Composability in quantum cryptography

Abstract

If we combine two secure cryptographic systems, is the resulting system still secure? Answering this question is highly non-trivial and has recently sparked a considerable research effort, in particular in the area of classical cryptography. A central insight was that the answer to the question is yes, but only within a well specified composability framework and for carefully chosen security definitions.In this article, we review several aspects of composability in the context of quantum cryptography. The first part is devoted to key distribution. We discuss the security criteria that a quantum key distribution protocol must fulfill to allow its safe use within a larger security application (e.g., for secure message transmission); and we demonstrate-by an explicit example-what can go wrong if conventional (non-composable) security definitions are used. Finally, to illustrate the practical use of composability, we show how to generate a continuous key stream by sequentially composing rounds of a quantum key distribution protocol.In a second part, we take a more general point of view, which is necessary for the study of cryptographic situations involving, for example, mutually distrustful parties. We explain the universal composability framework and state the composition theorem which guarantees that secure protocols can securely be composed to larger applications. A focus is set on the secure composition of quantum protocols into unconditionally secure classical protocols. However, the resulting security definition is so strict that some tasks become impossible without additional security assumptions. Quantum bit commitment is impossible in the universal composability framework even with mere computational security. Similar problems arise in the quantum bounded storage model and we observe a trade-off between the universal composability and the use of the weakest possible security assumptions.2 Quantum Key Distribution (QKD) QKD in a NutshellQuantum key distribution (QKD) is the art of distributing a secret key to two distant parties, Alice and Bob, connected by an insecure quantum channel. Technically, a secret key is simply a random bitstring for which there is a certain guarantee that its value is unknown to an adversary, Eve. Such a key may be used for a variety of cryptographic tasks. The most prominent among them is certainly the secure transmission of secret messages over an insecure channel. Here, the key typically serves as a one-time-pad for message encryption.In the past two decades, numerous QKD schemes have been proposed. Although they differ in many aspects (such as their realizability with current technology), they still very much resemble the original protocols put forward by Bennett and Brassard [5] (based on ideas by Wiesner [48]) and by Ekert [16]. We will not attempt here to give a description of these protocols. In fact, for the purpose of this article, it is sufficient to take a rather abstract point of view, where the internal workings of the protocols are unimportant. (The reader interested...

Finite-key analysis for measurement-device-independent quantum key distribution

“…Before stating the protocol, let us quickly review the security framework 35,36 that we are considering here. A general QKD protocol (executed by Alice and Bob) generates either a pair of bit strings S A and S B , or a symbol ?…”

“…With this security definition we are able to guarantee that the security of the protocol holds even when combined with other protocols, that is, the protocol is secure in the so-called universally composable framework 35,36 .…”

“…First, in contrast to existing heuristic results on mdiQKD, we provide, for the first time, a security proof in the finite-key regime that is valid against general attacks and satisfies the composability definition 35,36 of QKD. Second, we apply large deviation theory, specifically a multiplicative form of the Chernoff bound 37 , to perform the parameter estimation step.…”

Full Security of Quantum Key Distribution From No-Signaling Constraints

“…By setting and erco to sufficiently small values, the honest parties can be confident of the fact that the secret key generated by the protocol is indistinguishable from an ideal secret key (10). This implies that the protocol is secure according to the strongest notion of security, the so called universally-composable security [21,34] (see Section II E).…”

“…This is the strongest notion of security, and it is called universally composable security [19,20,34,35]. It is often the case that the secret key generated by a QKD protocol is used as an ingredient for another cryptographic task.…”