Block encryption of quantum messages

TL;DR

This paper introduces a new quantum block encryption scheme called $ ext{EHE}$ that allows key reuse and achieves security comparable to the quantum one-time pad, overcoming classical limitations and enabling practical quantum encryption.

Contribution

The paper presents the $ ext{EHE}$ mode for quantum encryption, enabling key reuse and perfect security, which was previously thought impossible in classical cryptography.

Findings

The scheme achieves indistinguishability under chosen plaintext attack with secure pseudorandom functions.

It allows exponential encryption of qubits with a reusable 2n-bit key.

Implementation requires only simple single-qubit gates, feasible with current technology.

Abstract

In modern cryptography, block encryption is a fundamental cryptographic primitive. However, it is impossible for block encryption to achieve the same security as one-time pad. Quantum mechanics has changed the modern cryptography, and lots of researches have shown that quantum cryptography can outperform the limitation of traditional cryptography. This article proposes a new constructive mode for private quantum encryption, named $\mathcal{EHE}$, which is a very simple method to construct quantum encryption from classical primitive. Based on $\mathcal{EHE}$ mode, we construct a quantum block encryption (QBE) scheme from pseudorandom functions. If the pseudorandom functions are standard secure, our scheme is indistinguishable encryption under chosen plaintext attack. If the pseudorandom functions are permutation on the key space, our scheme can achieve perfect security. In our scheme, the key can be reused and the randomness cannot, so a $2n$-bit key can be used in an exponential number of encryptions, where the randomness will be refreshed in each time of encryption. Thus $2n$-bit key can perfectly encrypt $O(n2^n)$ qubits, and the perfect secrecy would not be broken if the $2n$-bit key is reused for only exponential times. Comparing with quantum one-time pad (QOTP), our scheme can be the same secure as QOTP, and the secret key can be reused (no matter whether the eavesdropping exists or not). Thus, the limitation of perfectly secure encryption (Shannon's theory) is broken in the quantum setting. Moreover, our scheme can be viewed as a positive answer to the open problem in quantum cryptography "how to unconditionally reuse or recycle the whole key of private-key quantum encryption". In order to physically implement the QBE scheme, we only need to implement two kinds of single-qubit gates (Pauli $X$ gate and Hadamard gate), so it is within reach of current quantum technology.

Equations

$$U_f:\sum _{x\in \mathcal{X},y\in \mathcal{Y}}{\alpha }_{x,y}|x⟩|y⟩⟶\sum _{x\in \mathcal{X},y\in \mathcal{Y}}{\alpha }_{x,y}|x⟩|y\oplus f(x)⟩,$$

$$O_f:(x,y)\to (x,y\oplus f(x)),\forall x\in \mathcal{X},y\in \mathcal{Y}.$$

$$Ad{v}_F^{PRF}(\mathcal{A})\triangleq \left|\underset{k\stackrel{R}{\leftarrow }\mathcal{K}}{\mathrm{Pr}}[{\mathcal{A}}^{F_k}()=1]-\underset{f\stackrel{R}{\leftarrow }Fun{c}_n}{\mathrm{Pr}}[{\mathcal{A}}^f()=1]\right|$$

$$\left|\underset{k\leftarrow \mathcal{K}}{\mathrm{Pr}}[{\mathcal{A}}^{F_k}()=1]-\underset{f\leftarrow Fun{c}_n}{\mathrm{Pr}}[{\mathcal{A}}^f()=1]\right|<ϵ.$$

$$\left|\underset{k\leftarrow \mathcal{K}}{\mathrm{Pr}}[{\mathcal{A}}^{|F_k⟩}()=1]-\underset{f\leftarrow Fun{c}_n}{\mathrm{Pr}}[{\mathcal{A}}^{|f⟩}()=1]\right|<ϵ.$$

$$\left|\underset{k\leftarrow \mathcal{K}}{\mathrm{Pr}}[{\mathcal{A}}^{F_k,G}()=1]-\underset{f\leftarrow Fun{c}_n}{\mathrm{Pr}}[{\mathcal{A}}^{f,G}()=1]\right|<ϵ(n),$$

$$\left|\underset{k\leftarrow \mathcal{K}}{\mathrm{Pr}}[{\mathcal{A}}^{F_k,G}()=1]-\underset{f\leftarrow Fun{c}_n}{\mathrm{Pr}}[{\mathcal{A}}^{f,G}()=1]\right|=\left|\underset{k\leftarrow \mathcal{K}}{\mathrm{Pr}}[{\mathcal{A}}_G^{F_k}()=1]-\underset{f\leftarrow Fun{c}_n}{\mathrm{Pr}}[{\mathcal{A}}_G^f()=1]\right|=Ad{v}_F^{PRF}({\mathcal{A}}_G).$$

$$\left|\underset{k\leftarrow \mathcal{K}}{\mathrm{Pr}}[{\mathcal{A}}^{F_k,G}()=1]-\underset{f\leftarrow Fun{c}_n}{\mathrm{Pr}}[{\mathcal{A}}^{f,G}()=1]\right|<ϵ(n),$$

$$\left|\underset{k\leftarrow \mathcal{K}}{\mathrm{Pr}}[{\mathcal{A}}^{|F_k⟩,|G⟩}()=1]-\underset{f\leftarrow Fun{c}_n}{\mathrm{Pr}}[{\mathcal{A}}^{|f⟩,|G⟩}()=1]\right|<ϵ(n),$$

$$\left|\underset{k\leftarrow \mathcal{K}\times \mathcal{K}}{\mathrm{Pr}}[{\mathcal{A}}^{H_k}()=1]-\underset{f\leftarrow Fun{c}_{2n}}{\mathrm{Pr}}[{\mathcal{A}}^f()=1]\right|<ϵ(n).$$

$$\left|\underset{k\leftarrow \mathcal{K}}{\mathrm{Pr}}[{\mathcal{A}}_1^{F_k}()=1]-\underset{f_1\leftarrow Fun{c}_n}{\mathrm{Pr}}[{\mathcal{A}}_1^{f_1}()=1]\right|<{ϵ}_1(n).$$

$$\left|\underset{k\leftarrow \mathcal{K}}{\mathrm{Pr}}[{\mathcal{A}}_2^{G_k}()=1]-\underset{f_2\leftarrow Fun{c}_n}{\mathrm{Pr}}[{\mathcal{A}}_2^{f_2}()=1]\right|<{ϵ}_2(n).$$

$$\left|\underset{k_1\leftarrow \mathcal{K},k_2\leftarrow \mathcal{K}}{\mathrm{Pr}}[{\mathcal{A}}^{F_{k_1},G_{k_2}}()=1]-\underset{f_1\leftarrow Fun{c}_n,f_2\leftarrow Fun{c}_n}{\mathrm{Pr}}[{\mathcal{A}}^{f_1,f_2}()=1]\right|$$

$$Dec(k_1,k_2,Enc(k_1,k_2,\sigma ))=\sigma ,\forall \sigma ,$$

$$\left|Pr[\mathcal{A}(\sum _{k\in \mathcal{K}}{p}_{k}Enc(k,{\sigma }_1))=1]-Pr[\mathcal{A}(\sum _{k\in \mathcal{K}}{p}_{k}Enc(k,{\sigma }_2))=1]\right|<ϵ(n),$$

$$\left|Pr[\mathcal{A}(\sum _{k\in \mathcal{K}}{p}_{k}Enc(k,\sigma ))=1]-Pr[\mathcal{A}(\sum _{k\in \mathcal{K}}{p}_{k}Enc(k,\frac{I}{2^n}))=1]\right|<ϵ(n),$$

$$\rho_{1}=\sum_{c\in\{0,1\}}p_{c}Enc(c,\sigma_{1})=\frac{1}{2}Enc(0,\sigma_{1})+\frac{1}{2}Enc(1,\sigma_{1})=\left(\begin{array}[]{cc}1/2&-i/2\\ i/2&1/2\\ \end{array}\right),$$

$$\rho_{2}=\sum_{c\in\{0,1\}}p_{c}Enc(c,\sigma_{2})=\frac{1}{2}Enc(0,\sigma_{2})+\frac{1}{2}Enc(1,\sigma_{2})=\left(\begin{array}[]{cc}1/2&0\\ 0&1/2\\ \end{array}\right).$$

$$E_F^{\prime }(k,\sum _m{\alpha }_m|m⟩)=\left(r,\sum _m{\alpha }_m|m\oplus F(k,r)⟩\right),$$

$$D_F^{\prime }(k,(r,\sum _c{\alpha }_c|c⟩))=\sum _c{\alpha }_c|c\oplus F(k,r)⟩.$$

$$E_F^{\prime }(k,|{\phi }_1⟩)$$

$$E_F^{\prime }(k,|{\phi }_2⟩)$$

$$\sum _{k\in \mathcal{K}}{p}_k{E}_F^{\prime }(k,|{\phi }_1⟩)$$

$$\sum _{k\in \mathcal{K}}{p}_k{E}_F^{\prime }(k,|{\phi }_2⟩)$$

$$Enc(k_1,k_2,\sigma )=(r_1,r_2,U_{k_1,k_2}^{F,G}(r_1,r_2)\sigma (U_{k_1,k_2}^{F,G}(r_1,r_2){)}^{†})\stackrel{△}{=}(r_1,r_2,\rho ),$$

