Unforgeable quantum encryption Christian Majenz Joint work with - - PowerPoint PPT Presentation

▶
unforgeable quantum encryption
SMART_READER_LITE
LIVE PREVIEW

Unforgeable quantum encryption Christian Majenz Joint work with - - PowerPoint PPT Presentation

Jun 05, 2023 214 likes •896 views

Unforgeable quantum encryption Christian Majenz Joint work with Gorjan Alagic and Tommaso Gagliardoni Authenticated Encryption! ( Using AES with 128 bit block size in Galois Counter Mode and SHA2 ) Authenticated Encryption! ( Using AES with 128

slide-1
SLIDE 1

Unforgeable quantum encryption

Christian Majenz Joint work with Gorjan Alagic and Tommaso Gagliardoni

slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4
slide-5
SLIDE 5
slide-6
SLIDE 6

Authenticated Encryption! (Using AES with 128 bit block size in Galois Counter Mode and SHA2)

slide-7
SLIDE 7

Authenticated Encryption! (Using AES with 128 bit block size in Galois Counter Mode and SHA2)

slide-8
SLIDE 8

Taxonomy of security

slide-9
SLIDE 9

secrecy

Taxonomy of security

slide-10
SLIDE 10

secrecy authenticity, Integrity

Taxonomy of security

slide-11
SLIDE 11

secrecy authenticity, Integrity

Taxonomy of security

Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA)

slide-12
SLIDE 12

secrecy authenticity, Integrity

Taxonomy of security

Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA) Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks (IND-CCA1) = implication

slide-13
SLIDE 13

secrecy authenticity, Integrity

Taxonomy of security

Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA) Indistinguishability of ciphertexts under adaptive chosen ciphertext attacks (IND-CCA2) Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks (IND-CCA1) = implication

slide-14
SLIDE 14

secrecy authenticity, Integrity

Taxonomy of security

Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA) Indistinguishability of ciphertexts under adaptive chosen ciphertext attacks (IND-CCA2) Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks (IND-CCA1) = implication Integrity of ciphertexts (INT-CTXT) ( EUF-CMA for encryption schemes)

≈

slide-15
SLIDE 15

secrecy authenticity, Integrity

Taxonomy of security

Authenticated encryption

Definition

Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA) Indistinguishability of ciphertexts under adaptive chosen ciphertext attacks (IND-CCA2) Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks (IND-CCA1) = implication Integrity of ciphertexts (INT-CTXT) ( EUF-CMA for encryption schemes)

≈

slide-16
SLIDE 16

secrecy authenticity, Integrity

Taxonomy of security

Authenticated encryption Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA) Indistinguishability of ciphertexts under adaptive chosen ciphertext attacks (IND-CCA2) Indistinguishability of ciphertexts under chosen ciphertext attacks (IND-CCA1) Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA) Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks (IND-CCA1)

Broadbent and Jeffery, Crypto 2015 Alagic et al., ICITS 2016

Integrity of ciphertexts (INT-CTXT) ( EUF-CMA for encryption schemes)

≈

slide-17
SLIDE 17

secrecy authenticity, Integrity

Taxonomy of security

Authenticated encryption Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA) Indistinguishability of ciphertexts under adaptive chosen ciphertext attacks (IND-CCA2) Indistinguishability of ciphertexts under chosen ciphertext attacks (IND-CCA1) No quantum version!!! Why not, what is the difficulty? Indistinguishability of ciphertexts under chosen plaintext attacks (IND-CPA) Indistinguishability of ciphertexts under nonadaptive chosen ciphertext attacks (IND-CCA1)

Broadbent and Jeffery, Crypto 2015 Alagic et al., ICITS 2016

Integrity of ciphertexts (INT-CTXT) ( EUF-CMA for encryption schemes)

