Security of Y-00 and similar quantum cryptographic protocols
Horace P. Yuen, Prem Kumar, Eric Corndorf, Ranjith Nair
备注：
V.2 is a comprehensive response to Nishioka et. al., and also contains a brief response to Lo and Ko (quant-ph/0309127). We have provided a concise, and hopefully understandable, description of the security characteristics of AlphaEta for both direct encryption as well as key generation. Submitted to Physics Letters A, Oct. 2004
It is claimed in Phys. Lett. A by T. Nishioka et. al. 327 (2004) 28-32, that the security of Y-00 is equivalent to that of a classical stream cipher. In this paper it is shown that the claim is false in either the use of Y-00 for direct encryption or key generation, in all the parameter ranges it is supposed to operate including those of the experiments reported thus far. The security of Y-00 type protocols is clarified.
We show that the Csiszar-Korner sufficient condition for secure cryptographic key generation with the help of quantum theory can be easily derived using the triangle inequality for an information-theoretic distance.
Due to the impossibility results of Mayers and Lo/Chau it is generally thought that a quantum channel is cryptographically strictly weaker than oblivious transfer. In this paper we prove that in a three party scenario a quantum channel can be strictly stronger than oblivious transfer. With the protocol introduced in this paper we can completely classify the cryptographic strength of quantum multi party protocols.
This paper presents a hybrid cryptographic protocol, using quantum and classical resources, to generate a key for authentication and optionally for encryption in a network. One or more trusted servers distribute streams of entangled photons to individual resources that seek to communicate. An important class of cheating by a compromised server will be detected.
Standard quantum cryptographic protocols are not secure if one assumes that nonlocal hidden variables exist and can be measured with arbitrary precision. The security can be restored if one of the communicating parties randomly switches between two standard protocols.
In this paper we consider a three-state variant of the BB84 quantum key distribution (QKD) protocol. We derive a new lower-bound on the key rate of this protocol in the asymptotic scenario and use mismatched measurement outcomes to improve the channel estimation. Our new key rate bound remains positive up to an error rate of $11\%$, exactly that achieved by the four-state BB84 protocol.
We investigate a fundamental property of device independent security in quantum cryptography by characterizing probability distributions which are necessarily independent of the measurement results of any eavesdropper. We show that probability distributions that are secure in this sense are exactly the extremal quantum probability distributions. This allows us to give a characterization of security in algebraic terms. We apply the method to common examples for two-party as well as multi-party setups and present a scheme for verifying security of probability distributions with two parties, two …
Recently, Pawlowski [Phys. Rev. A 82, 032313 (2010)] claimed to have proven the security of a quantum key distribution by using only the monogamy of Bell's inequality violations. In the proof, however, he tacitly assumed that the eavesdropper's outcome is binary. The assumption cannot be justified because Eve's (eavesdropper's) power can only be limited by natural principle. We provide a counter-example for a step of the proof.
We introduce a new control strategy on a two-way deterministic cryptographic scheme, which relies on a suitable unitary transformation rather than quantum measurement. The study is developed for d-ary alphabets and the particular choice of the transformation works when d is an odd prime power. It leads to an improvement of the protocol security, which we prove to increase with the alphabet order d.
In this reply I address the comment by W-Y. Hwang and O. Gittsovich on my paper [Phys. Rev. A {\bf 82}, 032313 (2010)]. The authors of the comment point out that I use implicit assumption that the alphabet of the eavesdropper is binary. They claim that such assumption is unrealistic. Here I show that even without this assumption the main result of my paper still holds.