$$Dec(k_1,k_2,(r_1,r_2,\rho ))=(U_{k_1,k_2}^{F,G}(r_1,r_2){)}^{†}\rho U_{k_1,k_2}^{F,G}(r_1,r_2).$$

$$X^{G(k_2,r_2)}{H}^{\otimes n}{X}^{F(k_1,r_1)}\sigma X^{F(k_1,r_1)}{H}^{\otimes n}{X}^{G(k_2,r_2)}=H^{\otimes n}{Z}^{G(k_2,r_2)}{X}^{F(k_1,r_1)}\sigma X^{F(k_1,r_1)}{Z}^{G(k_2,r_2)}{H}^{\otimes n}.$$

$$Enc(k_1,k_2,\sigma )=(r_1,r_2,Z^{G(k_2,r_2)}{X}^{F(k_1,r_1)}\sigma X^{F(k_1,r_1)}{Z}^{G(k_2,r_2)}),$$

$$Dec(k_1,k_2,(r_1,r_2,\rho ))=X^{F(k_1,r_1)}{Z}^{G(k_2,r_2)}\rho Z^{G(k_2,r_2)}{X}^{F(k_1,r_1)}.$$

$$Enc(k_1,k_2,\sigma )=(r_1,r_2,U_{k_1,k_2}^{F,G}(r_1,r_2)\sigma (U_{k_1,k_2}^{F,G}(r_1,r_2){)}^{†})\stackrel{△}{=}(r_1,r_2,\rho ).$$

$$O_{Enc(k_1,k_2,\ast )}(\rho )=(r_1,r_2,U_{k_1,k_2}^{F,G}(r_1,r_2)\rho (U_{k_1,k_2}^{F,G}(r_1,r_2){)}^{†})=(r_1,r_2,X^c{Z}^c\sigma Z^c{X}^c),$$

$$\left|Pr\left[\mathcal{A}(r_1,r_2,\frac{1}{|\mathcal{K}{|}^2}\sum _{k_1,k_2}{U}_{k_1,k_2}^{F,G}(r_1,r_2)\sigma (U_{k_1,k_2}^{F,G}(r_1,r_2){)}^{†})=1\right]-Pr\left[\mathcal{A}(r_1,r_2,\frac{I}{2^n})=1\right]\right|=ϵ(n).$$

Full text

This article proposes a new constructive mode for private quantum encryption, named $\mathcal{EHE}$, which is a very simple method to construct quantum encryption from classical primitive. Based on $\mathcal{EHE}$ mode, we construct a quantum block encryption (QBE) scheme from pseudorandom functions. If the pseudorandom functions are standard secure, our scheme is indistinguishable encryption under chosen plaintext attack. If the pseudorandom functions are permutation on the key space, our scheme can achieve perfect security. In our scheme, the key can be reused and the randomness cannot, so a $2n$-bit key can be used in an exponential number of encryptions, where the randomness will be refreshed in each time of encryption. Thus $2n$-bit key can perfectly encrypt $O(n2^{n})$ qubits, and the perfect secrecy would not be broken if the $2n$-bit key is reused for only exponential times.

Comparing with quantum one-time pad (QOTP), our scheme can be the same secure as QOTP, and the secret key can be reused (no matter whether the eavesdropping exists or not). Thus, the limitation of perfectly secure encryption (Shannon’s theory) is broken in the quantum setting. Moreover, our scheme can be viewed as a positive answer to the open problem in quantum cryptography “how to unconditionally reuse or recycle the whole key of private-key quantum encryption”. In order to physically implement the QBE scheme, we only need to implement two kinds of single-qubit gates (Pauli $X$ gate and Hadamard gate), so it is within reach of current quantum technology.

I Introduction

The combination of quantum mechanics and information science forms a new science – quantum information science, in which the information extends to quantum information. The requirement of processing quantum information occurs, and we have to develop quantum cryptographic technology for quantum information, e.g. encryption of quantum information. Since the quantum information can be seen as an extension of classical information in complex Hilbert space, the cryptographic schemes for quantum information are suitable for classical information, but not vice versa.

Quantum information encryption is a kind of basic quantum cryptographic primitive, especially the quantum one-time pad (QOTP), which has been applied in various quantum cryptographic schemes. For example, the quantum message authentication (QMA) is applied in the constructions of secure multiparty quantum computation [1] and quantum interactive proof [2], and the authenticity of QMA can be guaranteed by quantum encryption [3].

QOTP (or private quantum channel) [4, 5, 6, 7] is the first kind of quantum information encryption scheme, which uses preshared classical symmetric key and has perfect security. However, the secret key cannot be reused. The recycling issues of QOTP-key have been studied in some literatures [8]. Zhou et al. propose another symmetric-key encryption algorithm [9], which uses quantum-classical hybrid keys.

Public-key encryption of quantum messages is firstly studied by Yang [10], in which both the public key and private key are classical. Because the scheme is constructed based on NP-complete problem, it has computational security at the most. Later, public-key encryption schemes with computational security are studied in more literatures [11, 12, 13]. In addition, public-key encryption with information-theoretic security is also studied [14, 15].

Alagic et al.[16] propose a private-key scheme and a public-key encryption scheme for quantum data, both of which have computational security. The private-key scheme is constructed based on quantum pseudorandom function (PRF) and QOTP, but it is not indistinguishable against chosen ciphertext attack. The public-key scheme is constructed based on quantum trapdoor one-way permutation and QOTP.

There are some literatures about QMA [3, 17, 18] or non-malleable quantum encryption [19, 20]. Because authenticity of QMA implies encryption [3], those secure quantum authentication schemes can also be used as quantum message encryption scheme; However, the secret key cannot be reused or can be recycled partially.

I-A Our Results

We present a detailed description of $\mathcal{EHE}$ encryption. In the notation “$\mathcal{EHE}$”, each $\mathcal{E}$ represents a different quantum encryption operation, and $\mathcal{H}$ represents a transversal Hadamard transformation. Actually, QOTP can be viewed as a special case of $\mathcal{EHE}$ encryption, where each $\mathcal{E}$ is implemented by encrypting quantum superpositions using classical one-time pad.

Based on two PRFs, we construct a secure quantum block encryption (QBE) scheme in the form of $\mathcal{EHE}$ encryption. The idea is described in Fig.1. $\mathcal{E}(F)$ and $\mathcal{E}(G)$ are two classical block encryption (BE) schemes that are constructed based on two PRFs $F$ and $G$. $\mathcal{E}^{\prime}(F)$ and $\mathcal{E}^{\prime}(G)$ are insecure QBE schemes that are constructed using $\mathcal{E}(F)$ and $\mathcal{E}(G)$. The whole procedure of quantum encryption $\mathcal{E}(F,G):\sigma\in M_{1}\rightarrow\rho\in C_{2}$ can be finished in the three steps: (1) the quantum message $\sigma\in M_{1}$ is encrypted using the first QBE scheme $\mathcal{E}^{\prime}(F)$, and the obtained ciphertext is $\rho_{1}\in C_{1}$; (2) perform transversal Hadamard transformation on $\rho_{1}\in C_{1}$, and obtain $\rho_{2}\in C_{1}^{\prime}$; (3) If $C_{1}^{\prime}\subseteq M_{2}$, then $\rho_{2}\in M_{2}$ can be encrypted using the second QBE scheme $\mathcal{E}^{\prime}(G)$, and the obtained ciphertext is $\rho\in C_{2}$.

We study the security of QBE scheme $\mathcal{E}(F,G)$, and obtain the main results as follows.

Theorem 1** (informal)**

If PRFs $F,G$ are chosen independently and have standard security in the quantum computation setting, then $\mathcal{E}(F,G)$ is an IND-CPA-secure QBE scheme.

Theorem 2** (informal)**

$F,G$* are independent PRFs with standard security. If both $F$ and $G$ are permutations on the key space, then $\mathcal{E}(F,G)$ is a perfectly secure QBE scheme.*

Theorem 1 states that our QBE scheme can be IND-CPA-secure. The plaintext block has the same length as ciphertext block. Theorem 2 states that, in some particular case, the QBE scheme can have the same security as QOTP even if the keys are reused. Thus, our scheme can be viewed as a positive answer to an open problem in quantum cryptography “how to unconditionally reuse or recycle the whole key of private-key quantum encryption”, which has been studied in Refs.[8, 17, 18, 21, 22, 23].

QOTP has been widely applied in the theoretical design of various quantum encryption and authentication schemes [1, 2, 3, 14, 18]. Based on our results, we can consider modifying those QOTP-based schemes by replacing QOTP with perfectly secure QBE, and expect an obvious optimization, for example, recycling all the keys of the scheme in Ref.[18] or lifting weak authentication to total authentication [17].

I-B Related works

I-B1 How to construct quantum cryptographic primitives from classical ones

Based on quantum mechanics, the information extends to quantum information, and the computation extends to quantum computation. A natural question is whether or not the modern cryptography based on the information and computation could extend to quantum cryptography. Concretely, how to extend classical cryptographic primitive to quantum one? Our results give an answer from the aspect of BE (or pseudorandom functions). In addition, there are also some other related works.

In Ref.[10], a quantum public-key encryption scheme is proposed based on classical McEliece public-key cryptosystem. Later, more constructions are proposed [11]. In order to improve the security, Yang and Liang [13] propose the double-encryption technique, which is the origin of $\mathcal{EHE}$ encryption.

