# Provably secure key establishment against quantum adversaries

## TL;DR

This paper presents a classical key establishment protocol secure against quantum adversaries, with provable bounds on the number of quantum queries needed for eavesdroppers to learn the key, advancing quantum-resistant cryptography.

## Contribution

It extends previous work by providing rigorous security proofs and new tools for quantum query complexity analysis, demonstrating practical quantum-resistant key establishment.

## Key findings

- Classical protocol achieves O(N) expected queries for key establishment.
- Quantum eavesdropper requires O(N^{1.5-e}) queries to learn the key with high probability.
- Develops new methods for lower bounds on quantum distinguishability and a composition theorem.

## Abstract

At Crypto 2011, some of us had proposed a family of cryptographic protocols for key establishment capable of protecting quantum and classical legitimate parties unconditionally against a quantum eavesdropper in the query complexity model. Unfortunately, our security proofs were unsatisfactory from a cryptographically meaningful perspective because they were sound only in a worst-case scenario. Here, we extend our results and prove that for any e > 0, there is a classical protocol that allows the legitimate parties to establish a common key after O(N) expected queries to a random oracle, yet any quantum eavesdropper will have a vanishing probability of learning their key after O(N^{1.5-e}) queries to the same oracle. The vanishing probability applies to a typical run of the protocol. If we allow the legitimate parties to use a quantum computer as well, their advantage over the quantum eavesdropper becomes arbitrarily close to the quadratic advantage that classical legitimate parties enjoyed over classical eavesdroppers in the seminal 1974 work of Ralph Merkle. Along the way, we develop new tools to give lower bounds on the number of quantum queries required to distinguish two probability distributions. This method in itself could have multiple applications in cryptography. We use it here to study average-case quantum query complexity, for which we develop a new composition theorem of independent interest.