This paper consists of musings that originate mainly from conversations with other physicists, as together we've tried to learn some cryptography, but also from conversations with a couple of classical cryptographers. The main thrust of the paper is an attempt to explore the ramifications for cryptographic security of incorporating physics into our thinking at every level. I begin by discussing two fundamental cryptographic principles, namely that security must not rely on secrecy of the protocol and that our local environment must be secure, from a physical perspective. I go on to explain why…
We show that monogamy of Bell's inequality violations, which is strictly weaker condition than no-signaling is enough to prove security of quantum key distribution. We derive our results for a whole class of monogamy constraints and generalize our results to any theory that communicating parties may have access to. Some of these theories do not respect no-signaling principle yet still allow for secure communication. This proves that no-signaling is only a sufficient condition for the possibility of secure communication, but not the necessary one. We also present some new qualitative results co…
We propose a multiparty quantum cryptographic protocol. Unitary operators applied by Bob and Charlie, on their respective qubits of a tripartite entangled state encodes a classical symbol that can be decoded at Alice's end with the help of a decoding matrix. Eve's presence can be detected by the disturbance of the decoding matrix. Our protocol is secure against intercept-resend attacks. Furthermore, it is efficient and deterministic in the sense that two classical bits can be transferred per entangled pair of qubits. It is worth mentioning that in this protocol same symbol can be used for key …
A central claim in quantum cryptography is that secrecy can be proved rigorously, based on the assumption that the relevant information-processing systems obey the laws of quantum physics. This claim has recently been challenged by Bernstein (arXiv:1803.04520). He argues that the laws of physics may also entail an unavoidable leakage of any classical information encoded in physical carriers. The security claim of quantum key distribution would then be vacuous, as the computation of the final secret key would leak its value. However, as we explain in this short note, Bernstein's reasoning is ba…
Public-key quantum money is a cryptographic protocol in which a bank can create quantum states which anyone can verify but no one except possibly the bank can clone or forge. There are no secure public-key quantum money schemes in the literature; as we show in this paper, the only previously published scheme [1] is insecure. We introduce a category of quantum money protocols which we call collision-free. For these protocols, even the bank cannot prepare multiple identical-looking pieces of quantum money. We present a blueprint for how such a protocol might work as well as a concrete example wh…
We consider a cryptographically motivated framework for quantum metrology in the presence of a malicious adversary. We begin by devising an estimation strategy for a (potentially) altered resource (due to a malicious adversary) and quantify the amount of bias and the loss in precision as a function of the introduced uncertainty in the resource. By incorporating an appropriate cryptographic protocol, the uncertainty in the resource can be bounded with respect to the soundness of the cryptographic protocol. Thus the effectiveness of the quantum metrology problem can be directly related to the ef…
The Gaussian quantum key distribution protocol based on coherent states and heterodyne detection [Phys. Rev. Lett. 93, 170504 (2004)] has the advantage that no active random basis switching is needed on the receiver's side. Its security is, however, not very satisfyingly understood today because the bounds on the secret key rate that have been derived from Heisenberg relations are not attained by any known scheme. Here, we address the problem of the optimal Gaussian individual attack against this protocol, and derive tight upper bounds on the information accessible to an eavesdropper. The opti…
We present a protocol for quantum cryptographic network consisting of a quantum network center and many users, in which any pair of parties with members chosen from the whole users on request can secure a quantum key distribution by help of the center. The protocol is based on the quantum authentication scheme given by Barnum et al. [Proc. 43rd IEEE Symp. FOCS'02, p. 449 (2002)]. We show that exploiting the quantum authentication scheme the center can safely make two parties share nearly perfect entangled states used in the quantum key distribution. This implies that the quantum cryptographic …
We propose a wide class of distillation schemes for multi-partite entangled states that are CSS-states. Our proposal provides not only superior efficiency, but also new insights on the connection between CSS-states and bipartite graph states. We then apply our distillation schemes to the tri-partite case for three cryptographic tasks--namely, (a) conference key agreement, (b) quantum sharing of classical secrets and (c) third-man cryptography. Moreover, we construct ``prepare-and-measure'' protocols for the above three cryptographic tasks which can be implemented with the generation of only a …
Quantum cloud computing is emerging as a popular model for users to experience the power of quantum computing through the internet, enabling quantum computing as a service. The question is, when the scale of the computational problems becomes out of reach of classical computers, how can users be sure that the output strings sent by the server are really from a quantum hardware? In 2008, Shepherd and Bremner proposed a cryptographic verification protocol based on a simplified circuit model called IQP (instantaneous quantum polynomial-time), which can potentially be applied to most existing quan…
This work is intended as an introduction to cryptographic security and a motivation for the widely used Quantum Key Distribution (QKD) security definition. We review the notion of security necessary for a protocol to be usable in a larger cryptographic context, i.e., for it to remain secure when composed with other secure protocols. We then derive the corresponding security criterion for QKD. We provide several examples of QKD composed in sequence and parallel with different cryptographic schemes to illustrate how the error of a composed protocol is the sum of the errors of the individual prot…
The commitment of bits between two mutually distrustful parties is a powerful cryptographic primitive with which many cryptographic objectives can be achieved. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. Gaps in the proof of this impossibility theorem are found. An unconditionally secure bit commitment protocol utilizing anonymous quantum states and the no-clone theorem is presented below with a full security proof.
