Proving Erasure

TL;DR

This paper explores whether quantum mechanics can enable a server to verifiably prove data deletion through a BB84-like protocol, introducing privacy delegation as a new concept for secure remote data management.

Contribution

It introduces privacy delegation as an alternative to encryption and applies it to develop protocols for provable deletion and remote data storage with partial security analysis.

Findings

Proposed a BB84-like protocol for verifiable data deletion.

Identified vulnerabilities to targeted eavesdropping attacks.

Introduced the concept of privacy delegation for data security.

Abstract

It seems impossible to certify that a remote hosting service does not leak its users' data --- or does quantum mechanics make it possible? We investigate if a server hosting data can information-theoretically prove its definite deletion using a "BB84-like" protocol. To do so, we first rigorously introduce an alternative to privacy by encryption: privacy delegation. We then apply this novel concept to provable deletion and remote data storage. For both tasks, we present a protocol, sketch its partial security, and display its vulnerability to eavesdropping attacks targeting only a few bits.

Equations

$$\operatorname{P}\!\left[\operatorname{CERT}^{(\mathcal{V},\mathcal{P},\mathcal{A})}\!(n)\right]\cdot\left(\operatorname{P}\!\left[\operatorname{DISCR}^{(\mathcal{V},\mathcal{P},\mathcal{A})}(n)|\operatorname{CERT}^{(\mathcal{V},\mathcal{P},\mathcal{A})}\!(n)\right]\right.\\ -1/2\Big{)}<\operatorname{negl}(n)\,,$$

$$P\left[{\mathrm{CERT}}^{(\mathcal{V},{\mathcal{P}}_{\text{honest}},\mathcal{A})}(n)\right]>1-\mathrm{negl}(n).$$

$$\mathrm{len}(k)=n+\log \left(\genfrac{}{}{0ex}{}{m+n}{n}\right)\approx n\log m.$$

$$P\left[{\mathrm{CERT}}^{(\mathcal{V},\mathcal{P},\tilde{\mathcal{A}}(r))}\right]\le 2^{-rn/(m+n)+ϵ}+2\exp (-2{ϵ}^{2}r),$$

$$P\left[{\mathrm{CERT}}^{(\mathcal{V},\mathcal{P},\tilde{\mathcal{A}}(r))}\right]=\sum _{k=0}^r{2}^{-k}\frac{\left(\genfrac{}{}{0ex}{}{n}{k}\right)\left(\genfrac{}{}{0ex}{}{m}{r-k}\right)}{\left(\genfrac{}{}{0ex}{}{m+n}{r}\right)}.$$

$$P\left[|K-\mu (K)|\ge ϵ\right]\le 2\exp (-2{ϵ}^{2}r),$$

$$P$$

$$\ge (1-n/(n+m))/4,$$

$$P$$

$$\therefore$$

$$\cdot \left(P\left[{\mathrm{DISCR}}^{(\mathcal{V},\bar{\mathcal{P}},\bar{\mathcal{A}})}(n)|{\mathrm{CERT}}^{(\mathcal{V},\bar{\mathcal{P}},\bar{\mathcal{A}})}(n)\right]-1/2\right)\nless \mathrm{negl}(n).$$

Full text

I Introduction

As the story goes [1], some sailors who did not have access to secure private storage on ships would tie their bag of belongings with the “thief knot.” This particular knot resembled the reef knot, one of the most common knots, so that anyone not knowing the secret would tie back the bag the wrong way. The canny sailors would then detect when someone went through their belongings because the thief knot they tied would be altered.

This folktale inspires us to introduce in Section II a novel, relaxed, notion of privacy: privacy delegation. Privacy delegation does not prevent eavesdropping but it makes such an act inevitably detectable. It is useful in applications where we cannot aspire to have perfect encryption in the sense of Shannon[2].

A typical application is data storage (Section III-A): Information-theoretically secure encryption of data is impossible unless one keeps a secret key at least as long as the message that is remotely stored[2], defeating the purpose of storing it in the first place. So how can a hosting server meaningfully certify it protected one’s privacy?

This is related to the question of provable erasure (Section III-B): Can one verify some information was indeed deleted? These two tasks seem at first sight impossible, at least when restricting ourselves to classical physics. We use quantum theory instead and follow the path of Bennett and Brassard in 1984[3]. We present a straightforward protocol in Section IV and sketch a proof of its partial security in Section IV-C, before showing in Section IV-D it fails to be unconditionally secure against some limited attacks. We are, in Section IV-E, left with the question of how to fix it.