Garg et al. [17] propose the “Auth-QFT-Auth” pattern used to construct QMA scheme (denoted as $Auth_{2}(\mathcal{H}(Auth_{1}(\rho)))$), where $Auth_{1},Auth_{2}$ are the classical Wegman-Carter MAC schemes and $\mathcal{H}$ is the quantum Hadamard transform. Obviously, this pattern is very similar to $\mathcal{EHE}$ encryption.

In fact, QOTP can be viewed as an $\mathcal{EHE}$-like construction based on classical OTP: quantum states are encrypted using the classical one-time pad in the basis $\{|0\rangle,|1\rangle\}$, and then using the classical one-time pad in the basis $\{|+\rangle,|-\rangle\}$.

The most related work is Ref.[16], which propose a computationally secure framework for quantum encryption. However, their construction uses “PRF+QOTP” mode, and our construction uses $\mathcal{EHE}$ mode. In the spirit, $\mathcal{EHE}$ mode is a special combination of two insecure encryption. This mode of combination can be extended to construct more quantum cryptographic schemes.

I-B2 Quantum encryption with key recycling

OTP is a perfectly secure encryption scheme, but the key cannot be reused; In BE scheme, the key can be reused, but the security is weaker than OTP. In quantum cryptography, there exists the same problem: QOTP has the same security as OTP, but the key cannot be reused (Though we can use a QOTP with quantum key distribution, this would need more rounds of interaction and more communication.). In order to settle this problem, the researchers begin to consider how to recycle part of the keys or conditionally reuse the keys.

Damgard et al.[21, 22] show how to encrypt a classical message in a quantum state and recycle the key. Oppenheim and Horodecki [8] study how to encrypt a quantum message and recycle the key, and the key of QOTP can only be partially reused. Fehr and Salvail [23] propose a classical-message-oriented quantum authentication scheme with key recycling, in which the partial randomness can be extracted and be used as the OTP-key or QOTP-key. Then the combination of the authentication scheme and OTP (or QOTP) becomes a quantum encryption scheme with key recycling, and can be used to encrypt the classical or quantum information.

There are also some researches about QMA with key recycling [17, 18]. The “Auth-QFT-Auth” authentication scheme [17] allows conditionally recycling part of the keys: the inner key can be recycled upon successful verification, and the outer key unfortunately cannot be. Because any scheme to authenticate quantum messages must also encrypt them [3], these authentication schemes can also be used as encryption schemes with key recycling.

In all these schemes, the keys cannot be totally reused, and we will solve this problem through QBE scheme.

I-C Organization

In Section II, we introduce some basic notations, and review three kinds of PRFs. In Section II-C, we describe the $\mathcal{EHE}$ encryption technique. In Section III, we show how to construct IND-CPA-secure QBE scheme, and prove the perfectly secure scheme is achievable. Finally, we conclude and discuss these results.

II Preliminaries

II-A Notations and definitions

$Func_{n}=\{f|f:\{0,1\}^{n}\rightarrow\{0,1\}^{n}\}$ denotes the set of all the functions that map $n$ bits to $n$ bits. Define $\mathcal{Y}^{\mathcal{X}}$ as the set of functions $\{f|f:\mathcal{X}\rightarrow\mathcal{Y}\}$, then $Func_{n}=\mathcal{N}^{\mathcal{N}}$, where $\mathcal{N}=\{0,1\}^{n}$.

Any classical computable function $f\in\mathcal{Y}^{\mathcal{X}}$ can be implemented by a quantum computer, or be implemented as an oracle which is queried on quantum superpositions.

[TABLE]

where $\mathcal{X}$ and $\mathcal{Y}$ are the domain and range, respectively. $\sum_{x\in\mathcal{X},y\in\mathcal{Y}}$ can be briefly written as $\sum_{x,y}$ without leading to any misunderstanding. $\mathcal{A}^{|f\rangle}$ represents the quantum adversary $\mathcal{A}$ can access to $f$ with quantum superposition queries. $\mathcal{A}^{f}$ represents the (classical or quantum) adversary $\mathcal{A}$ can access to $f$ classically

[TABLE]

PRF is the basic primitive in modern cryptography. A PRF is a polynomial-time computable function $F:\mathcal{K}\times\mathcal{X}\rightarrow\mathcal{Y}$, where $\mathcal{K}$, $\mathcal{X}$ and $\mathcal{Y}$ are the key space, the domain and range, respectively. Denote $\mathcal{K}\times\mathcal{X}=\{(k,x):k\in\mathcal{K},x\in\mathcal{X}\}$. $\mathcal{K},\mathcal{X},\mathcal{Y}$ are implicit functions of the security parameter $n$. We write $y=F_{k}(x)$ or $y=F(k,x)$.

Definition 1** (PRF)**

A function $F:\mathcal{K}\times\mathcal{X}\rightarrow\mathcal{Y}$ is PRF, if for any probabilistic polynomial-time (PPT) adversary $\mathcal{A}$, the advantage of $\mathcal{A}$ while distinguishing between a truly random function $f$ and the function $F_{k}$ for a uniformly chosen $k$

[TABLE]

is negligible. We write $k\xleftarrow{R}\mathcal{K}$ to represent the key $k$ is drawn from $\mathcal{K}$ uniformly and randomly. $f\xleftarrow{R}Func_{n}$ represents the function $f$ is uniformly chosen from $Func_{n}$. The notations can be briefly written as $k\leftarrow\mathcal{K}$ and $f\leftarrow Func_{n}$.

“$\epsilon(n)$ is negligible” means that, for any polynomial $p(n)$, there exists $n_{0}$ such that $\epsilon(n)<\frac{1}{p(n)},\forall n>n_{0}$.

Pauli $X$ gate and $Z$ gate can be represented as: X=\left(\begin{array}[]{cc}0&1\\ 1&0\\ \end{array}\right), Z=\left(\begin{array}[]{cc}1&0\\ 0&-1\\ \end{array}\right), and Hadamard gate is H=\frac{1}{\sqrt{2}}\left(\begin{array}[]{cc}1&1\\ 1&-1\\ \end{array}\right). Given any unitary matrix $U$ and a $n$-bit string $b=b_{1}b_{2}\cdots b_{n}$ ($b_{i}$ is the $i$-th bit of the string $b$), we write $U^{b}$ to denote $\bigotimes_{i=1}^{n}U^{b_{i}}$. Particularly, $U^{\otimes n}=\bigotimes_{i=1}^{n}U=U^{11\cdots 1}$.

For two $n$-bit strings $a,b\in\{0,1\}^{n}$, define $a\odot b=\sum_{i=1}^{n}a_{i}b_{i}(\mathrm{mod}2)$.

We write $[[p_{k},U_{k},k\in\mathcal{K}]]$ to represent a quantum message encryption scheme that performs encryption operator $U_{k}$ and decryption operator $U_{k}^{\dagger}$ using the symmetric key $k\in\mathcal{K}$, where $k$ is chosen with probability $p_{k}$ and cannot be reused. Then QOTP can be described by the notation $[[p_{ab}=\frac{1}{2^{2n}},X^{a}Z^{b},a,b\in\{0,1\}^{n}]]$.

II-B Quantum pseudorandom functions

Following the definitions in Ref.[24], there are two security notions of PRF under quantum computation model. The first notion is standard security, where the quantum adversary can only access to the function classically; We denote this kind of PRF as “sPRF”. The second one is quantum security, where the quantum adversary can access to the function with quantum superposition queries; We denote this kind of PRF as “qPRF”.

Definition 2** (sPRF)**

A PRF $F:\mathcal{K}\times\mathcal{X}\rightarrow\mathcal{Y}$ is standard secure, if no quantum polynomial-time (QPT) adversary $\mathcal{A}$ making classical queries can distinguish between a truly random function $f$ and the function $F_{k}$ for a uniformly chosen $k$. That is, for every such $\mathcal{A}$, there exists a negligible function $\epsilon=\epsilon(n)$ such that

[TABLE]

Definition 3** (qPRF)**

A PRF $F:\mathcal{K}\times\mathcal{X}\rightarrow\mathcal{Y}$ is quantum secure, if no QPT adversary $\mathcal{A}$ making quantum queries can distinguish between a truly random function $f$ and the function $F_{k}$ for a uniformly chosen $k$. That is, for every such $\mathcal{A}$, there exists a negligible function $\epsilon=\epsilon(n)$ such that

[TABLE]

For sPRF $F$, define $Adv_{F}^{sPRF}(\mathcal{A})=\left|\operatorname{Pr}_{k\leftarrow\mathcal{K}}[\mathcal{A}^{F_{k}}()=1]-\operatorname{Pr}_{f\leftarrow Func_{n}}[\mathcal{A}^{f}()=1]\right|$. For qPRF $F$, define $Adv_{F}^{qPRF}(\mathcal{A})=\left|\operatorname{Pr}_{k\leftarrow\mathcal{K}}[\mathcal{A}^{|F_{k}\rangle}()=1]-\operatorname{Pr}_{f\leftarrow Func_{n}}[\mathcal{A}^{|f\rangle}()=1]\right|$, where $\mathcal{A}$ is QPT adversary.

When quantum queries are allowed, QPT adversary has more advantage while distinguishing PRF and truly random function. That is $Adv_{F}^{sPRF}(\mathcal{A})<Adv_{F}^{qPRF}(\mathcal{A})$. If $Adv_{F}^{qPRF}(\mathcal{A})<\epsilon(n)$, then $Adv_{F}^{sPRF}(\mathcal{A})<\epsilon(n)$, where $\epsilon(n)$ is negligible. Thus, if a PRF $F$ is a qPRF, then it is also a sPRF.