New quantum cryptography, often called Y-00 protocol, has much higher performance than the conventional quantum cryptographies. It seems that the conventional quantum cryptographic attacks are inefficient at Y-00 protocol as its security is based on the different grounds from that of the conventional ones. We have, then, tried to cryptoanalyze Y-00 protocol in the view of cryptographic communication system. As a result, it turns out that the security of Y-00 protocol is equivalent to that of classical stream cipher.
Quantum cryptographic conferencing (QCC) holds promise for distributing information-theoretic secure keys among multiple users over long distance. Limited by the fragility of Greenberger-Horne-Zeilinger (GHZ) state, QCC networks based on directly distributing GHZ states at long distance still face big challenge. Another two potential approaches are measurement device independent QCC and conference key agreement with single-photon interference, which was proposed based on the post-selection of GHZ states and the post-selection of W state, respectively. However, implementations of the former pro…
We present a system to measure the distance between two parties that allows only trusted people to access the result. The security of the protocol is guaranteed by the complementarity principle in quantum mechanics. The protocol can be realized with available technology, at least as a proof of principle experiment.
We develop a general framework for parameter estimation that allows only trusted parties to access the result and achieves optimal precision. The protocols are designed such that adversaries can access some information indeterministically, but only at the risk of getting caught (cheat-sensitivity); under the assumption that the adversary can access the channel only once, then the protocol is unconditionally secure. By combining techniques from quantum cryptography and quantum metrology, we devise cryptographic procedures for single parameter estimation when an arbitrary number of parties are i…
In quantum key distribution, one conservatively assumes that the eavesdropper Eve is restricted only by physical laws, whereas the legitimate parties, namely the sender Alice and receiver Bob, are subject to realistic constraints, such as noise due to environment-induced decoherence. In practice, Eve too may be bound by the limits imposed by noise, which can give rise to the possibility that decoherence works to the advantage of the legitimate parties. A particular scenario of this type is one where Eve can't replace the noisy communication channel with an ideal one, but her eavesdropping chan…
Methods of quantum mechanics promise information-theoretic security for various protocols in cryptography. However, impossibility of some cryptographic applications such as standard bit commitment, oblivious transfer, multiparty secure computations and ideal coin tossing in quantum regime leaves an obvious question on the completeness of quantum cryptography. Instead of using wide range of rules and techniques for a variety of cryptographic applications, we demonstrate here a unified structure for quantum cryptography based on quantum non-local correlations. The unified framework achieves same…
A cryptographic algorithm is proposed based on fully quantum mechanical keys and ciphers. Encryption and decryption are carried out via an appropriate measurement process on entangled states as governed by a quantum mechanical, asymmetrical and dynamical public key distribution. The use of public keys leads to a high availability of our scheme, while their quantum nature is shown to ensure unconditional security of the proposed algorithm.
