Quantum Encryption with Certified Deletion, Revisited: Public Key, Attribute-Based, and Classical Communication

Abstract

Broadbent and Islam (TCC '20) proposed a quantum cryptographic primitive called quantum encryption with certified deletion. In this primitive, a receiver in possession of a quantum ciphertext can generate a classical certificate that the encrypted message is deleted. Although their construction is information-theoretically secure, it is limited to the setting of one-time symmetric key encryption (SKE), where a sender and receiver have to share a common key in advance and the key can be used only once. Moreover, the sender has to generate a quantum state and send it to the receiver over a quantum channel in their construction. Although deletion certificates are privately verifiable, which means a verification key for a certificate has to be kept secret, in the definition by Broadbent and Islam, we can also consider public verifiability.In this work, we present various constructions of encryption with certified deletion. * This is a major update version of the paper by Nishimaki and Yamakawa [NY21] with many new results.one-shot signatures prevents decryption of witness encryption after issuing a valid deletion certificate. Georgiou and Zhandry [GZ20] used a similar combination of one-shot signatures and witness encryption to construct unclonable decryption keys. Related workBefore the work by Broadbent and Islam [BI20], Fu and Miller [FM18] and Coiteux-Roy and Wolf [CRW19] also studied the concept of certifying deletion of information in different settings. (See [BI20] for the comparison with these works.)The quantum encryption scheme with certified deletion by Broadbent and Islam [BI20] is based on Wiesner's conjugate coding, which is the backbone of quantum money [Wie83] and quantum key distribution [BB84]. A similar idea has been used in many constructions in quantum cryptography that include (but not limited to) revocable quantum timed-release encryption [Unr15], uncloneable quantum encryption [BL20], single-decryptor encryption [GZ20], and copy protection/secure software leasing [CMP20]. Among them, revocable quantum timed-release encryption is conceptually similar to quantum encryption with certified deletion. In this primitive, a receiver can decrypt a quantum ciphertext only after spending a certain amount of time T . The receiver can also choose to return the ciphertext before the time T is over, in which case it is ensured that the message can no longer be recovered. As observed by Broadbent and Islam [BI20], an essential difference from quantum encryption with certified deletion is that the revocable quantum timed-release encryption does not have a mechanism to generate a classical certificate of deletion. Moreover, the construction by Unruh [Unr15] heavily relies on the random oracle heuristic [BR97, BDF + 11], and there is no known construction without random oracles.Kundu and Tan [KT20] constructed (one-time symmetric key) quantum encryption with certified deletion with the device-independent security, i.e., the security holds even if quantum devices are untrusted. Moreover, they show that their cons...

Quantum cryptography with classical communication: parallel remote state preparation for copy-protection, verification, and more

“…In addition to this line of work focused on rigidity statements, application-specific dequantisations were already considered for private-key quantum money [RS19], certifiable deletion of quantum encryption [HMNY21] and secure software leasing [KNY21]. In all these cases the authors derived the desired security statement from properties of trapdoor claw-free functions, a cryptographic primitive which is also the basis of our RSP protocol.…”

Depth-efficient proofs of quantumness

“…A number of followup results also made use of TCFs in this way, allowing for the efficient certification of randomness generation [BCM + 18], remote quantum state preparation [GV19, CCKW19, MV21], device-independent cryptography [MDCAF20], zero-knowledge [VZ20] and others [ACGH20, CCY20, KNY20,HMNY21]. Since all of these protocols require the quantum prover to coherently evaluate the TCFs, which are polynomial-depth classical circuits, the prover must have the ability to perform polynomial-depth quantum circuits.…”