How to directly construct a sPRF that is not a qPRF? In fact, Even-Mansour block cipher is a sPRF [25], but it is not a qPRF [26]. In addition, CBC-MAC is also not quantum-secure as a PRF [27].

Lemma 1

Given a function $G$, if $G$ is independent of PRF $\{F_{k}\}_{k\in\mathcal{K}}$, then

[TABLE]

where $\mathcal{A}$ is any PPT adversary and $\epsilon(n)$ is negligible.

Proof:

Define a new quantum adversary $\mathcal{A}_{G}$, where the adversary $\mathcal{A}$ is allowed to access to the function $G$ classically. Because $G$ is independent of $\{F_{k}\}_{k\in\mathcal{K}}$, we have

[TABLE]

$F_{k}$ is a PRF, so $Adv_{F}^{PRF}(\mathcal{A}_{G})$ is negligible. Thus complete the proof. ∎

There are two similar results for sPRF and qPRF, respectively.

Lemma 2

Given a function $G$, if $G$ is independent of sPRF $\{F_{k}\}_{k\in\mathcal{K}}$, then

[TABLE]

where $\mathcal{A}$ is any QPT adversary and $\epsilon(n)$ is negligible.

Lemma 3

Given a function $G$, if $G$ is independent of qPRF $\{F_{k}\}_{k\in\mathcal{K}}$, then

[TABLE]

where $\mathcal{A}$ is any QPT adversary and $\epsilon(n)$ is negligible.

Remark 1

If $G$ is a PRF $\{G_{k}\}_{k\in\mathcal{K}}$ and is independent of $\{F_{k}\}_{k\in\mathcal{K}}$, then the results in Lemmas 1,2 and 3 hold as well.

Theorem 3** (Parallel Composition)**

If $\{F_{k}\}_{k\in\mathcal{K}}$ and $\{G_{k}\}_{k\in\mathcal{K}}$ are two independent sPRFs, then $H_{k}=(F_{k_{1}},G_{k_{2}}),\forall k=k_{1}\parallel k_{2}$ is also a sPRF. That is, for any QPT adversary $\mathcal{A}$, there exists a negligible function $\epsilon(n)$ such that

[TABLE]

Proof:

According to Definition 2, if $F$ is a sPRF, then for any QPT adversary $\mathcal{A}_{1}$ there exists a negligible function $\epsilon_{1}(n)$ such that

[TABLE]

If $G$ is a sPRF, then for any QPT adversary $\mathcal{A}_{2}$ there exists a negligible function $\epsilon_{2}(n)$ such that

[TABLE]

Thus for any QPT adversary $\mathcal{A}$, we have the following deduction according to Lemma 2 and Remark 1.

[TABLE]

Let $\epsilon(n)=\epsilon_{1}(n)+\epsilon_{2}(n)$, then $\epsilon(n)$ is negligible. Let $H_{k}=(F_{k_{1}},G_{k_{2}})$ and $f=(f_{1},f_{2})$. Thus complete the proof. ∎

II-C $\mathcal{EHE}$* encryption*

In Ref.[13], Yang and Liang have improved the security of quantum McEliece PKE using double-encryption technology. Here, the “double-encryption” is named as “$\mathcal{EHE}$ encryption”. The new name “$\mathcal{EHE}$ encryption” can accurately reflect its structural characteristic.

Based on $\mathcal{EHE}$ encryption, secure quantum encryption scheme can be constructed by combining two insecure ones. $\mathcal{EHE}$ is a universal technology for the construction of quantum cryptographic schemes. The basic framework can be summarized in the following three steps: (1) Encrypt using the first insecure quantum encryption scheme; (2) Perform transversal Hadamard transformation; (3) Encrypt again using the second insecure quantum encryption scheme.

Suppose $(G_{i},E_{i},D_{i}),i=1,2$ are the two insecure quantum encryption schemes, where $G_{i}$,$E_{i}$,$D_{i}$ represent the key generation, encryption and decryption algorithms, respectively. $\mathcal{H}(\cdot)$ is the transversal Hadamard transformation being performed on all the input qubits. General framework of $\mathcal{EHE}$ encryption is completely described in the following three algorithms.

• •

$KeyGen(1^{n})$: $k_{1}\leftarrow G_{1}(1^{n}),k_{2}\leftarrow G_{2}(1^{n})$, output $k_{1},k_{2}$;

• •

$Enc(k_{1},k_{2},\sigma)$: $\sigma_{1}\leftarrow E_{1}(k_{1},\sigma),\sigma_{2}\leftarrow\mathcal{H}(\sigma_{1}),\rho\leftarrow E_{2}(k_{2},\sigma_{2})$, output $\rho$;

• •

$Dec(k_{1},k_{2},\rho)$: $\rho_{1}\leftarrow D_{2}(k_{2},\rho),\rho_{2}\leftarrow\mathcal{H}(\rho_{1}),\sigma\leftarrow D_{1}(k_{1},\rho_{2})$, output $\sigma$.

The two encryption schemes $(G_{i},E_{i},D_{i}),i=1,2$ should satisfy the conditions $D_{i}(k_{i},E_{i}(k_{i},\sigma))=\sigma$,$\forall\sigma,i=1,2$. It is straightforward that

[TABLE]

so the combined construction can decrypt the ciphertext correctly.

III Quantum block encryption

III-A Some definitions

$[[p_{k},U_{k},k\in\mathcal{K}]]$ is a kind of symmetric-key quantum encryption scheme, where each key $k$ is chosen with probability $p_{k}$ and cannot be reused. In this section, we propose the QBE scheme, which is another kind of symmetric-key scheme, and its secret key can be reused for many times.

Definition 4** (QBE)**

QBE scheme is defined by a triplet $(KeyGen,Enc,Dec)$, where $KeyGen,Enc,Dec$ are key generation, encryption and decryption algorithms, respectively. $\mathcal{K}$ is the key space, and $\mathcal{H}_{M}$ and $\mathcal{H}_{C}$ are the quantum plaintext/ciphertext spaces. The randomness $R$ is optional.

• •

$KeyGen$: Given a security parameter $n$, it generates a secret key $k\in\mathcal{K}$;

• •

$Enc$: Choose a random number $r\in R$ and perform the encryption transformation $Enc:\mathcal{K}\times\mathcal{H}_{M}\rightarrow R\times\mathcal{H}_{C}$ with the key $k\in\mathcal{K}$;

• •

$Dec$: Perform the decryption transformation $Dec:\mathcal{K}\times R\times\mathcal{H}_{C}\rightarrow\mathcal{H}_{M}$ with the key $k\in\mathcal{K}$.

These algorithms satisfy the condition $Dec(k,Enc(k,\sigma))=\sigma,\forall k\in\mathcal{K},\sigma\in\mathcal{H}_{M}.$

Similar to the security notions of classical encryption, we can define the quantum versions of indistinguishability (IND), indistinguishability against chosen plaintext attack (IND-CPA).These definitions can also be referred to Refs.[14][16][28]. Notice that, indistinguishability for quantum encryption is originally defined in Ref.[28]. Later, Broadbent and Jeffery [33] presents a definition of quantum IND-CPA with an interactive game, and gives no explicit definition of IND. Following the definition in Ref.[33], Ref.[16] defines IND, IND-CPA and IND-CCA with an incremental way instead of interactive game. The incremental definition is very brief and is adopted in our manuscript.

Definition 5** (IND)**

A QBE scheme $(KeyGen,Enc,Dec)$ is IND-secure, if for any QPT adversary $\mathcal{A}$,

[TABLE]

where $\epsilon(n)$ is negligible, $\sigma_{1},\sigma_{2}$ are arbitrary quantum states chosen by the adversary from $\mathcal{H}_{M}$, $p_{k}=Pr[k\leftarrow KeyGen(1^{n})]$, and the probability in these terms is taken over the internal randomness of the algorithms $KeyGen$, $Enc$ and $\mathcal{A}$.

Next, we introduce another definition of IND.

Definition 6** (IND)**

A QBE scheme $(KeyGen,Enc,Dec)$ is IND-secure, if for any QPT adversary $\mathcal{A}$,

[TABLE]

where $\epsilon(n)$ is negligible, $\sigma$ is arbitrary quantum state chosen by the adversary from $\mathcal{H}_{M}$, $p_{k}=Pr[k\leftarrow KeyGen(1^{n})]$, and the probability in these terms is taken over the internal randomness of the algorithms $KeyGen$, $Enc$ and $\mathcal{A}$.

Obviously, the two definitions of IND are equivalent. The reason is as follows: (1)if a QBE scheme satisfies Definition 5, let $\sigma_{2}=\frac{I}{2^{n}}$, then the QBE scheme satisfies Definition 6 too; (2)if a QBE scheme satisfies Definition 6, then $|Pr[\mathcal{A}(\sum_{k\in\mathcal{K}}p_{k}Enc(k,\sigma_{1}))=1]-Pr[\mathcal{A}(\sum_{k\in\mathcal{K}}p_{k}Enc(k,\sigma_{2}))=1]|<2\epsilon(n)$ and the QBE scheme satisfies Definition 5 too.