Experimental Phase-Matching Quantum Cryptographic Conferencing in Symmetric and Asymmetric Fiber Channels
Hefei National Laboratory, University of Science and Technology of China（中国科学技术大学合肥国家实验室）；Hefei National Research Center for Physical Sciences at the Microscale and School of Physical Sciences, University of Science and Technology of China（中国科学技术大学微尺度物质科学国家研究中心物理学院）；CAS Center for Excellence in Quantum Information and Quantum Physics, University of Science and Technology of China（中国科学技术大学量子信息科学研究院）；School of Cyberspace, Hangzhou Dianzi University（杭州电子科技大学网络空间学院）；Pinghu Digital Technology Innovation Research Institute, Hangzhou Dianzi University（杭州电子科技大学平湖数字技术创新研究院）；Shanghai Research Center for Quantum Science and CAS Center for Excellence in Quantum Information and Quantum Physics, University of Science and Technology of China（中国科学技术大学上海量子科学研究中心和量子信息科学研究院）
The realm of this thesis is cryptographic protocol theory in the quantum world. We study the security of quantum and classical protocols against adversaries that are assumed to exploit quantum effects to their advantage. Security in the quantum world means that quantum computation does not jeopardize the assumption, underlying the protocol construction. But moreover, we encounter additional setbacks in the security proofs, which are mostly due to the fact that some well-known classical proof techniques are forbidden by certain properties of a quantum environment. Interestingly, we can exploit …
Comparison of security mechanisms of Mathematical cipher, Wyner scheme, QKD, and Quantum stream cipher
Optical Quantum Information Technology Laboratory（光学量子信息技术实验室）；Quantum ICT Research Institute, Tamagawa University（多摩大学量子ICT研究所）；Research and Development Initiative, Chuo University（中央大学研发倡议）
Quantum key distribution protocols are known to be vulnerable against a side channel attack that exploits the time difference in detector responses used to obtain key bits. The recommended solution against this timing side channel attack is to use a large time bin width instead of high resolution timing information. Common notion is that using a large bin width reduces the resolution of detector responses, hence supposedly minimizes the information leakage to an eavesdropper. We challenge this conventional wisdom, and demonstrate that increasing the bin width does not monotonically reduce the …
Several quantum process algebras have been proposed and successfully applied in verification of quantum cryptographic protocols. All of the bisimulations proposed so far for quantum processes in these process algebras are state-based, implying that they only compare individual quantum states, but not a combination of them. This paper remedies this problem by introducing a novel notion of distribution-based bisimulation for quantum processes. We further propose an approximate version of this bisimulation that enables us to prove more sophisticated security properties of quantum protocols which …
Entropic uncertainty relations are underpinning to compute the quantitative security bound in quantum cryptographic applications, such as quantum random number generation (QRNG) and quantum key distribution (QKD). All security proofs derive a relation between the information accessible to the legitimate group and the maximum knowledge that an adversary may have gained, Eve, which exploits entropic uncertainty relations to lower bound Eve's uncertainty about the raw key generated by one party, Alice. The standard entropic uncertainty relations is to utilize the smooth min- and max-entropies to …
Cryptographic protocols, such as protocols for secure function evaluation (SFE), have played a crucial role in the development of modern cryptography. The extensive theory of these protocols, however, deals almost exclusively with classical attackers. If we accept that quantum information processing is the most realistic model of physically feasible computation, then we must ask: what classical protocols remain secure against quantum attackers? Our main contribution is showing the existence of classical two-party protocols for the secure evaluation of any polynomial-time function under reasona…
In this letter, we proposed a quantum authentication protocol. The authentication process is implemented by the symmetric cryptographic scheme with quantum effects.
