Unforgeable quantum encryption Christian Majenz Joint work with - PowerPoint PPT Presentation

Unforgeable quantum encryption Christian Majenz Joint work with Gorjan Alagic and Tommaso Gagliardoni

Authenticated Encryption! ( Using AES with 128 bit block size in Galois Counter Mode and SHA2 )

Authenticated Encryption! ( Using AES with 128 bit block size in Galois Counter Mode and SHA2 )

Taxonomy of security

Taxonomy of security secrecy

Taxonomy of security authenticity, secrecy Integrity

Taxonomy of security authenticity, secrecy Integrity Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA)

Taxonomy of security authenticity, secrecy Integrity Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks (IND-CCA1) = implication Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA)

Taxonomy of security authenticity, secrecy Integrity Indistinguishability of ciphertexts under adaptive chosen ciphertext attacks (IND-CCA2) Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks (IND-CCA1) = implication Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA)

Taxonomy of security authenticity, secrecy Integrity Integrity of ciphertexts Indistinguishability of ciphertexts (INT-CTXT) under adaptive chosen ciphertext attacks ( EUF-CMA for encryption ≈ (IND-CCA2) schemes) Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks (IND-CCA1) = implication Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA)

Taxonomy of security Authenticated encryption authenticity, secrecy Integrity Definition Integrity of ciphertexts Indistinguishability of ciphertexts (INT-CTXT) under adaptive chosen ciphertext attacks ( EUF-CMA for encryption ≈ (IND-CCA2) schemes) Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks (IND-CCA1) = implication Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA)

Taxonomy of security Authenticated encryption authenticity, secrecy Integrity Integrity of ciphertexts Indistinguishability of ciphertexts (INT-CTXT) under adaptive chosen ciphertext attacks ( EUF-CMA for encryption ≈ (IND-CCA2) schemes) Indistinguishability of ciphertexts Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks under chosen ciphertext attacks (IND-CCA1) (IND-CCA1) Broadbent and Je ff ery, Crypto 2015 Alagic et al., ICITS 2016 Indistinguishability of ciphertexts Indistinguishability of ciphertexts under chosen plaintext attacks under chosen plaintext attacks (IND-CPA) (IND-CPA)

Taxonomy of security Authenticated encryption authenticity, secrecy Integrity No quantum version!!! Why not, what is the di ffi culty? Integrity of ciphertexts Indistinguishability of ciphertexts (INT-CTXT) under adaptive chosen ciphertext attacks ( EUF-CMA for encryption ≈ (IND-CCA2) schemes) Indistinguishability of ciphertexts Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks under chosen ciphertext attacks (IND-CCA1) (IND-CCA1) Broadbent and Je ff ery, Crypto 2015 Alagic et al., ICITS 2016 Indistinguishability of ciphertexts Indistinguishability of ciphertexts under chosen plaintext attacks under chosen plaintext attacks (IND-CPA) (IND-CPA)

Integrity of ciphertexts An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists:

Integrity of ciphertexts An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k

Integrity of ciphertexts An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k c 1 m 1

Integrity of ciphertexts An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k c 1 c 2 m 1 m 2

Integrity of ciphertexts An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k c 1 c 2 c q m 1 m 2 m q …

Integrity of ciphertexts An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k c 1 c 2 c q m 1 m 2 m q … c *

Integrity of ciphertexts An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k c 1 c 2 c q Success: i ) c * ≠ c i for all i = 1,..., q m 1 m 2 m q … ii ) Dec k ( c *) ≠ ⊥ c *

Integrity of ciphertexts An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k c 1 c 2 c q Success: i ) c * ≠ c i for all i = 1,..., q m 1 m 2 m q … ii ) Dec k ( c *) ≠ ⊥ c * What about encryption of quantum data?

Quantum i (attempt) Integrity of ciphertexts An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k c 1 c 2 c q Success: i ) c * ≠ c i for all i = 1,..., q m 1 m 2 m q … ii ) Dec k ( c *) ≠ ⊥ c * What about encryption of quantum data?

Quantum i (attempt) Integrity of ciphertexts Quantum An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k c 1 c 2 c q Success: i ) c * ≠ c i for all i = 1,..., q m 1 m 2 m q … ii ) Dec k ( c *) ≠ ⊥ c * What about encryption of quantum data?

Quantum i (attempt) Integrity of ciphertexts Quantum An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k Enc k | c q ⟩ | c 1 ⟩ | c 2 ⟩ Success: i ) c * ≠ c i for all i = 1,..., q … | m q ⟩ | m 1 ⟩ | m 2 ⟩ ii ) Dec k ( c *) ≠ ⊥ c * What about encryption of quantum data?

Quantum i (attempt) Integrity of ciphertexts Quantum An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k Enc k | c q ⟩ | c 1 ⟩ | c 2 ⟩ Success: i ) c * ≠ c i for all i = 1,..., q … | m q ⟩ | m 1 ⟩ | m 2 ⟩ ii ) Dec k ( c *) ≠ ⊥ | c * ⟩ What about encryption of quantum data?

Quantum i (attempt) Integrity of ciphertexts Quantum An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k Enc k | c q ⟩ | c 1 ⟩ | c 2 ⟩ Success: ???????????? i ) … | m q ⟩ | m 1 ⟩ | m 2 ⟩ ii ) Dec k ( | c * ⟩ ) ≠ | ⊥ ⟩ | c * ⟩ What about encryption of quantum data?

Quantum i (attempt) Integrity of ciphertexts Quantum An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k Enc k | c q ⟩ | c 1 ⟩ | c 2 ⟩ Success: ???????????? i ) … | m q ⟩ | m 1 ⟩ | m 2 ⟩ ii ) Dec k ( | c * ⟩ ) ≠ | ⊥ ⟩ | c * ⟩ What about encryption of quantum data? Unsurmountable problems arise: • no-cloning: can’t copy for later comparison with . | c i ⟩ | c * ⟩ • destructive nature of quantumn measurement: even assuming we had coexisting copies of and , can’t compare them without destroying . | c i ⟩ | c * ⟩ | c * ⟩

Quantum i (attempt) Integrity of ciphertexts Quantum An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k Enc k | c q ⟩ | c 1 ⟩ | c 2 ⟩ Success: ???????????? i ) … | m q ⟩ | m 1 ⟩ | m 2 ⟩ ii ) Dec k ( | c * ⟩ ) ≠ | ⊥ ⟩ | c * ⟩ What about encryption of quantum data? Unsurmountable problems arise: • no-cloning: can’t copy for later comparison with . | c i ⟩ | c * ⟩ • destructive nature of quantumn measurement: even assuming we had coexisting copies of and , can’t compare them without destroying . | c i ⟩ | c * ⟩ | c * ⟩ IND-CCA2: Adversary gets decryption oracle after the challenge phase, but can’t decrypt the challenge. Similar problem ⟹

Quantum (plaintext) unforgeability — Setup Quantum (plaintext) unforgeability For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum Enc k c 1 c 2 c q Success: i ) m * := Dec k ( c *) ≠ m i for all i = 1,..., q m 1 m 2 m q … ii ) Dec k ( c *) ≠ ⊥ c *

Quantum (plaintext) unforgeability — Setup Quantum (plaintext) unforgeability For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum Enc k Enc k | c q ⟩ | c 1 ⟩ | c 2 ⟩ Success: ???????????? i ) … | m q ⟩ | m 1 ⟩ | m 2 ⟩ ii ) Dec k ( | c * ⟩ ) ≠ | ⊥ ⟩ | c * ⟩