Definition 7** (IND-CPA)**

A QBE scheme $(KeyGen,Enc,Dec)$ is IND-CPA-secure, if it is IND-secure when the QPT adversary $\mathcal{A}$ is allowed to access to the encryption oracle $Enc(k,*)$, where $k$ is the secret key.

IND and IND-CPA define the computational security. In addition, we can define information-theoretic security, e.g. perfect security. Actually, QOTP is a kind of perfectly secure quantum encryption. In quantum cryptography, there exist some other cryptographic schemes that can achieve perfect security.

Definition 8** (Perfect Security)**

A QBE scheme $(KeyGen,Enc,Dec)$ is perfectly secure, if Definition 5 (or Definition 6) holds for $\epsilon(n)\equiv 0$ when $\mathcal{A}$ is computationally unbounded quantum adversary.

In QOTP $[[p_{ab}=\frac{1}{2^{2n}},X^{a}Z^{b},a,b\in\{0,1\}^{n}]]$, a secret key of $2n$ bits is necessary for perfectly encrypting $n$ qubits. Suppose we set a restriction on $a$ and $b$ such that $a\equiv b$, then we get a new encryption scheme $[[p_{c}=\frac{1}{2^{n}},X^{c}Z^{c},c\in\{0,1\}^{n}]]$. The length of the key would decrease to $n$, however, the security will also decrease.

Proposition 1

The quantum encryption scheme $[[p_{c}=\frac{1}{2^{n}},X^{c}Z^{c},c\in\{0,1\}^{n}]]$ is not IND-secure.

Proof:

Suppose $n=1$. Two quantum states $\frac{1}{\sqrt{2}}(|0\rangle+i|1\rangle)$ and $|0\rangle$ are chosen as the challenge messages. Consider the two messages are encrypted. The density matrixes of the two messages are written as $\sigma_{1}$ and $\sigma_{2}$, respectively.

The key $c\in\{0,1\}$ is chosen with probability $\frac{1}{2}$. Because the adversary does not know the value of $c$, the ciphertexts corresponding to $\sigma_{1}$ and $\sigma_{2}$ should be represented as two mixed states $\rho_{1}$, $\rho_{2}$.

[TABLE]

[TABLE]

The trace distance of the two ciphertexts is $D(\rho_{1},\rho_{2})=\frac{1}{2}$, and the adversary can efficiently distinguish the ciphertexts of $\sigma_{1}$ and $\sigma_{2}$. In fact, the adversary chooses $\{\frac{1}{\sqrt{2}}(|0\rangle+i|1\rangle),\frac{1}{\sqrt{2}}(|0\rangle-i|1\rangle)\}$ as the measurement basis. If the adversary measures $\rho_{1}$ in the basis, he can obtain $\frac{1}{\sqrt{2}}(|0\rangle+i|1\rangle)$ with probability $1$; If the adversary measures $\rho_{2}$ in the basis, he can obtain $\frac{1}{\sqrt{2}}(|0\rangle+i|1\rangle)$ with probability $\frac{1}{2}$, and obtain $\frac{1}{\sqrt{2}}(|0\rangle-i|1\rangle)$ with probability $\frac{1}{2}$. Thus, the adversary can efficiently distinguish $\rho_{1}$ and $\rho_{2}$ with successful probability $\frac{3}{4}$.

For any value of $n$, we choose the two states $\frac{1}{\sqrt{2^{n}}}(|0\rangle+i|1\rangle)^{\otimes n}$ and $|0\rangle^{\otimes n}$ as the challenge messages, and analyze the security in the same way. Then the adversary can efficiently distinguish their ciphertexts with successful probability $1-\frac{1}{4^{n}}$. Thus complete the proof. ∎

III-B An insecure construction from classical block encryption

Next, we introduce the PRF-based classical BE scheme $\mathcal{E}(F)$, and construct a QBE scheme $\mathcal{E}^{\prime}(F)$ which is insecure.

Construction 1(Construction 5.3.9 in Ref.[29]): Let $F:\mathcal{K}\times\{0,1\}^{n}\rightarrow\{0,1\}^{n}$ be a PRF. Define classical BE scheme $\mathcal{E}(F)=(G_{F},E_{F},D_{F})$ as follows.

• •

$G_{F}(1^{n})$: $k\xleftarrow{R}\mathcal{K}$, output $k$;

• •

$E_{F}(k,m)$: $r\xleftarrow{R}\{0,1\}^{n},c\leftarrow m\oplus F(k,r)$, output $(r,c)$;

• •

$D_{F}(k,(r,c))$: $m\leftarrow c\oplus F(k,r)$, output $m$.

Based on the classical scheme $\mathcal{E}(F)$, we can construct a QBE scheme $\mathcal{E}^{\prime}(F)=(G_{F}^{\prime},E_{F}^{\prime},D_{F}^{\prime})$ for encrypting any $n$-qubit message.

Construction 2: Let $\mathcal{E}(F)=(G_{F},E_{F},D_{F})$ be a classical BE scheme defined in Construction 1, define the QBE scheme $\mathcal{E}^{\prime}(F)=(G_{F}^{\prime},E_{F}^{\prime},D_{F}^{\prime})$ as follows.

• •

$G_{F}^{\prime}(1^{n})$: $k\leftarrow G_{F}(1^{n})$, output $k$;

• •

$E_{F}^{\prime}(k,\sigma)$: $r\xleftarrow{R}\{0,1\}^{n},\rho\leftarrow X^{F(k,r)}\sigma X^{F(k,r)}$, output $(r,\rho)$;

• •

$D_{F}^{\prime}(k,(r,\rho))$: $\sigma\leftarrow X^{F(k,r)}\rho X^{F(k,r)}$, output $\sigma$.

Assume without loss of generality that the quantum message is a pure state $\sum_{m}\alpha_{m}|m\rangle$, where $\sum_{m}|\alpha_{m}|^{2}=1$. According to the encryption operator $E_{F}^{\prime}$ defined in Construction 2, the obtained ciphertext is also pure state, which can be written as $\sum_{c}\alpha_{c}|c\rangle$.

[TABLE]

Next we show that the QBE scheme $\mathcal{E}^{\prime}(F)$ in Construction 2 is insecure.

Theorem 4

The QBE scheme $\mathcal{E}^{\prime}(F)=(G_{F}^{\prime},E_{F}^{\prime},D_{F}^{\prime})$ in Construction 2 is not IND-secure.

Proof:

Choose two quantum plaintexts $|\varphi_{1}\rangle=\frac{1}{\sqrt{2^{n}}}\sum_{m\in\{0,1\}^{n}}|m\rangle$ and $|\varphi_{2}\rangle=|0\rangle^{\otimes n}$. Suppose the secret key is $k$, the ciphertexts of $|\varphi_{1}\rangle$ and $|\varphi_{2}\rangle$ are

[TABLE]

With respect to the adversary (who does not know the key $k$), the ciphertexts of $|\varphi_{1}\rangle$ and $|\varphi_{2}\rangle$ should be written in the mixed states as follows.

[TABLE]

The adversary performs quantum measurement on the ciphertexts in the basis $\{|+\rangle,|-\rangle\}$. Because $|\varphi_{1}\rangle=|+\rangle^{\otimes n}$, while measuring its ciphertext, the outcome would be $00\cdots 0$ with probability $1$; While measuring the ciphertext of $|\varphi_{2}\rangle$, the outcome would be $00\cdots 0$ with probability at most $\frac{1}{|\mathcal{K}|}\sum_{k\in\mathcal{K}}\frac{1}{2^{n}}=\frac{1}{2^{n}}$. Thus, the adversary can successfully distinguish the two ciphertexts with probability at least $1-\frac{1}{2^{n}}$. Thus complete the proof. ∎

Theorem 4 can be extended to the case that replacing $\mathcal{E}(F)=(G_{F},E_{F},D_{F})$ with any quasi-length-preserving encryption scheme. See the eprint version of Ref.[30] for the definition of quasi-length-preserving encryption.

Theorem 5

Given any quasi-length-preserving classical BE scheme, the QBE scheme constructed according to Construction 2 is not IND-secure.

Proof:

The proof is similar to Theorem 4. ∎

From Theorems 4 and 5, it is insecure to use any quasi-length-preserving classical BE schemes in the following two cases. The first case is that the classical scheme is directly used to encrypt quantum superpositions on the quantum computer. The second case is that the classical scheme is embedded into the quantum cryptographic protocols.

III-C IND-CPA quantum block encryption

If $F$ and $G$ are PRFs, two insecure QBE schemes can be defined following the constructions in Section III-B. Denote the two schemes as $\mathcal{E}^{\prime}(F)=(G_{F}^{\prime},E_{F}^{\prime},D_{F}^{\prime})$ and $\mathcal{E}^{\prime}(G)=(G_{G}^{\prime},E_{G}^{\prime},D_{G}^{\prime})$, respectively. Next, we propose a secure QBE scheme $\mathcal{E}(F,G)=(KeyGen,Enc,Dec)$ following the framework of $\mathcal{EHE}$ encryption.

Construction 3: Given two schemes $\mathcal{E}^{\prime}(F)=(G_{F}^{\prime},E_{F}^{\prime},D_{F}^{\prime})$ and $\mathcal{E}^{\prime}(G)=(G_{G}^{\prime},E_{G}^{\prime},D_{G}^{\prime})$, define a new QBE scheme $\mathcal{E}(F,G)=(KeyGen,Enc,Dec)$ as follows.