≈

slide-18
SLIDE 18

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec)

slide-19
SLIDE 19

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec) Enck

slide-20
SLIDE 20

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec) m1 c1 Enck

slide-21
SLIDE 21

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec) m1 c1 m2 c2 Enck

slide-22
SLIDE 22

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec) m1 c1 m2 c2 … mq cq Enck

slide-23
SLIDE 23

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec) m1 c1 m2 c2 … mq cq c* Enck

slide-24
SLIDE 24

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec) m1 c1 m2 c2 … mq cq c* Success: i) c* ≠ ci for all i = 1,...,q ii) Deck(c*) ≠ ⊥ Enck

slide-25
SLIDE 25

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec) m1 c1 m2 c2 … mq cq c* Success: i) c* ≠ ci for all i = 1,...,q ii) Deck(c*) ≠ ⊥ Enck

What about encryption of quantum data?

slide-26
SLIDE 26

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec)

What about encryption of quantum data?

Quantum i (attempt)

Success: i) c* ≠ ci for all i = 1,...,q ii) Deck(c*) ≠ ⊥ m1 c1 m2 c2 … mq cq c* Enck

slide-27
SLIDE 27

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec)

What about encryption of quantum data?

Quantum i (attempt)

Success: i) c* ≠ ci for all i = 1,...,q ii) Deck(c*) ≠ ⊥ m1 c1 m2 c2 … mq cq c* Enck

Quantum

slide-28
SLIDE 28

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec)

What about encryption of quantum data?

Quantum i (attempt)

|m1⟩ |c1⟩ |m2⟩ |c2⟩ … |mq⟩ |cq⟩ Enck c* Success: i) c* ≠ ci for all i = 1,...,q ii) Deck(c*) ≠ ⊥ Enck

Quantum

slide-29
SLIDE 29

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec)

What about encryption of quantum data?

Quantum i (attempt)

|m1⟩ |c1⟩ |m2⟩ |c2⟩ … |mq⟩ |cq⟩ Enck |c*⟩ Success: i) c* ≠ ci for all i = 1,...,q ii) Deck(c*) ≠ ⊥ Enck

Quantum

slide-30
SLIDE 30

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec)

What about encryption of quantum data?

Quantum i (attempt)

|m1⟩ |c1⟩ |m2⟩ |c2⟩ … |mq⟩ |cq⟩ Success: i) ii) Deck(|c*⟩) ≠ | ⊥ ⟩ ???????????? Enck |c*⟩ Enck

Quantum

slide-31
SLIDE 31

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec)

What about encryption of quantum data?

Quantum i (attempt)

|m1⟩ |c1⟩ |m2⟩ |c2⟩ … |mq⟩ |cq⟩ Success: i) ii) Deck(|c*⟩) ≠ | ⊥ ⟩ ???????????? Enck |c*⟩ Enck

Unsurmountable problems arise:

  • no-cloning: can’t copy for later comparison with .
  • destructive nature of quantumn measurement: even assuming we had coexisting

copies of and , can’t compare them without destroying .

|ci⟩ |c*⟩ |ci⟩ |c*⟩ |c*⟩

Quantum

slide-32
SLIDE 32

Integrity of ciphertexts

An encryption scheme has integrity of ciphertexts, if no successfull ciphertext-forging adversary exists:

(KeyGen, Enc, Dec)

What about encryption of quantum data?

Quantum i (attempt)

|m1⟩ |c1⟩ |m2⟩ |c2⟩ … |mq⟩ |cq⟩ Success: i) ii) Deck(|c*⟩) ≠ | ⊥ ⟩ ???????????? Enck |c*⟩ Enck

Unsurmountable problems arise:

  • no-cloning: can’t copy for later comparison with .
  • destructive nature of quantumn measurement: even assuming we had coexisting

copies of and , can’t compare them without destroying .

|ci⟩ |c*⟩ |ci⟩ |c*⟩ |c*⟩

Quantum

IND-CCA2: Adversary gets decryption oracle after the challenge phase, but can’t decrypt the

