Unforgeable quantum encryption Christian Majenz Joint work with - PowerPoint PPT Presentation

Unforgeable quantum encryption Christian Majenz Joint work with Gorjan Alagic and Tommaso Gagliardoni

Authenticated Encryption! ( Using AES with 128 bit block size in Galois Counter Mode and SHA2 )

Taxonomy of security Authenticated encryption authenticity, secrecy Integrity Definition Integrity of ciphertexts Indistinguishability of ciphertexts (INT-CTXT) under adaptive chosen ciphertext attacks ( EUF-CMA for encryption ≈ (IND-CCA2) schemes) Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks (IND-CCA1) = implication Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA)

Taxonomy of security Authenticated encryption authenticity, secrecy Integrity Integrity of ciphertexts Indistinguishability of ciphertexts (INT-CTXT) under adaptive chosen ciphertext attacks ( EUF-CMA for encryption ≈ (IND-CCA2) schemes) Indistinguishability of ciphertexts Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks under chosen ciphertext attacks (IND-CCA1) (IND-CCA1) Broadbent and Je ff ery, Crypto 2015 Alagic et al., ICITS 2016 Indistinguishability of ciphertexts Indistinguishability of ciphertexts under chosen plaintext attacks under chosen plaintext attacks (IND-CPA) (IND-CPA)

Taxonomy of security Authenticated encryption authenticity, secrecy Integrity No quantum version!!! Why not, what is the di ffi culty? Integrity of ciphertexts Indistinguishability of ciphertexts (INT-CTXT) under adaptive chosen ciphertext attacks ( EUF-CMA for encryption ≈ (IND-CCA2) schemes) Indistinguishability of ciphertexts Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks under chosen ciphertext attacks (IND-CCA1) (IND-CCA1) Broadbent and Je ff ery, Crypto 2015 Alagic et al., ICITS 2016 Indistinguishability of ciphertexts Indistinguishability of ciphertexts under chosen plaintext attacks under chosen plaintext attacks (IND-CPA) (IND-CPA)

Integrity of ciphertexts An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k c 1 c 2 c q Success: i ) c * ≠ c i for all i = 1,..., q m 1 m 2 m q … ii ) Dec k ( c *) ≠ ⊥ c * What about encryption of quantum data?

Quantum i (attempt) Integrity of ciphertexts An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k c 1 c 2 c q Success: i ) c * ≠ c i for all i = 1,..., q m 1 m 2 m q … ii ) Dec k ( c *) ≠ ⊥ c * What about encryption of quantum data?

Quantum i (attempt) Integrity of ciphertexts Quantum An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k c 1 c 2 c q Success: i ) c * ≠ c i for all i = 1,..., q m 1 m 2 m q … ii ) Dec k ( c *) ≠ ⊥ c * What about encryption of quantum data?

Quantum i (attempt) Integrity of ciphertexts Quantum An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k Enc k | c q ⟩ | c 1 ⟩ | c 2 ⟩ Success: i ) c * ≠ c i for all i = 1,..., q … | m q ⟩ | m 1 ⟩ | m 2 ⟩ ii ) Dec k ( c *) ≠ ⊥ c * What about encryption of quantum data?

Quantum i (attempt) Integrity of ciphertexts Quantum An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k Enc k | c q ⟩ | c 1 ⟩ | c 2 ⟩ Success: i ) c * ≠ c i for all i = 1,..., q … | m q ⟩ | m 1 ⟩ | m 2 ⟩ ii ) Dec k ( c *) ≠ ⊥ | c * ⟩ What about encryption of quantum data?

Quantum i (attempt) Integrity of ciphertexts Quantum An encryption scheme has integrity of ciphertexts, if no successfull (KeyGen, Enc, Dec) ciphertext-forging adversary exists: Enc k Enc k | c q ⟩ | c 1 ⟩ | c 2 ⟩ Success: ???????????? i ) … | m q ⟩ | m 1 ⟩ | m 2 ⟩ ii ) Dec k ( | c * ⟩ ) ≠ | ⊥ ⟩ | c * ⟩ What about encryption of quantum data? Unsurmountable problems arise: • no-cloning: can’t copy for later comparison with . | c i ⟩ | c * ⟩ • destructive nature of quantumn measurement: even assuming we had coexisting copies of and , can’t compare them without destroying . | c i ⟩ | c * ⟩ | c * ⟩ IND-CCA2: Adversary gets decryption oracle after the challenge phase, but can’t decrypt the challenge. Similar problem ⟹

Quantum (plaintext) unforgeability — Setup Quantum (plaintext) unforgeability For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum Enc k c 1 c 2 c q Success: i ) m * := Dec k ( c *) ≠ m i for all i = 1,..., q m 1 m 2 m q … ii ) Dec k ( c *) ≠ ⊥ c *