• •

$KeyGen(1^{n})$: $k_{1}\leftarrow G_{F}^{\prime}(1^{n})$, $k_{2}\leftarrow G_{G}^{\prime}(1^{n})$, output $(k_{1},k_{2})$;

• •

$Enc(k_{1},k_{2},\sigma)$: $(r_{1},\sigma_{1})\leftarrow E_{F}^{\prime}(k_{1},\sigma)$,$\sigma_{2}\leftarrow\mathcal{H}(\sigma_{1})$, $(r_{2},\rho)\leftarrow E_{G}^{\prime}(k_{2},\sigma_{2})$, output $(r_{1},r_{2},\rho)$;

• •

$Dec(k_{1},k_{2},(r_{1},r_{2},\rho))$: $\sigma_{2}\leftarrow D_{G}^{\prime}(k_{2},(r_{2},\rho))$, $\sigma_{1}\leftarrow\mathcal{H}(\sigma_{2})$, $\sigma\leftarrow D_{F}^{\prime}(k_{1},(r_{1},\sigma_{1}))$, output $\sigma$.

According to the QBE scheme $\mathcal{E}(F,G)$ defined in Construction 3, we encrypt $n$ qubits $\sigma$ with the keys $k_{1},k_{2}$, and obtain

[TABLE]

where $U^{F,G}_{k_{1},k_{2}}(r_{1},r_{2})=X^{G(k_{2},r_{2})}H^{\otimes n}X^{F(k_{1},r_{1})}$.

We decrypt the ciphertext $(r_{1},r_{2},\rho)$ with the keys $k_{1},k_{2}$, and obtain

[TABLE]

Notice that

[TABLE]

Then we can make a slight modification to the encryption/decryption operators (in Equations (3) and (4)) as follows.

[TABLE]

It can be seen that, the only modification is that the quantum operator $H^{\otimes n}$ is discarded. Because the operator $H^{\otimes n}$ does not contain variable parameters, the modification would not affect its security essentially. However, there exists a slight disadvantage that is analyzed as follows.

Upon the modifications (defined by Equations (6) and (7)), if $|m\rangle$ is encrypted with the keys $k_{1},k_{2}$ and the randomness are $r_{1},r_{2}$, then the ciphertext would be $|m\oplus F(k_{1},r_{1})\rangle$ (ignoring the global phase which depends on $G$); If the ciphertext is encrypted and the same randomness $r_{1},r_{2}$ are used, then the original message $|m\rangle$ would be restored. In the same way, we consider the original QBE scheme (defined by Equations (3) and (4)). If $|m\rangle$ is encrypted twice in sequence using the same randomness, then we can obtain $|m\oplus F(k_{1},r_{1})\oplus G(k_{2},r_{2})\rangle$, instead of $|m\rangle$. For this tiny difference, we decide to choose the original scheme in Construction 3. That is, the Hadamard transformation $H^{\otimes n}$ is kept in the scheme.

It can be seen that the QBE scheme $\mathcal{E}(F,G)=(KeyGen,Enc,Dec)$ is very similar to QOTP. The difference is that, the QOTP-key is replaced with the pseudorandom numbers generated from the PRFs $F,G$ with the keys $k_{1},k_{2}$ and randomness $r_{1},r_{2}$. According to Construction 3, the keys of the PRFs (or classical BE schemes) are used as the key of QBE scheme $\mathcal{E}(F,G)$. Because the keys of the PRFs (or classical BE schemes) can be reused, the key of $\mathcal{E}(F,G)$ can also be reused. However, the randomness $r_{1},r_{2}$ cannot be reused, or else the security would decrease. The proof is as follows.

Proposition 2

For the QBE scheme $\mathcal{E}(F,G)=(KeyGen,Enc,Dec)$ defined in Construction 3, if it is allowed to reuse the randomness $(r_{1},r_{2})$, then the scheme is not IND-CPA-secure.

Proof:

Let $k_{1},k_{2}$ be the secret key of QBE scheme, and choose the randomness $(r_{1},r_{2})$. For the first time, the sender encrypts the quantum message $\sigma$, and obtains the ciphertext

[TABLE]

In the CPA model, the adversary is allowed to access to the quantum encryption oracle. Given the input $\rho$, the adversary can query the quantum encryption oracle $O_{Enc(k_{1},k_{2},*)}$. If the randomness $(r_{1},r_{2})$ are reused, then the adversary would obtain the new ciphertext

[TABLE]

where $c\stackrel{{\scriptstyle\triangle}}{{=}}F(k_{1},r_{1})\oplus G(k_{2},r_{2})$. The ciphertext $X^{c}Z^{c}\sigma Z^{c}X^{c}$ can be viewed as the outcome of performing quantum encryption scheme $[[p_{c}=\frac{1}{2^{n}},X^{c}Z^{c},c\in\{0,1\}^{n}]]$ on the quantum message $\sigma$. From Proposition 1, we conclude the QBE scheme in Construction 3 is not IND-CPA-secure if the randomness is reused. ∎

According to Proposition 2, while applying the QBE scheme $\mathcal{E}(F,G)$, the randomness $r_{1},r_{2}$ cannot be reused, and should be chosen randomly in every execution of encryption.

Next we prove the security of QBE scheme $\mathcal{E}(F,G)$ in Construction 3.

Theorem 6

If $F,G:\mathcal{K}\times\{0,1\}^{n}\rightarrow\{0,1\}^{n}$ are two independent sPRFs, then $\mathcal{E}(F,G)=(KeyGen,Enc,Dec)$ in Construction 3 is an IND-CPA-secure QBE scheme.

Proof:

If the scheme in Construction 3 adapts the truly random functions $f_{1},f_{2}\in Func_{n}$ (instead of PRFs $F,G$), then the scheme $\mathcal{E}(f_{1},f_{2})$ would be the same as QOTP. So the scheme would have perfect security.

Next we show the QBE scheme is IND-secure while using the two sPRFs $F$ and $G$.

According to the QBE scheme, if totally mixed state $\frac{I}{2^{n}}$ is encrypted, the outcome is $(r_{1},r_{2},\frac{I}{2^{n}})$, where $r_{1},r_{2}$ are chosen randomly. Given any QPT adversary $\mathcal{A}$, assume $\mathcal{A}$ can distinguish the two ciphertexts of arbitrary state $\sigma$ and $\frac{I}{2^{n}}$ with advantage

[TABLE]

Then we prove $\epsilon(n)$ is negligible as follows. For the pair of sPRFs $(F,G)$, we construct a distinguisher $\mathcal{D}$ invoking the QPT adversary $\mathcal{A}$. The distinguisher $\mathcal{D}$ can classically query a pair of functions, and should make a judgement about the queried functions, e.g. the queried functions are a pair of PRFs $(F,G)$ or truly random functions $(f_{1},f_{2})$.

Construction of distinguisher $\mathcal{D}$. $\mathcal{D}$ is given an input $1^{n}$ and a pair of classical random oracles $(O_{1},O_{2})$, where $O_{i}:\{0,1\}^{n}\rightarrow\{0,1\}^{n},i=1,2$.

Choose a pair of random values $r_{1},r_{2}\in\{0,1\}^{n}$; 2. 2.

Access to the pair of classical random oracles $(O_{1},O_{2})$ with input $r_{1},r_{2}$, and obtain the outcome $(s_{1},s_{2})=(O_{1}(r_{1}),O_{2}(r_{2}))$; 3. 3.

Randomly choose a plaintext $\sigma$ ($\sigma\neq\frac{I}{2^{n}}$). The output $(s_{1},s_{2})$ is used as the key to encrypt $\sigma$ as follow: $\sigma\rightarrow(r_{1},r_{2},X^{s_{2}}H^{\otimes n}X^{s_{1}}\sigma X^{s_{1}}H^{\otimes n}X^{s_{2}})$; Denote the ciphertext as $(r_{1},r_{2},\rho)$; 4. 4.

Invoke the QPT adversary $\mathcal{A}$ on input $(r_{1},r_{2},\rho)$, and output whatever $\mathcal{A}$ does.

In the above distinguisher, $\mathcal{D}$ may access two kinds of classical random oracles. The first one is for truly random functions $(f_{1},f_{2})$, and the second one is for PRFs $(F,G)$. We discuss the two cases as follows.

(a)

If $\mathcal{D}$ access to the truly random functions $(f_{1},f_{2})$, then $(s_{1},s_{2})$ is a random element in $\{0,1\}^{2n}$. In addition, the value of $(s_{1},s_{2})$ is not accessible to $\mathcal{A}$ in the distinguisher. From the aspect of $\mathcal{A}$, the ciphertext $(r_{1},r_{2},\rho)$ can be written as a mixed state $(r_{1},r_{2},\frac{1}{2^{2n}}\sum_{s_{1},s_{2}}X^{s_{2}}H^{\otimes n}X^{s_{1}}\sigma X^{s_{1}}H^{\otimes n}X^{s_{2}})$ (That is $(r_{1},r_{2},\frac{I}{2^{n}})$). Thus,

[TABLE]

where $f_{1},f_{2}$ are chosen randomly and independently from the set $Func_{n}$.