  • challenge. Similar problem

⟹

slide-33
SLIDE 33

Quantum (plaintext) unforgeability

For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum

m1 c1 m2 c2 … mq cq c* Success: i) m* := Deck(c*) ≠ mi for all i = 1,...,q ii) Deck(c*) ≠ ⊥ Enck

Quantum (plaintext) unforgeability — Setup

slide-34
SLIDE 34

Quantum (plaintext) unforgeability

For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum

|m1⟩ |c1⟩ |m2⟩ |c2⟩ … |mq⟩ |cq⟩ Success: i) ii) Deck(|c*⟩) ≠ | ⊥ ⟩ ???????????? Enck |c*⟩ Enck

Quantum (plaintext) unforgeability — Setup

slide-35
SLIDE 35

Quantum (plaintext) unforgeability — Setup

For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum

M1 C1 M2 C2 … Mq Cq Success: i) ii) M* ≠ | ⊥ ⟩ ???????????? Enck C* Enck M* Deck

slide-36
SLIDE 36

For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum

Quantum (plaintext) unforgeability — Setup

Mi M* Success: i) ii) M* ≠ | ⊥ ⟩ ???????????? M1 C1 M2 C2 … Mq Cq Enck C* Enck M* Deck

Problem: and don’t coexist. Ideas

slide-37
SLIDE 37

For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum

Quantum (plaintext) unforgeability — Setup

Mi M*

  • look at the channels with input and output .

Mi M* Success: i) ii) M* ≠ | ⊥ ⟩ ???????????? M1 C1 M2 C2 … Mq Cq Enck C* Enck M* Deck

Problem: and don’t coexist. Ideas

slide-38
SLIDE 38

For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum

Quantum (plaintext) unforgeability — Setup

Mi M*

  • look at the channels with input and output .

Mi M* Success: i) ii) M* ≠ | ⊥ ⟩ ???????????? M1 C1 M2 C2 … Mq Cq Enck C* Enck M* Deck

Problem: and don’t coexist. Ideas

  • compare two games, one testing whether any of these channels is the identity, one

testing validity of output

slide-39
SLIDE 39

For simplicity of exposition, let’s try to generalize plaintext unforgeability to quantum

Quantum (plaintext) unforgeability — Setup

Mi M*

  • look at the channels with input and output .

Mi M* Success: i) ii) M* ≠ | ⊥ ⟩ ???????????? M1 C1 M2 C2 … Mq Cq Enck C* Enck M* Deck

Problem: and don’t coexist. Ideas

  • compare two games, one testing whether any of these channels is the identity, one

testing validity of output

  • efficiency needed for reduction proofs
slide-40
SLIDE 40

Identity test

How do we test whether a quantum channel is the identity?

slide-41
SLIDE 41

Identity test

How do we test whether a quantum channel is the identity?

|ϕ+⟩ Λ

|ϕ+⟩ ⟨ϕ+| 𝕁 − |ϕ+⟩ ⟨ϕ+|

  • r

?

  • ne efficient solution (Broadbent & Waynewright ICITS 2016):
slide-42
SLIDE 42

Identity test

How do we test whether a quantum channel is the identity? inner product in the Choi-Jamiołkowski picture

|ϕ+⟩ Λ

|ϕ+⟩ ⟨ϕ+| 𝕁 − |ϕ+⟩ ⟨ϕ+|

  • r

?

  • ne efficient solution (Broadbent & Waynewright ICITS 2016):
slide-43
SLIDE 43

Identity test

How do we test whether a quantum channel is the identity? inner product in the Choi-Jamiołkowski picture

|ϕ+⟩ Λ

|ϕ+⟩ ⟨ϕ+| 𝕁 − |ϕ+⟩ ⟨ϕ+|

  • r

?