II Delegating Privacy

II-A Privacy Delegation: an Alternative Standard for Privacy

The general framework of privacy delegation is the following. After a certain protocol (e.g., data storage), the prover/server presents a proof to the verifier/user. If the proof is accepted by the verifier, they are sure the prover respected their privacy and that none of their data was leaked. On the other hand, the rejection of the proof by the verifier alarms them that their data might be compromised. Fig. 1 summarizes the idea of delegating privacy.

Definition 1**.**

A privacy-delegation protocol is an interactive protocol between a prover $\mathcal{P}$ and a verifier $\mathcal{V}$ that aims to establish whether a message $M$, sent by $\mathcal{V}$ to be temporarily held by $\mathcal{P}$, was rigorously protected from any past or future eavesdropper $\mathcal{A}$. $\mathcal{V}$ takes as input the message $M$ and the security parameter $n$. $(\mathcal{V},\mathcal{P},\mathcal{A})$ are modelled formally as probabilistic Turing machines.

We will define secure privacy delegation in the language of modern cryptography[4] through the notion of conditional indistinguishability: We will say the protocol is secure if, once the privacy certificate has been produced by the prover $\mathcal{P}$ and accepted by the verifier $\mathcal{V}$, no eavesdropping by an adversary $\mathcal{A}$ can offer any advantage in discriminating whether the now-completed privacy-delegation protocol was run on one message, or another, given the two messages are of the same length.

Definition 2**.**

A privacy-delegation protocol is information-theoretically secure if and only if, for every prover $\mathcal{P}$ and adversary $\mathcal{A}$,

[TABLE]

where $n$ is the security parameter and $\operatorname{negl}(n)$ is a negligible function, meaning smaller than the inverse of any polynomial function of $n$ for sufficiently large $n$.

$\operatorname{CERT}^{(\mathcal{V},\mathcal{P},\mathcal{A})}$ is the certification experiment and is passed (i.e., it evaluates to $\operatorname{true}$) if and only if the verifier $\mathcal{V}$ accepts the privacy certificate produced by the prover $\mathcal{P}$.

$\operatorname{DISCR}^{(\mathcal{V},\mathcal{P},\mathcal{A})}$ is the discrimination experiment, and it is passed if and only if, when attacking the privacy-delegation protocol executed on either the legitimate message or a dummy one (with equal probability), the adversary $\mathcal{A}$ guesses successfully which one it is. While not necessary, it is convenient to pose $\mathcal{P}$ and $\mathcal{A}$ as the same entity.

Note that conditioning $\operatorname{DISCR}^{(\mathcal{V},\mathcal{P},\mathcal{A})}$ on $\operatorname{CERT}^{(\mathcal{V},\mathcal{P},\mathcal{A})}$ does not imply that the certification experiment is necessarily done first, as a valid privacy certificate implies eavesdropping can neither have occurred before, nor can occur after.

Finally, the compact formulation of the privacy-delegation security definition reflects that the privacy-delegation protocol is secure as soon as either term is negligible.

Note how, in presence of a prover generating a valid privacy certificate with probability $1$, the above definition of secure privacy delegation reduces to Shannon’s notion of information-theoretic security against eavesdropping. Any scheme which is perfectly secure in Shannon’s sense can be seen as a trivial privacy-delegation scheme for which all certificates are valid.

We conclude our definition of privacy delegation by requiring one additional property: It is desirable that a privacy-delegation protocol fails with non-negligible probability only when the prover is dishonest.

Definition 3**.**

A privacy-delegation protocol is correct if and only if there exists a prover ${\mathcal{P}_{\text{honest}}}$ such that

[TABLE]

II-B Privacy Delegation Is an Alarm Bell

We shall stress the role of privacy delegation to detect information leaks; it is not by itself an encryption method: It offers no security against a malicious prover other than announcing its behaviour. In this sense, privacy delegation is more an alarm bell than a lock.

It can be useful in bringing a concept of liability to a hosting server. When a server leaks its users’ data, whether by malice or negligence, its privacy certificate will be rejected, and the server can subsequently be boycotted or taken to court.

Note that privacy delegation is different from digital watermarking[5], even if both techniques can be used to detect leaking agents. Digital watermarking mixes the sensitive data with hidden identification information in a way the source of the leak can be identified once the leaked data surfaces, while privacy delegation enables to detect misbehaviour even if no abnormal traces of the sensitive information have been observed. Privacy delegation offers in that sense stronger protection, even if neither approach directly prevents the leakage of data.