(b)

If $\mathcal{D}$ access to PRFs $(F,G)$, then $(s_{1},s_{2})=(F(k_{1},r_{1}),G(k_{2},r_{2}))$. From the aspect of $\mathcal{A}$ (who does not know $k_{1},k_{2}$), the ciphertext $(r_{1},r_{2},\rho)$ can be written as $(r_{1},r_{2},\frac{1}{|\mathcal{K}|^{2}}\sum_{k_{1},k_{2}}U^{F,G}_{k_{1},k_{2}}(r_{1},r_{2})\sigma(U^{F,G}_{k_{1},k_{2}}(r_{1},r_{2}))^{\dagger})$. It can be concluded that

[TABLE]

where $k_{1},k_{2}\in\mathcal{K}$ are chosen randomly and independently.

From the equations (8)(9)(10), it can be deduced that

[TABLE]

$\mathcal{A}$ is a QPT algorithm, then the distinguisher $\mathcal{D}$ invoking $\mathcal{A}$ is also a QPT algorithm. Using Theorem 3, if $F,G$ are sPRFs, then $\epsilon(n)$ in Equation (11) is negligible. From Equation (8) and Definition 6, the QBE scheme $\mathcal{E}(F,G)$ is IND-secure.

Consider the case that the adversary $\mathcal{A}$ is allowed to access to quantum encryption oracle

[TABLE]

If the randomness used by $O_{Enc(k_{1},k_{2},\ast)}$ have also been used in challenge query, then it would be insecure (According to Proposition 2, the advantage of $\mathcal{A}$ while distinguishing the challenge ciphertexts would be non-negligible). However, the encryption oracle will use a fresh randomness that is chosen uniformly and independently, so the probability that $O_{Enc(k_{1},k_{2},\ast)}$ uses the same randomness as the challenge query is negligible. Then allowing $\mathcal{A}$ to access to encryption oracle $O_{Enc(k_{1},k_{2},\ast)}$ has negligible effect on all the above proof of IND security. Thus the QBE scheme $\mathcal{E}(F,G)$ is IND-CPA-secure. ∎

Remark 2

From the proof of Theorem 6, the distinguisher can classically access to the oracles of PRFs (or truly random functions). The PRFs are not required to have quantum security. The PRFs with standard security are sufficient to assure the IND security of the QBE scheme.

Corollary 3.6.7 in Ref.[29] has shown that the existence of one-way function implies the existence of PRF. Zhandry [24] has proved that, if PRF exists then there exists sPRF that is not qPRF. Thus, from Theorem 6, we reduce IND-CPA-secure QBE scheme to the existence of one-way function. That is, if there exist one-way functions, then IND-CPA-secure QBE schemes exist as well.

Definition 9

A function $F:\mathcal{K}\times\{0,1\}^{n}\rightarrow\{0,1\}^{n}$ is pairwise independent sPRF, if the two probability distributions $(F_{k_{1}}(U_{n}),F_{k_{2}}(U_{n}))$,$k_{1},k_{2}\in\mathcal{K}$ and $f(U_{2n})$ are QPT-indistinguishable, where $U_{n}$ is uniformly distributed over $\{0,1\}^{n}$ and $f$ is a truly random function in $Func_{2n}$. That is

[TABLE]

where $\epsilon(n)$ is negligible, and $\mathcal{A}$ is any QPT adversary. $\mathcal{A}$ accesses to the two functions $F_{k_{1}}(*),F_{k_{2}}(*)$ with two independent inputs (the two inputs may be the same or different).

If $F$ is a pairwise independent PRF, let $G=F$, then a QBE scheme $\mathcal{E}(F,F)=(KeyGen,Enc,Dec)$ can be constructed from $\mathcal{EHE}$ encryption technology.

Construction 4: Given a pairwise independent PRF $F:\mathcal{K}\times\{0,1\}^{n}\rightarrow\{0,1\}^{n}$, an insecure QBE scheme $\mathcal{E}^{\prime}(F)=(G_{F}^{\prime},E_{F}^{\prime},D_{F}^{\prime})$ can be constructed following Constructions 1 and 2. Then a secure QBE scheme $\mathcal{E}(F,F)=(KeyGen,Enc,Dec)$ can be constructed as follows.

• •

$KeyGen(1^{n})$: $k_{1}\leftarrow G_{F}^{\prime}(1^{n})$, $k_{2}\leftarrow G_{F}^{\prime}(1^{n})$, output $(k_{1},k_{2})$;

• •

$Enc(k_{1},k_{2},\sigma)$: $(r_{1},\sigma_{1})\leftarrow E_{F}^{\prime}(k_{1},\sigma)$, $\sigma_{2}\leftarrow\mathcal{H}(\sigma_{1})$, $(r_{2},\rho)\leftarrow E_{F}^{\prime}(k_{2},\sigma_{2})$, output $(r_{1},r_{2},\rho)$;

• •

$Dec(k_{1},k_{2},(r_{1},r_{2},\rho))$: $\sigma_{2}\leftarrow D_{F}^{\prime}(k_{2},(r_{2},\rho))$, $\sigma_{1}\leftarrow\mathcal{H}(\sigma_{2})$, $\sigma\leftarrow D_{F}^{\prime}(k_{1},(r_{1},\sigma_{1}))$, output $\sigma$.

Theorem 7

If $F$ is a pairwise independent PRF and has standard security, then $\mathcal{E}(F,F)$ in Construction 4 is an IND-CPA-secure QBE scheme.

Proof:

The proof is similar to Theorem 6. Definition 9 is used in the proof. The details are omitted. ∎

III-D Perfectly secure case

In Section III-C, the QBE scheme in Construction 3 has been proved to be IND-CPA-secure. Next we show the QBE scheme can achieve higher security in a particular case.

It is well known that, BE cannot achieve the same security as OTP in classical cryptography. However, based on quantum mechanics, there may be an important breakthrough – QBE can achieve the same security as QOTP. Next we show the QBE scheme $\mathcal{E}(F,G)=(KeyGen,Enc,Dec)$ can achieve perfect security in certain special case.

Theorem 8

Given two independent sPRFs $F,G:\mathcal{K}\times\mathcal{X}\rightarrow\mathcal{Y}$, where $\mathcal{K}=\mathcal{X}=\mathcal{Y}=\{0,1\}^{n}$, if for any fixed $x$, both $F(*,x):\mathcal{K}\rightarrow\mathcal{Y}$ and $G(*,x):\mathcal{K}\rightarrow\mathcal{Y}$ are permutations, then $\mathcal{E}(F,G)$ in Construction 3 is a perfectly secure QBE scheme.

Notice that, Theorem 10 proves a special case of the scheme in Theorem 6 with only one additional limitation on the functions $F,G$. So the reusability of the key would not be affected. We have presented a strict proof that, the security is enhanced with this additional limitation, and achieve the same level as QOTP.

Proof:

From Theorem 6, $\mathcal{E}(F,G)$ in Construction 3 is an IND-CPA-secure QBE scheme. Next we prove it can achieve perfect security if $F(*,x)$ and $G(*,x)$ are permutations.

Suppose a block of quantum plaintext has $n$ qubits, and its density operator $\sigma$ can be written as a $2^{n}\times 2^{n}$ matrix with trace $tr(\sigma)=1$. Given a set of all $2^{n}\times 2^{n}$ matrixes, it is an inner space if we define inner product as $(M_{1},M_{2})=tr(M_{1}M_{2}^{\dagger})$, where $M_{1}$ and $M_{2}$ are $2^{n}\times 2^{n}$ matrixes. Then the set $\{X^{\alpha}Z^{\beta}|\alpha,\beta\in\{0,1\}^{n}\}$ is a group of complete orthogonal bases. Thus the density operator $\sigma$ can be expressed as $\sigma=\sum_{\alpha,\beta}a_{\alpha,\beta}X^{\alpha}Z^{\beta}$, where $a_{\alpha,\beta}=\frac{1}{2^{n}}tr(\sigma Z^{\beta}X^{\alpha})$. According to the QBE scheme $\mathcal{E}(F,G)$, quantum plaintext $\sigma$ is encrypted with the keys $k_{1},k_{2}\in\{0,1\}^{n}$ as follows.

[TABLE]

The keys $k_{1},k_{2}$ are unknown by the adversary and every $k_{1},k_{2}$ are used with identical probability. Thus, from the aspect of the adversary, the quantum ciphertext should be represented as an equal mixture of a quantum plaintext $\sigma$ encrypted under all possible keys with uniform probability

[TABLE]

Using the following three equations

[TABLE]

one can conclude that

[TABLE]

If $F(*,r_{1}):\mathcal{K}\rightarrow\mathcal{Y}$ and $G(*,r_{2}):\mathcal{K}\rightarrow\mathcal{Y}$ are permutations, then

[TABLE]

where the function \delta_{x,y}=\left\{\begin{array}[]{ll}1,&\hbox{x=y;}\\ 0,&\hbox{otherwise.}\end{array}\right. Using Equations (16)(17), it can be deduced that

[TABLE]

The facts $a_{\alpha,\beta}=tr(\sigma Z^{\beta}X^{\alpha})/2^{n}$ and $tr(\sigma)=1$ are used in the above deduction. $r_{1},r_{2}$ are randomly chosen and are independent of the plaintext. Then the adversary can obtain nothing from the quantum ciphertext $(r_{1},r_{2},\frac{I}{2^{n}})$. Thus the QBE scheme $\mathcal{E}(F,G)$ has perfect security. ∎

Because the perfectly secure QBE scheme is just a special case of the constructions in previous sections, the related results and discussions in Section III-C are also suitable for the perfectly secure QBE scheme. So the keys $k_{1},k_{2}$ are reusable and would not decrease the security. If the randomness $(r_{1},r_{2})$ are reused, the security would decrease.