  • ne efficient solution (Broadbent & Waynewright ICITS 2016):
  • ther identity tests possible that don’t need entanglement….
slide-44
SLIDE 44

Identity test

How do we test whether a quantum channel is the identity? inner product in the Choi-Jamiołkowski picture

|ϕ+⟩ Λ

|ϕ+⟩ ⟨ϕ+| 𝕁 − |ϕ+⟩ ⟨ϕ+|

  • r

?

  • ne efficient solution (Broadbent & Waynewright ICITS 2016):
  • ther identity tests possible that don’t need entanglement….

Let be the identity test from register to register .

IdR1R2 R1 R2

slide-45
SLIDE 45

Two games

QUF-Forge game

Success: i) ∅ ii) M* ≠ | ⊥ ⟩ M1 C1 M2 C2 … Mq Cq Enck C* Enck M* Deck

slide-46
SLIDE 46

QUF-Test game

Enck M1

Two games

QUF-Forge game

Success: i) ∅ ii) M* ≠ | ⊥ ⟩ M1 C1 M2 C2 … Mq Cq Enck C* Enck M* Deck

slide-47
SLIDE 47

QUF-Test game

Enck M1

Two games

QUF-Forge game

Success: i) ∅ ii) M* ≠ | ⊥ ⟩ M1 C1 M2 C2 … Mq Cq Enck C* Enck M* Deck

slide-48
SLIDE 48

QUF-Test game

Enck M1

Two games

QUF-Forge game

Success: i) ∅ ii) M* ≠ | ⊥ ⟩ M1 C1 M2 C2 … Mq Cq Enck C* Enck C1 M′

1

M* Deck

slide-49
SLIDE 49

QUF-Test game

Enck M1

Two games

QUF-Forge game

Success: i) ∅ ii) M* ≠ | ⊥ ⟩ M1 C1 M2 C2 … Mq Cq Enck C* Enck C1 M′

1

M* Deck C* M2 C2 M′

2

Mq Cq M′

q

… M* Deck

slide-50
SLIDE 50

QUF-Test game

Enck M1

Two games

QUF-Forge game

Success: i) ∅ ii) M* ≠ | ⊥ ⟩ M1 C1 M2 C2 … Mq Cq Enck C* Enck C1 M′

1

Run For all . (Ok by gentle measurement lemma)

IdM′

iM*

i M* Deck C* M2 C2 M′

2

Mq Cq M′

q

… M* Deck

slide-51
SLIDE 51

QUF-Test game

Enck M1

Two games

QUF-Forge game

Success: i) ∅ ii) M* ≠ | ⊥ ⟩ M1 C1 M2 C2 … Mq Cq Enck C* Enck C1 M′

1

Run For all . (Ok by gentle measurement lemma)

IdM′

iM*

i Cheat (=“Success”): i) IdM′

iM*

ii) ∅ succeeds for at least one i M* Deck C* M2 C2 M′

2

Mq Cq M′

q

… M* Deck

slide-52
SLIDE 52

Quantum (plaintext) unforgeability — Definition

(KeyGen, Enc, Dec) 𝒝 ℙ [𝒝 wins QUF − forge] − ℙ [𝒝 wins QUF − test] ≤ negl(n) Definition (Quantum plaintext unforgeability): A quantum encryption scheme has unforgeable plaintexts, if for all QPT adversaries it holds that

slide-53
SLIDE 53

Two games

QUF-Forge game QUF-Test game

Enck M1 Success: i) ∅ ii) M* ≠ | ⊥ ⟩ M1 C1 M2 C2 … Mq Cq Enck C* Enck C1 M′

1

Run For all . (Ok by gentle measurement lemma)

