Quantum Security of Cryptographic Primitives

TL;DR

This paper introduces a systematic classification of quantum security scenarios, covering classical, post-quantum, hybrid, and quantum-native cryptography, providing a foundational framework for future research in quantum IT security.

Contribution

It proposes the first comprehensive classification of quantum security domains, detailing tools, results, and new insights for each scenario.

Findings

Defined four quantum security classes: QS0, QS1, QS2, QS3.

Analyzed security reductions and challenges in post-quantum cryptography.

Presented a framework to formalize security notions in quantum environments.

Abstract

We call quantum security the area of IT security dealing with scenarios where one or more parties have access to quantum hardware. This encompasses both the fields of post-quantum cryptography (that is, traditional cryptography engineered to be resistant against quantum adversaries), and quantum cryptography (that is, security protocols designed to be natively run on a quantum infrastructure, such as quantum key distribution). In this work, we propose the first systematic classification of quantum security scenarios, and for each of them we recall the main tools and results, as well as presenting new ones. We achieve this goal by identifying four distinct quantum security classes, or domains, each of them encompassing the security notions and constructions related to a particular scenario. We start with the class QS0, which is `classical cryptography' (meaning that no quantum scenario is considered). Regarding post-quantum cryptography, we introduce the class QS1, where we discuss in detail the problems arising when designing a classical cryptographic object meant to be resistant against adversaries with local quantum computing power, and we provide a classification of the possible quantum security reductions in this scenario when considering provable security. In respect to hybrid classical-quantum models, in the security class QS2 we discuss in detail the possible scenarios where these scenarios arise, and what a correct formalization should be in terms of quantum oracle access. Finally, in the class QS3 we consider all those cryptographic constructions designed to run natively on quantum hardware. We believe that the framework we introduce in this work will be a valuable tool for the scientific community in addressing the challenges arising when formalizing sound constructions and notions of security in the quantum world.

Full text

\newcites

myList of Publications

\setlrmargins**1 \checkandfixthelayout \setpnumwidth1.8em \setrmarg1.8em \nouppercaseheads \makechapterstylemadsenplain

\newsubfloatfigure \captionnamefont \captiontitlefont \loosesubcaptions

\chapterstylemadsenplain

This document is an electronic version with minor modifications of the original, published through the E-Publishing-Service of the TU Darmstadt.

http://tuprints.ulb.tu-darmstadt.de

tuprints@ulb.tu-darmstadt.de

This document is released under the following Creative Commons license:

Attribution – NonCommercial – NoDerivatives – International 4.0

http://creativecommons.org/licenses/by-nc-nd/4.0/

Acknowledgments

Being a PhD student is a strange experience. I am sure that everyone who goes through this experience has their own personal stories, difficult moments to remember, and funny anecdotes to tell. I, for one, can truly say that these last five years have been exciting, funny, and productive. In short, they have been intense, and I can really say at the end that I have grown up a lot, both from an academic and from a personal perspective.

All of this I owe to my advisor, Marc Fischlin. If I could travel back in time and I were given the choice of applying as a PhD student again, at any one research group I possibly wished for, I would still spam ruthlessly my application to Marc. He taught me a lot of things which go well beyond academic matters, and I value his guidance immensely. When I was accepted in Marc’s group in 2011, I was not aware at the time of how privileged I was. Now I am, and for this I will owe forever a debt of gratitude to Marc.

Being part of the group was a great experience, and I really would like to thank a lot my present and former colleagues for this. I am particularly grateful to Andrea for being always there to help me with the bureaucracy, to Giorgia for helping me to support the thesis that Hawaii Pizza is a mortal sin, to Özgür for taking care of me during my first months in Darmstadt, and to Paul for sharing with me a lot of good time, laugh, and hate for pigeons. I am also very grateful to Arno, Chris, Christian, Cristina, Felix, Jacqueline, Pooya, Sogol, and Victoria, for their friendship and support. Thank you all!

I would also like to thank all my coauthors for many successful collaborations and for having helped me a lot into expanding my scientific knowledge. Sometimes collaboration turned into sincere friendship as well, and therefore I would like to thank in particular Gorjan Alagic, Andreas Hülsing, Nikolaos Karvelas, and Christian Schaffner for the priceless time spent together.

Finally, I would like to thank my family for their endless love and support. I will always look at you as an example and a guidance, and I strive to make you proud of me every day of my life. Thanks.

Tommaso Gagliardoni

Darmstadt, December 2016

Abstract

We call quantum security the area of IT security dealing with scenarios where one or more parties have access to quantum hardware. This encompasses both the fields of post-quantum cryptography (that is, traditional cryptography engineered to be resistant against quantum adversaries), and quantum cryptography (that is, security protocols designed to be natively run on a quantum infrastructure, such as quantum key distribution). Moreover, there exist also hybrid models, where traditional cryptographic schemes are somehow ‘mixed’ with quantum operations in certain scenarios. Even if a fully-fledged, scalable quantum computer has yet to be built, recent results and the pace of research in its realization call for attention, lest we suddenly find ourselves one day with an obsolete security infrastructure. For this reason, in the last two decades research in quantum security has experienced an exponential growth in interest and investments.

In this work, we propose the first systematic classification of quantum security scenarios, and for each of them we recall the main tools and results, as well as presenting new ones. We achieve this goal by identifying four distinct quantum security classes, or domains, each of them encompassing the security notions and constructions related to a particular scenario. We start with the class $\mathbf{QS}$0, which is ‘classical cryptography’ (meaning that no quantum scenario is considered), where we present some classical constructions and results as a preliminary step.

Regarding post-quantum cryptography, we introduce the class $\mathbf{QS}$1, where we discuss in detail the problems arising when designing a classical cryptographic object meant to be resistant against adversaries with local quantum computing power, and we provide a classification of the possible quantum security reductions in this scenario when considering provable security. Moreover, we present results about the quantum security and insecurity of the Fiat-Shamir transformation (a useful tool used to turn interactive identification schemes into digital signatures), and ORAMs (protocols used to outsource a database in a private way).

In respect to hybrid classical-quantum models, in the security class $\mathbf{QS}$2 we discuss in detail the possible scenarios where these scenarios arise, and what a correct formalization should be in terms of quantum oracle access. We also provide a novel framework for the quantum security (both in terms of indistinguishability and semantic security) of secret-key encryption schemes, and we give explicit secure constructions, as well as impossibility results.

Finally, in the class $\mathbf{QS}$3 we consider all those cryptographic constructions designed to run natively on quantum hardware. We give constructions for quantum encryption schemes (both in the secret- and public-key scenario), and we introduce transformations for obtaining such schemes by conceptually simpler schemes from the class $\mathbf{QS}$2. Moreover, we introduce a quantum version of ORAM, called quantum ORAM (QORAM), aimed at outsourcing in a private way a database composed of quantum data. In proposing a suitable security model and an explicit construction for QORAMs, we also introduce a technique of independent interest which models a quantum adversary able to extract information from a quantum system without disturbing it ‘too much’.

We believe that the framework we introduce in this work will be a valuable tool for the scientific community in addressing the challenges arising when formalizing sound constructions and notions of security in the quantum world.