Cryptography with Disposable Backdoors

Abstract

Backdooring cryptographic algorithms is an indisputable taboo in the cryptographic literature for a good reason: however noble the intentions, backdoors might fall in the wrong hands, in which case security is completely compromised. Nonetheless, more and more legislative pressure is being produced to enforce the use of such backdoors. In this work we introduce the concept of disposable cryptographic backdoors which can be used only once and become useless after that. These exotic primitives are impossible in the classical digital world without stateful and secure trusted hardware support, but, as we show, are feasible assuming quantum computation and access to classical stateless hardware tokens. Concretely, we construct a disposable (single-use) version of message authentication codes, and use them to derive a black-box construction of stateful hardware tokens in the above setting with quantum computation and classical stateless hardware tokens. This can be viewed as a generic transformation from stateful to stateless tokens and enables, among other things, one-time programs and memories. This is to our knowledge the first provably secure construction of such primitives from stateless tokens. As an application of disposable cryptographic backdoors we use our constructed primitive above to propose a middle-ground solution to the recent legislative push to backdoor cryptography: the conflict between Apple and FBI. We show that it is possible for Apple to create a one-time backdoor which unlocks any single device, and not even Apple can use it to unlock more than one, i.e., the backdoor becomes useless after it is used. We further describe how to use our ideas to derive a version of CCA-secure public key encryption, which is accompanied with a disposable (i.e., single-use, as in the above scenario) backdoor.

Towards Quantum One-Time Memories from Stateless Hardware

“…Specifically, in [Chu+19], security against a polynomial number of queries is achieved, albeit with respect to a new definition of "OTMs relative to an oracle" (while the security results of the present paper are with respect to the well-established simulation-based definition of [Goy+10;Kat07]). Furthermore, [Chu+19] directly applies known quantum money constructions, which require difficult-to-prepare highly entangled states. Our focus here, in contrast, is to take a "first-principles" approach and build a technologically simple-to-implement scheme which requires no entanglement, but rather the preparation of just one of four single qubit states, |0 , |1 , |+ , |− .…”

“…The current paper hence employs a different proof approach, which models interaction with the token as a "quantum game" via semidefinite programming (further details below). Since our original paper was posted, recent work [Chu+19] has shown an alternate quantum "stateful to stateless" transformation via quantum money constructions [BDS18]. Specifically, in [Chu+19], security against a polynomial number of queries is achieved, albeit with respect to a new definition of "OTMs relative to an oracle" (while the security results of the present paper are with respect to the well-established simulation-based definition of [Goy+10;Kat07]).…”

“…Since our original paper was posted, recent work [Chu+19] has shown an alternate quantum "stateful to stateless" transformation via quantum money constructions [BDS18]. Specifically, in [Chu+19], security against a polynomial number of queries is achieved, albeit with respect to a new definition of "OTMs relative to an oracle" (while the security results of the present paper are with respect to the well-established simulation-based definition of [Goy+10;Kat07]). Furthermore, [Chu+19] directly applies known quantum money constructions, which require difficult-to-prepare highly entangled states.…”

Noise-Tolerant Quantum Tokens for MAC

“…Similarly, it is also possible to construct unforgeable public quan-tum money [AC13, Zha21, FGH + 12] from public tokenized digital signatures (as shown in [BS16]) which is a stronger and much harder primitive to build. Another application of TMAC is that of disposable-cryptographic backdoors [CGLZ19]. For a cryptographic primitive such as an encryption scheme, the task is to give a one-time backdoor access to the secret information such as the message hidden under the cipher, in case of an encryption.…”

“…However, these primitives cannot exist in the standard model even in a quantum setting, see [GKR08,BGS13]. In [CGLZ19], the authors show how to construct one-time programs from TMACs relative to a classical stateless oracle.…”