We present a protocol for the amplification and distribution of a one-time-pad cryptographic key over a point-to-multipoint optical network based on computational ghost imaging (GI) and compressed sensing (CS). It is shown experimentally that CS imaging can perform faster authentication and increase the key generation rate by an order of magnitude compared with the scheme using computational GI alone. The protocol is applicable for any number of legitimate user, thus, the scheme could be used in real intercity networks where high speed and high security are crucial.
The recent application of the principles of quantum mechanics to cryptography has led to a remarkable new dimension in secret communication. As a result of these new developments, it is now possible to construct cryptographic communication systems which detect unauthorized eavesdropping should it occur, and which give a guarantee of no eavesdropping should it not occur. CONTENTS P3. Cryptographic systems before quantum cryptography P7. Preamble to quantum cryptography P10. The BB84 quantum cryptographic protocol without noise P16. The BB84 quantum cryptographic protocol with noise P19..The B92…
Attacks on classical cryptographic protocols are usually modeled by allowing an adversary to ask queries from an oracle. Security is then defined by requiring that as long as the queries satisfy some constraint, there is some problem the adversary cannot solve, such as compute a certain piece of information. In this paper, we introduce a fundamentally new model of quantum attacks on classical cryptographic protocols, where the adversary is allowed to ask several classical queries in quantum superposition. This is a strictly stronger attack than the standard one, and we consider the security of…
We call quantum security the area of IT security dealing with scenarios where one or more parties have access to quantum hardware. This encompasses both the fields of post-quantum cryptography (that is, traditional cryptography engineered to be resistant against quantum adversaries), and quantum cryptography (that is, security protocols designed to be natively run on a quantum infrastructure, such as quantum key distribution). In this work, we propose the first systematic classification of quantum security scenarios, and for each of them we recall the main tools and results, as well as present…
Quantum Cryptography is a rapidly developing field of research that benefits from the properties of Quantum Mechanics in performing cryptographic tasks. Quantum walks are a powerful model for quantum computation and very promising for quantum information processing. In this paper, we present a quantum public-key cryptographic system based on quantum walks. In particular, in the proposed protocol the public key is given by a quantum state generated by performing a quantum walk. We show that the protocol is secure and analyze the complexity of public-key generation and encryption/decryption proc…
We present new connections between quantum information and the field of classical cryptography. In particular, we provide examples where Simon's algorithm can be used to show insecurity of commonly used cryptographic symmetric-key primitives. Specifically, these examples consist of a quantum distinguisher for the 3-round Feistel network and a forgery attack on CBC-MAC which forges a tag for a chosen-prefix message querying only other messages (of the same length). We assume that an adversary has quantum-oracle access to the respective classical primitives. Similar results have been achieved re…
Proof of security of cryptographic protocols theoretically establishes the strength of a protocol and the constraints under which it can perform, it does not take into account the overall design of the protocol. In the past model checking has been successfully applied to classical cryptographic protocols to weed out design flaws which would have otherwise gone unnoticed. Quantum cryptographic protocols differ from their classical counterparts, in their ability to detect the presence of an eavesdropper. Although unconditional security has been proven for both BB84 and B92 protocols, in this pap…
Hacking Cryptographic Protocols with Advanced Variational Quantum Attacks
Multiverse Computing（多元宇宙计算公司）；Tecnun - University of Navarra（纳瓦拉大学 Tecnun 学院）；Donostia International Physics Center（多诺斯蒂亚国际物理中心）；Ikerbasque Foundation for Science（伊克尔巴斯克科学基金会）
The appealing feature of quantum key distribution (QKD), from a cryptographic viewpoint, is the ability to prove the information-theoretic security (ITS) of the established keys. As a key establishment primitive, QKD however does not provide a standalone security service in its own: the secret keys established by QKD are in general then used by a subsequent cryptographic applications for which the requirements, the context of use and the security properties can vary. It is therefore important, in the perspective of integrating QKD in security infrastructures, to analyze how QKD can be combined…