III Applications

III-A Remote Storage

An important application of privacy delegation is the remote storage of classical information. In this setting, a user wants to upload classical data to a server and be able to retrieve it later; while the server wants to prove to the user it protected its data from any eavesdropping — both in the past and in the future. We explicit the general form of this task.

The task of remote storage with privacy delegation:

A user (verifier $\mathcal{V}$) wants to store the classical message $M$ on a server (prover $\mathcal{P}$). The user can manipulate quantum states. 2. 2.

$\mathcal{V}$ generates a key $k$ at random and sends quantum encoding $\rho(M,k)$ to $\mathcal{P}$. The state $\rho(M,k)$ depends on the specific protocol. 3. 3.

Time passes. Eventually the user $\mathcal{V}$ asks the server $\mathcal{P}$ for its data $\rho(M,k)$ back and wants to be assured no copies were made. 4. 4.

$\mathcal{P}$ sends back a quantum state $\rho^{\prime}$ which will also act as the privacy certificate. If they are honest, $\rho^{\prime}=\rho(M,k)$. 5. 5.

$\mathcal{V}$ examines the privacy certificate (i.e., $\rho^{\prime}$). If they accept it and the protocol is secure, neither $\mathcal{P}$ nor any eavesdropper $\mathcal{A}$ have any information about $M$.

Note that the last step is not a full authentication of the quantum state $\rho(M,k)$ but only of its privacy-delegation layer111We were made aware after finishing this work of Daniel Gottesman’s concept of uncloneable encryption, and of its conjecture that it could be applicable to schemes that were different from quantum authentication schemes in that they would “not authenticate the classical message” [6]. Since our privacy-delegation scheme does no error estimation in the rectilinear basis, our work is coincidentally relevant to that interrogation. We do not directly study the impact of revealing the user’s key at the end of the privacy-delegation protocols, but it would be a very relevant question for this framework—it would make erasure even more meaningful.. It is, however, easy to guarantee the integrity of the classical data by adding on top of the privacy-delegation protocol a Wegman-Carter classical authentication scheme[7]. These schemes are well-known and can be information-theoretically secure even with a short key.

Because of the nature of remote storage with privacy, it is clear that if the user must keep a secret key: It must at least be shorter than the message to be stored. This is impossible if we aim for arbitrarily perfect secrecy, as stated by Shannon’s theorem, and it is why we look for privacy delegation instead of encryption.

Privacy delegation differs from, but is not incompatible with (as we develop next), the standard approach which is to aim for computational security. Computational security is reached through classical encryption relying on assumptions on the computing power of the adversary and the hardness of certain mathematical problems[8, 9].

III-B Provable Deletion

Provable deletion can be framed as a general case of remote storage. In this scenario, the user/verifier is not interested in retrieving their remotely stored data, but simply orders for its definitive erasure. The server/prover subsequently produces a token which, if accepted by the user, certifies the erasure. It is of special interest because classically, there is no way for the server to prove it did not secretly keep a backup of the data, as the act of copying classical information is undetectable.

The task of provable deletion with privacy delegation:

A user (verifier $\mathcal{V}$) wants to store the classical message $M$ on a server (prover $\mathcal{P}$). The user can manipulate quantum states. 2. 2.

$\mathcal{V}$ generates a key $k$ at random and sends quantum encoding $\rho(M,k)$ to $\mathcal{P}$. The state $\rho(M,k)$ depends on the specific protocol. 3. 3.

Time passes. Eventually the user $\mathcal{V}$ asks the server $\mathcal{P}$ to provably delete all of its data $M$. 4. 4.

$\mathcal{P}$ applies some operations on $\rho(M,k)$ and provides to $\mathcal{V}$ a privacy certificate $C$. 5. 5.

$\mathcal{V}$ examines $C$, whose acceptance proves the erasure of $M$.

We note here that we are analyzing the provable deletion of purely classical information. The no-go theorem for deleting arbitrary quantum states[10] does, therefore, not apply.

