Semantic Security and Indistinguishability in the Quantum World

Abstract

At CRYPTO 2013, Boneh and Zhandry initiated the study of quantum-secure encryption. They proposed first indistinguishability definitions for the quantum world where the actual indistinguishability only holds for classical messages, and they provide arguments why it might be hard to achieve a stronger notion. In this work, we show that stronger notions are achievable, where the indistinguishability holds for quantum superpositions of messages. We investigate exhaustively the possibilities and subtle differences in defining such a quantum indistinguishability notion for symmetric-key encryption schemes. We justify our stronger definition by showing its equivalence to novel quantum semantic-security notions that we introduce. Furthermore, we show that our new security definitions cannot be achieved by a large class of ciphers -- those which are quasi-preserving the message length. On the other hand, we provide a secure construction based on quantum-resistant pseudorandom permutations; this construction can be used as a generic transformation for turning a large class of encryption schemes into quantum indistinguishable and hence quantum semantically secure ones. Moreover, our construction is the first completely classical encryption scheme shown to be secure against an even stronger notion of indistinguishability, which was previously known to be achievable only by using quantum messages and arbitrary quantum encryption circuits.Comment: 37 pages, 2 figure

On Quantum Chosen-Ciphertext Attacks and Learning with Errors

“…The classical proof of the above (see, e.g., [Gol09]) carries over directly to the quantum case. This was already observed for the case of QCPA by [GHS16], and extends straightforwardly to the case where both the adversary and the simulator gain oracle access to Dec k in the pre-challenge phase. 6 4 Secure Constructions…”

“…Security model and basic definitions. First, we set down the basic QCCA1 security model, adapting the ideas of [BZ13a; GHS16]. Recall that an encryption scheme is a triple Π = (KeyGen, Enc, Dec) of algorithms (key generation, encryption, and decryption, respectively) satisfying Dec k (Enc k (m)) = m for any key k ← KeyGen and message m. In what follows, all oracles are quantum, meaning that a function f is accessed via the unitary operator |x |y → |x |y ⊕ f (x) .…”

“…This leads to natural security notions for symmetric-key encryption, which we call IND-QCCA1 and SEM-QCCA1, respectively. Following previous works, it is straightforward to define both IND-QCCA1 and SEM-QCCA1 formally, and prove that they are equivalent [BJ15; GHS16;BZ13b].…”

“…This is the case for hashing, public-key encryption, and circuit obfuscation. Moreover, understanding this model is crucial for gauging the degree to which any physical device involved in cryptography must be resistant to reverse engineering or forced quantum behavior (consider, e.g., the so-called "frozen smart card" example [GHS16]). For instance, one may reasonably ask: what happens to the security of a classical cryptosystem when the device leaks only a single quantum query to the adversary?…”

“…Prior works have formalized the quantum-accessible model for classical cryptography in several settings, including unforgeable message authentication codes and digital signatures [BZ13b; BZ13a], encryption secure against quantum chosen-plaintext attacks (QCPA) [BJ15; GHS16], and encryption secure against adaptive quantum chosen-ciphertext attacks (QCCA2) [BZ13b].…”