Notice that the key can be reused and the randomness cannot. The randomness $r_{1},r_{2}$ has exponential different choices, so a $2n$-bit key can be used in an exponential number of encryptions, where the randomness will be refreshed in each time of encryption. Thus $2n$-bit key can perfectly encrypt $O(n2^{n})$ qubits, and the perfect secrecy would not be broken if the $2n$-bit key is reused only exponential times.

Remark 3

In Theorem 8, the functions $F,G$ should satisfy two conditions: (1) they are independent sPRFs; (2) for any fixed $x$, both $F(*,x)$ and $G(*,x)$ are permutations. We argue that $\mathcal{E}(F,G)$ cannot be a perfectly secure QBE if the condition (1) does not hold. For example, let $F(k_{1},r_{1})=k_{1}\oplus r_{1}$ and $G(k_{2},r_{2})=k_{2}\oplus r_{2}$, then both $F(*,r_{1})$ and $G(*,r_{2})$ are permutations. So $Enc(k_{1},k_{2},\sigma)=(r_{1},r_{2},H^{\otimes n}Z^{k_{2}\oplus r_{2}}X^{k_{1}\oplus r_{1}}\sigma X^{k_{1}\oplus r_{1}}Z^{k_{2}\oplus r_{2}}H^{\otimes n})$. Because $r_{1},r_{2}$ are public, the encryption is equivalent to $QOTP(k_{1},k_{2},\sigma)=Z^{k_{2}}X^{k_{1}}\sigma X^{k_{1}}Z^{k_{2}}$. Thus the keys $k_{1},k_{2}$ cannot be reused, and $\mathcal{E}(F,G)$ is not a QBE.

Remark 4

In Theorem 8, the sPRF $F$ (or $G$) is required that, for any fixed $x$, the function $F(*,x)$ (or $G(*,x)$) is permutation on the key space $\mathcal{K}=\{0,1\}^{n}$. In fact, a good candidate is GGM-PRF [34] construction $\mathrm{PRF}_{k}(x_{1}x_{2}\cdots x_{n})=G_{x_{1}}(\cdots G_{x_{n-1}}(G_{x_{n}}(k))\cdots),x_{i}\in\{0,1\}$, where $G_{0}(x),G_{1}(x)$ are pseudorandom permutation from $\mathcal{K}$ to $\mathcal{K}$.

Next, we give a detailed comparison between our scheme and QOTP, especially their relations and differences. (1) For QOTP (see Ref.[4]), while considering the encryption of $n$ qubits, we should use an unused $2n$-bit key in each encryption, and an used key may be chosen again with probability $\frac{1}{2^{2n}}$ if the key is randomly chosen. For our scheme, the key can be reused, but a $2n$-bit randomness should be sampled and an used randomness may be chosen again with probability $\frac{1}{2^{2n}}$. (2) In QOTP, the key can be used only one time and no randomness is used. In our scheme, the key can be reused, and we only need to choose a $2n$-bit randomness in each encryption. Because the randomness can be chosen from exponential candidates, our scheme can be viewed as exponential times of $n$-qubit QOTP encryption with the same key. (3) In the $n$-qubit QOTP, the key has $2n$ bits, where $n$ can be arbitrary value. That means the length of the key is variable. In our scheme, the randomness has $2n$ bits, where the value $n$ depends on the length of the key. (4) In QOTP, $2n$-bit key can perfectly encrypt $n$ qubits. In our scheme, $2n$-bit key can perfectly encrypt $O(n2^{n})$ qubits, since the scheme would not be perfectly secure when the randomness is reused. (5) Our scheme can be implemented using Pauli $X$ and $H$ gates, and the number is at most $3n$ ($n$ is the length of one block); the QOTP can be implemented using Pauli $X$ gate and $Z$ gate, and the number is at most $2n$. Thus, the QBE scheme has nearly the same difficulty and complexity as QOTP from the aspect of physical implementation. (6) QOTP can be completely replaced with our scheme. Currently, QOTP has been used as a basic quantum primitive in various cryptographic protocols and algorithms [1, 2, 3, 14, 18]. If the QOTP in these protocols or algorithms is replaced with perfectly secure QBE scheme, then optimized schemes could be obtained.

III-E Multiple-message encryption

Given a classical BE scheme, if it is IND-CPA-secure in single-message encryption, then it is also IND-CPA-secure in multiple-message encryption. However, it is not the case for QBE scheme: QBE scheme is secure in single-message encryption, however it may be insecure in multiple-message encryption.

In this section, we show that the perfectly secure QBE scheme $\mathcal{E}(F,G)$ is not perfectly secure in multiple-message encryption. However, the multiple-message encryption would be perfectly secure if the QBE scheme is applied in the operation mode “encrypt-decrypt-confirm”: Alice encrypts one block of message and sends it to Bob; After receiving Alice’s one block of ciphertext, Bob decrypts it; Next, Bob confirms publicly that he has decrypted the ciphertext; Then Alice and Bob start the next round of encrypted communication.

Given $s(n)$ blocks of messages $\bigotimes_{1\leq i\leq s(n)}\sigma_{i}$, from the aspect of the adversary, the multiple-message encryption would output

[TABLE]

where the randomness $(r_{1}^{i},r_{2}^{i})$ is used in the encryption of $i$th block of messages.

Generally, Equation (19) does not equal to the following equation

[TABLE]

The result in the proof of Theorem 8 does not hold any more. Thus, from the aspect of the adversary, the ciphertext of $s(n)$ blocks of messages are not equal to

[TABLE]

Thus, the perfectly secure QBE scheme $\mathcal{E}(F,G)$ is not perfectly secure in multiple-message encryption. If it works in the operation mode “encrypt-decrypt-confirm”, then the encryption of the different blocks would be independent, and it would still be perfectly secure in every single-message encryption.

IV Conclusions and discussions

The $\mathcal{EHE}$ encryption has been described and be used in the construction of QBE scheme. Firstly, we show how to construct an insecure QBE scheme based on PRF. Then, we propose a secure construction from two insecure QBE schemes according to $\mathcal{EHE}$ encryption. It is shown that the QBE scheme is IND-CPA-secure if there exist PRFs with standard security. Finally, we show the QBE scheme can have the same security as QOTP when the PRFs satisfy an additional condition.

As is well known that, “QKD+OTP” can perfectly encrypt classical messages in theory, and there are many applications in practice. However, lots of interaction and communication are necessary, and the efficiency would decrease. Actually, the QBE scheme can also be used to encrypt classical messages. For example, the classical message $m$ can be viewed as a quantum state $|m\rangle$, and each bit $m_{i}$ is encrypted to a qubit $X^{G(k_{2},r_{2})_{i}}HX^{F(k_{1},r_{1})_{i}}|m_{i}\rangle$, which belongs to the set $\{|0\rangle,|1\rangle,|+\rangle,|-\rangle\}$. Then, while encrypting classical messages, we can use a perfectly secure QBE scheme. Because no interaction is needed in QBE scheme, it would be more efficient than “QKD+OTP”, and is a potential replacement of “QKD+OTP” in the future. Theoretically, $2n$-bit key can perfectly encrypt $O(n2^{n})$ classical bits.

For perfect secrecy, Ref.[31] proposed a strict mathematical proof that the key must have at least the same length as the plaintext. In Section III-D, we have shown the BE scheme based on quantum mechanics can break the limitation of perfectly secure encryption. In QOTP, $2n$-bit key is necessary to perfectly encrypt $n$ qubits. However, in the QBE scheme, $2n$-bit key can be reused and the fresh randomness $(r_{1},r_{2})$ are used to encrypt another $n$ qubits, thus $2n$-bit key can be used to perfectly encrypt $O(n2^{n})$ qubits.

$\mathcal{EHE}$ encryption is a kind of generic transformation used for the construction of quantum encryption scheme. It can convert classical encryption or insecure quantum encryption scheme into secure quantum encryption scheme. The QBE scheme constructed based on $\mathcal{EHE}$ encryption can be seen as an extension of classical BE scheme, and it is also suitable for encryption of the classical messages. Thus, $\mathcal{EHE}$ encryption has established the direct connection between the quantum and classical BE schemes.

Finally, two problems are left for the future research.

• •

Construct more cryptographic schemes in the $\mathcal{EHE}$-like way. It is proved that Wegman-Carter MAC is insecure while authenticating quantum message $Auth(\rho)$ [32], however, it can be converted into a secure QMA scheme in the $Auth_{2}(H(Auth_{1}(\rho)))$ pattern [17]. In addition, our results show that $\mathcal{EHE}$ encryption can convert an insecure QBE scheme into a secure QBE scheme. Is there any other quantum cryptographic scheme that can be constructed in the $\mathcal{EHE}$-like way?

• •

Replace the QOTP with the QBE in those QOTP-based (encryption, authentication or others) schemes. QOTP has been used as an important building block in many quantum schemes. Because the perfectly secure QBE scheme in Section III-D has many advantages, we could replace the QOTP with the QBE and expect an obvious optimization, for example, recycling all the keys of the scheme in Ref.[18] or lifting weak authentication to total authentication [17].

Acknowledgment

This work was supported by the National Natural Science Foundation of China (Grant No. 61672517), and National Cryptography Development Fund (Grant No. MMJJ20170108).