III-C Combining Privacy Delegation and Computational Security

In cases where standard privacy is desirable, meaning when privacy concerns require more than leak detection, privacy delegation can be complemented by classical encryption with computational security. Such a combination has multiple advantages. First, the storage is still meaningful as both techniques only necessitate short keys. Second, it makes possible the concept of recalling encrypted data. Standard classical encryption relies on assumptions that need not hold forever: Computing power grows exponentially, and the underlying hard mathematical problems could at any time be solved more easily than currently believed. There is no guarantee of everlasting security with standard classical encryption because any encrypted message can be stored by an adversary until its encryption becomes obsolete[11]. As such, there is always a risk, even if one uses strong up-to-date encryption, in uploading data to a server that could leak it. If, however, the server is able to produce a valid privacy certificate when the user wants to recall data to change its encryption, then the user can be sure that her or his data is still perfectly safe.

Finally, an adversary scanning massive amounts of data looking for weak encryptions, obsolete standards and/or valuable information can be quickly detected by the privacy-delegation scheme. This makes the hosting network more secure as a whole, since an adversary will not necessarily know what type of computational encryption they are attacking before they attack it in a detectable way.

IV Implementation: A Naive Protocol

We explore how to implement privacy delegation in the information-theoretically secure way of Section II. We start with a naive protocol which splits into two versions: remote storage ($\operatorname{STORAGE}$) and provable deletion ($\operatorname{ERASURE}$). We then show how they are partially secure whereas an eavesdropper can still gain some small amount of information even when privacy should be certified.

IV-A The Encoding

Both versions start the same way. The idea is for the user to preëmptively, at random positions, sprinkle the $m$ bits plain message in the rectilinear basis $\{\ket{0},\ket{1}\}$ with $n$ random “trap bits” in the diagonal basis $\{\ket{+},\ket{-}\}$. Fig. 2 illustrates the idea.

The secret key $k$, used later by the user to validate the privacy certificate provided by the server, then consists of the $n$ random check bits $s_{0},s_{1},\dots,s_{n}$ and their positions. The length of the secret key is, therefore (with the approximation valid when $m\gg n$),

[TABLE]

Note that the encoded message is not, and needs not be, securely encrypted in the traditional sense: An adversary can read almost all of it without requiring the secret key. However, when it does so, it destroys the information needed to conclude successfully the privacy delegation: The eavesdropping can be detected222This is different from quantum sealing[12], because we require here that the secret key be shorter than the message and do not insist on the message being totally readable by someone not having the key.. The security parameter $n$ constrains the minimal length $m$ of the message meaningfully stored ($m\gg n$), but it is quite natural to assume the message is long in the storage setting.

IV-B The Privacy Delegation

The protocol now splits into two versions according to the chosen task.

Remote-Storage Version

In the version $\operatorname{STORAGE}$, the server sends back the whole quantum state to the user, who then checks the integrity of the sprinkled bits and separate them from the meaningful data. If the user’s measurements on the sprinkled bits match their secret key, they accept the privacy certificate. Otherwise, they reject it and accuse the server of having leaked their information.

Note that the integrity of the information stored on the server is not guaranteed by that basic protocol even when the privacy delegation succeeds because an adversary could for example flip in the rectilinear basis (i.e., apply an $\operatorname{X}$-gate) every bit without making $\operatorname{CERT}$ fail. As mentioned before we are, however, not concerned by this kind of attack because it can be prevented in a straightforward way using a Wegman-Carter classical authentication scheme.

Provable-Deletion Version

In the version $\operatorname{ERASURE}$, the user asks the server to delete all of its data by measuring it in the diagonal basis and publicly announcing the result. If the server behaved honestly and did not leak any data, the output should be completely random except for the sprinkled check bits. The user accepts the privacy certificate if these values correspond to the secret key, and reject it otherwise. They ignore all non-sprinkled bits.

The proof of erasure comes from the server being forced to measure in the diagonal basis bits that are encoded in the rectilinear basis. This gives a series of uniformly random bits while destroying the original information. Since the diagonal-basis measurements are announced publicly by the prover, they cannot rewind the protocol later: The information which was encoded in the rectilinear basis is lost forever.

IV-C Partial Security

Both versions of the naive protocol offer arbitrarily high partial privacy-delegation security for sufficiently long messages, meaning that a valid certificate information-theoretically guarantees that at most a limited fraction of the total information was leaked. We aim to give the intuition behind this statement by proving it for non-coherent attacks. We show the privacy certificate will be rejected with arbitrarily high probability in presence of enough eavesdropping.

Theorem 1**.**

For both $\operatorname{STORAGE}$ and $\operatorname{ERASURE}$, the probability of any prover $\mathcal{P}$ producing a valid privacy certificate in presence of an eavesdropper $\tilde{A}(r)$ doing a rectilinear projective measurement on $r\in\Theta{(m)}$ qubits is given by

[TABLE]

where $m$ is the message length, $n$ the number of sprinkled check bits, and $\epsilon$ some fixed constant.

