Revocable Quantum Timed-Release Encryption

We prove the security of NMAC, HMAC, AMAC, and the cascade construction with fixed input-length as quantum-secure pseudorandom functions (PRFs). Namely, they are indistinguishable from a random oracle against any polynomial-time quantum adversary that can make quantum superposition queries. In contrast, many blockcipherbased PRFs including CBC-MAC were recently broken by quantum superposition attacks. Classical proof strategies for these constructions do not generalize to the quantum setting, and we observe that they sometimes even fail completely (e.g., the universal-hash then PRF paradigm for proving security of NMAC). Instead, we propose a direct hybrid argument as a new proof strategy (both classically and quantumly). We first show that a quantumsecure PRF is secure against key-recovery attacks, and remains secure under random leakage of the key. Next, as a key technical tool, we extend the oracle indistinguishability framework of Zhandry in two directions: we consider distributions on functions rather than strings, and we also consider a relative setting, where an additional oracle, possibly correlated with the distributions, is given to the adversary as well. This enables a hybrid argument to prove the security of NMAC. Security proofs for other constructions follow similarly.

show abstract

“…To prove Theorem 4.2, we are going to use the following lemma of Unruh. [17]). Let H : X → Y be a random oracle.…”

Section: Security Of Prfs Under Random Leakagementioning

confidence: 99%

Quantum Security of NMAC and Related Constructions

Song

Yun

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…1 in such a way that four cipherstates lie in the xz-plane [40], corresponding to linear polarisation. Another physical implementation of qubits is to use pulse trains as in Di↵erential Phase Shift QKD [38], but with di↵erent amplitudes and phases. As topics for future work we mention (i) security proof for the proposed key recycling scheme; (ii) using the moments listed in Table 4 to derive a sharper bound on |⇢ g ⌧ | 1 and max (⇢ g ⌧ ).…”

Section: Discussionmentioning

confidence: 99%

“…From (38) we can derive an expression like Theorem 6.5 for the sufficient key length to obtain a ∞-norm version of ε-privacy; only the constant terms are different.…”

Section: Discussionmentioning

confidence: 99%

“…If Bob accepts then the message remains confidential even if Eve learns the full encryption key afterward. UE can be useful for primitives like revocable time-release encryption [38], for communication-efficient QKD, and in attacker models where the storage of keys suffers particular vulnerabilities. Gottesman identified the chain of implications: quantum authentication =⇒ UE =⇒ QKD.…”

Section: Unclonable Encryptionmentioning

confidence: 99%

See 1 more Smart Citation

Quantum Key Recycling with 8-state encoding (The Quantum One-Time Pad is more interesting than we thought)

Škorić

Vries

2017

Int. J. Quantum Inform.

View full text Add to dashboard Cite

Perfect encryption of quantum states using the Quantum One-Time Pad (QOTP) requires two classical key bits per qubit. Almost-perfect encryption, with information-theoretic security, requires only slightly more than 1. We slightly improve lower bounds on the key length. We show that key length [Formula: see text] suffices to encrypt [Formula: see text] qubits in such a way that the cipherstate’s [Formula: see text]-distance from uniformity is upperbounded by [Formula: see text]. For a stricter security definition involving the [Formula: see text]-norm, we prove sufficient key length [Formula: see text], where [Formula: see text] is a small probability of failure. Our proof uses Pauli operators, whereas previous results on the [Formula: see text]-norm needed Haar measure sampling. We show how to QOTP-encrypt classical plaintext in a nontrivial way: we encode a plaintext bit as the vector [Formula: see text] on the Bloch sphere. Applying the Pauli encryption operators results in eight possible cipherstates which are equally spread out on the Bloch sphere. This encoding, especially when combined with the half-keylength option of QOTP, has advantages over 4-state and 6-state encoding in applications such as Quantum Key Recycling (QKR) and Unclonable Encryption (UE). We propose a key recycling scheme that is more efficient and can tolerate more noise than a recent scheme by Fehr and Salvail. For 8-state QOTP encryption with pseudorandom keys, we do a statistical analysis of the cipherstate eigenvalues. We present numerics up to nine qubits.

show abstract

“…In order to consider quantum adversaries and quantum queries, the concept of one-way to hiding (O2H) [9] is introduced in the security proofs.…”

confidence: 99%

Post-Quantum Security of IGE Mode Encryption in Telegram

Lee

Kim

Lee

et al. 2019

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

IGE mode used in Telegram's customized protocol has not been fully investigated in terms of post-quantum security. In this letter, we show that IGE mode is IND-qCPA insecure by Simon's algorithm, assuming that the underlying block cipher is a standard-secure pseudorandom function (sPRF). Under a stronger assumption that the block cipher is a quantumsecure pseudorandom function (qPRF), IND-qCPA security of IGE mode is proved using one-way to hiding lemma.

show abstract

Revocable Quantum Timed-Release Encryption

Cited by 73 publications

References 35 publications

Quantum Security of NMAC and Related Constructions

Quantum Security of NMAC and Related Constructions

Quantum Key Recycling with 8-state encoding (The Quantum One-Time Pad is more interesting than we thought)

Post-Quantum Security of IGE Mode Encryption in Telegram

Contact Info

Product

Resources

About