New security notions and feasibility results for authentication of quantum data

TL;DR

This paper introduces new security definitions for quantum data authentication, demonstrating their advantages, and presents protocols that meet these standards, including classical schemes secure against quantum attacks and a lifting theorem for state authentication.

Contribution

It proposes a new class of security definitions for quantum authentication, showing their implications and providing protocols that satisfy these enhanced security notions.

Findings

Classical Wegman-Carter scheme with 3-universal hashing is secure against quantum attacks.

Presented simple constructions for full quantum state authentication.

Proved a lifting theorem enabling secure authentication of any quantum state.

Abstract

We give a new class of security definitions for authentication in the quantum setting. These definitions capture and strengthen existing definitions of security against quantum adversaries for both classical message authentication codes (MACs) and well as full quantum state authentication schemes. The main feature of our definitions is that they precisely characterize the effective behavior of any adversary when the authentication protocol accepts, including correlations with the key. Our definitions readily yield a host of desirable properties and interesting consequences; for example, our security definition for full quantum state authentication implies that the entire secret key can be re-used if the authentication protocol succeeds. Next, we present several protocols satisfying our security definitions. We show that the classical Wegman-Carter authentication scheme with 3-universal hashing is secure against superposition attacks, as well as adversaries with quantum side information. We then present conceptually simple constructions of full quantum state authentication. Finally, we prove a lifting theorem which shows that, as long as a protocol can securely authenticate the maximally entangled state, it can securely authenticate any state, even those that are entangled with the adversary. Thus, this shows that protocols satisfying a fairly weak form of authentication security automatically satisfy a stronger notion of security (in particular, the definition of Dupuis, et al (2012)).