Proof.

The probability to pass the certification given the number $K=k$ of randomly sprinkled check bits that were measured by the eavesdropper is $2^{-k}$. $K$ follows a hypergeometric distribution (it is as if the eavesdropper had done classical sampling). The maximal probability of passing the certification is thus

[TABLE]

The upper bound follows from Hoeffding’s inequality [13, 14],

[TABLE]

with $\mu(K)=rn/(m+n)$ since $K$ is hypergeometric. ∎

IV-D An Attack Leaking Partial Information

An attack on a limited number of bits is, however, still possible. More precisely, an adversary can pass with non-negligible probability both a discrimination experiment (e.g., discriminating a message starting by 0 from an uniformly random one) and the certification experiment.

Theorem 2**.**

$\operatorname{STORAGE}$* and $\operatorname{ERASURE}$ are insecure against an eavesdropper $\mathcal{\bar{A}}$ measuring only, in the rectilinear basis, the first bit of the quantumly encoded message (of length $m$) and a prover $\mathcal{\bar{P}}$ proceeding honestly otherwise.*

Proof.

[TABLE]

∎

This does not mean that the protocol is useless, as it is already desirable to restrict the amount of stored data that can be leaked without the user becoming aware. This is especially so if the data are already encrypted with computational security. However, for our protocol to be more than only partially secure, the protocol run on any message should be indistinguishable from the one run on any other one. It is important to note the weakness exhibited in Thm. 2 is also present in naive implementations of BB84. We will discuss next how this problem is, however, usually resolved in the case of BB84, and what this implies for our privacy-delegation protocol.

IV-E Privacy Amplification by Public Discussion

In its original version[3], the BB84 quantum key-distribution protocol was also susceptible to the weak attack suggested in Proposition 2. There was, however, a fix: privacy amplification by public discussion [15, 16, 17]. These now well-known schemes aim to reduce the amount of information an eavesdropper can have about the private key. Two parties do so by assessing through public discussion how much information the eavesdropper can have about their key and by agreeing accordingly on a randomly selected error-correcting code or a hashing function from a universal class. When successful (if Eve does not have too much information), the result is a shorter but fully private key. Public discussion between Alice and Bob is achieved through a perfectly authenticated, but not private, channel.

In our storage scenario, public discussion is unavailable as it would necessitate communication between a user’s past and future selves. Communication from the past to the future could still be simulated by the user if they keep some secret information, but the amount of this information they would need to privately store to apply standard privacy-amplification schemes would be longer than the message they want to store. Privacy amplification by public discussion as it is usually done fails, therefore, to extend partial privacy-delegation security to full information-theoretic privacy-delegation security in the storage setting. Could there be an alternative way in this setting to amplify the partial security? And how close to information-theoretic security can we get in presence of more sophisticated adversaries?333Indistinguishability seems for example to be too strong of a security requirement if the adversary can build coherent attacks using unlimited computational power. That is because the short-key requirement implies that $\sum_{k\in\mathcal{K}}\rho(M,k)/|\mathcal{K}|$ cannot be uniform over all messages. These are our main open questions.

V Conclusion

We approached this work with one question in mind: Does quantum mechanics make provable deletion of classical data achievable? This leads us to define rigorously privacy delegation, an alternative to the ideal of privacy through encryption, and to formalize how to detect leaks during data storage.

We suggest that quantum-provable deletion could be possible by providing a naive privacy-delegation scheme for both the remote-storage and provable-deletion problems. The question remains, however, open as our scheme offers only partial security: It fails against restricted attacks on targeted bits. This shortcoming is known from quantum key distribution; unfortunately, the fix used there, namely privacy amplification by public discussion, cannot be applied in our setting.

To conclude, we emphasize that even if the protocols presented are out of reach of current quantum technologies — quantum memory is hard —, there is real value in devising and analyzing this kind of theoretical puzzles: Formal definitions give focus and direction to future research, while attempts to solve difficult problems under novel constraints invariably spark new ideas that ultimately turn into the building blocks needed to shrink the domain of the mathematical, cryptological and physical impossibles.

Acknowledgment

We would like to thank Alberto Montina, Arne Hansen, Bart van der Vecht, Boris Škorić, and Cecilia Boschini for helpful discussions, and the two anonymous reviewers for their useful comments.