Quantum (plaintext) unforgeability — Setup Quantum (plaintext) unforgeability For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum Enc k Enc k | c q ⟩ | c 1 ⟩ | c 2 ⟩ Success: ???????????? i ) … | m q ⟩ | m 1 ⟩ | m 2 ⟩ ii ) Dec k ( | c * ⟩ ) ≠ | ⊥ ⟩ | c * ⟩

Quantum (plaintext) unforgeability — Setup For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum Enc k Enc k C q C 1 C 2 Success: ???????????? i ) M q M 1 M 2 … ii ) M * ≠ | ⊥ ⟩ Dec k C * M *

Quantum (plaintext) unforgeability — Setup For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum Enc k Enc k C q C 1 C 2 Success: ???????????? i ) M q M 1 M 2 … ii ) M * ≠ | ⊥ ⟩ Dec k C * M * Problem: and don’t coexist. Ideas M i M * • look at the channels with input and output . M i M * • compare two games, one testing whether any of these channels is the identity, one testing validity of output • e ffi ciency needed for reduction proofs

Identity test How do we test whether a quantum channel is the identity? one e ffi cient solution (Broadbent & Waynewright ICITS 2016): Λ | ϕ + ⟩ | ϕ + ⟩ ⟨ ϕ + | or 𝕁 − | ϕ + ⟩ ⟨ ϕ + | ? inner product in the Choi-Jamio ł kowski picture other identity tests possible that don’t need entanglement…. Let be the identity test from register to register . Id R 1 R 2 R 1 R 2

Two games QUF-Forge game Enc k Enc k Success: C q C 1 C 2 i ) ∅ M q M 1 M 2 ii ) M * ≠ | ⊥ ⟩ … Dec k C * M * QUF-Test game Enc k Run For all . (Ok by gentle i Id M ′ � C 1 C 2 C q i M * measurement lemma) M ′ � M ′ � M ′ � 1 2 q Cheat (=“Success”): succeeds for at least one i i ) Id M ′ � i M * M 1 M 2 M q ii ) ∅ … Dec k C * M *

Quantum (plaintext) unforgeability — Definition Definition (Quantum plaintext unforgeability): A quantum encryption scheme has (KeyGen, Enc, Dec) unforgeable plaintexts, if for all QPT adversaries it holds that 𝒝 ℙ [ 𝒝 wins QUF − forge ] − ℙ [ 𝒝 wins QUF − test ] ≤ negl( n )

Quantum (plaintext) unforgeability — Definition Two games QUF-Forge game Enc k Enc k Success: C q C 1 C 2 i ) ∅ M q M 1 M 2 ii ) M * ≠ | ⊥ ⟩ … Dec k C * M * QUF-Test game Enc k Run For all . (Ok by gentle i Id M ′ � C 1 C 2 C q i M * measurement lemma) M ′ � M ′ � M ′ � 1 2 q Cheat (=“Success”): succeeds for at least one i i ) Id M ′ � i M * M 1 M 2 M q ii ) ∅ … Dec k C * M *

Quantum (plaintext) unforgeability — Definition Definition (Quantum plaintext unforgeability): A quantum encryption scheme has (KeyGen, Enc, Dec) unforgeable plaintexts, if for all QPT adversaries it holds that 𝒝 ℙ [ 𝒝 wins QUF − forge ] − ℙ [ 𝒝 wins QUF − test ] ≤ negl( n ) • implies IND-CPA, ok because authentication encryption (Barnum et al. 2002) . ⟹ • classical restriction is equivalent to authenticated encryption • can be upgraded to quantum ciphertext authentication: ✴ possible via lemma: any quantum encryption function can be implemented by classical sampling and unitary transformation ✴ use identity test for quantum part and save a copy of classical randomness

What I couldn’t explain in 17 min… QIND-CCA2: Use identity test to detect challenge decryption, again by comparing two games quantum authenticated encryption? Could define as QUF+QIND-CCA2, but… …alternative real vs. ideal characterization (Shrimpton, 2004) is made for the identity testing technique! separate definition: QAE ⟹ simple construction from pseudorandom functions and unitary 2-designs

Taxonomy of quantum security new notions

Conclusion • Generalizing authenticity and integrity security notions (and adaptive CCA security) to quantum is complicated by the fact that states from di ff erent stages of an algorithm cannot be compared • Divide and conquer! If it is impossible to check two properties in one game, use two (indistinguishable) games! • That way we get quantum versions of the integrity notions used in modern crypto. • They can be fulfilled and have nice relationships. What’s left to do? • Is QAE=QUF+QIND-CCA2? • Relationship to quantum world notions?