IdM′

iM*

i Cheat (=“Success”): i) IdM′

iM*

ii) ∅ succeeds for at least one i M* Deck C* M2 C2 M′

2

Mq Cq M′

q

… M* Deck

Quantum (plaintext) unforgeability — Definition

slide-54
SLIDE 54

Quantum (plaintext) unforgeability — Definition

(KeyGen, Enc, Dec) 𝒝 ℙ [𝒝 wins QUF − forge] − ℙ [𝒝 wins QUF − test] ≤ negl(n) Definition (Quantum plaintext unforgeability): A quantum encryption scheme has unforgeable plaintexts, if for all QPT adversaries it holds that

slide-55
SLIDE 55

Quantum (plaintext) unforgeability — Definition

(KeyGen, Enc, Dec) 𝒝 ℙ [𝒝 wins QUF − forge] − ℙ [𝒝 wins QUF − test] ≤ negl(n) Definition (Quantum plaintext unforgeability): A quantum encryption scheme has unforgeable plaintexts, if for all QPT adversaries it holds that ⟹

  • implies IND-CPA, ok because authentication encryption (Barnum et al. 2002).
slide-56
SLIDE 56

Quantum (plaintext) unforgeability — Definition

(KeyGen, Enc, Dec) 𝒝 ℙ [𝒝 wins QUF − forge] − ℙ [𝒝 wins QUF − test] ≤ negl(n) Definition (Quantum plaintext unforgeability): A quantum encryption scheme has unforgeable plaintexts, if for all QPT adversaries it holds that

  • classical restriction is equivalent to authenticated encryption

⟹

  • implies IND-CPA, ok because authentication encryption (Barnum et al. 2002).
slide-57
SLIDE 57

Quantum (plaintext) unforgeability — Definition

(KeyGen, Enc, Dec) 𝒝 ℙ [𝒝 wins QUF − forge] − ℙ [𝒝 wins QUF − test] ≤ negl(n) Definition (Quantum plaintext unforgeability): A quantum encryption scheme has unforgeable plaintexts, if for all QPT adversaries it holds that

  • classical restriction is equivalent to authenticated encryption
  • can be upgraded to quantum ciphertext authentication:

⟹

  • implies IND-CPA, ok because authentication encryption (Barnum et al. 2002).
slide-58
SLIDE 58

Quantum (plaintext) unforgeability — Definition

(KeyGen, Enc, Dec) 𝒝 ℙ [𝒝 wins QUF − forge] − ℙ [𝒝 wins QUF − test] ≤ negl(n) Definition (Quantum plaintext unforgeability): A quantum encryption scheme has unforgeable plaintexts, if for all QPT adversaries it holds that

  • classical restriction is equivalent to authenticated encryption
  • can be upgraded to quantum ciphertext authentication:

✴ possible via lemma: any quantum encryption function can be implemented

by classical sampling and unitary transformation ⟹

  • implies IND-CPA, ok because authentication encryption (Barnum et al. 2002).
slide-59
SLIDE 59

Quantum (plaintext) unforgeability — Definition

(KeyGen, Enc, Dec) 𝒝 ℙ [𝒝 wins QUF − forge] − ℙ [𝒝 wins QUF − test] ≤ negl(n) Definition (Quantum plaintext unforgeability): A quantum encryption scheme has unforgeable plaintexts, if for all QPT adversaries it holds that

  • classical restriction is equivalent to authenticated encryption
  • can be upgraded to quantum ciphertext authentication:

✴ possible via lemma: any quantum encryption function can be implemented

by classical sampling and unitary transformation

✴ use identity test for quantum part and save a copy of classical randomness

⟹

  • implies IND-CPA, ok because authentication encryption (Barnum et al. 2002).
slide-60
SLIDE 60

What I couldn’t explain in 17 min…

slide-61
SLIDE 61

What I couldn’t explain in 17 min…

QIND-CCA2: Use identity test to detect challenge decryption, again by comparing two games

slide-62
SLIDE 62

What I couldn’t explain in 17 min…

QIND-CCA2: Use identity test to detect challenge decryption, again by comparing two games quantum authenticated encryption? Could define as QUF+QIND-CCA2, but…

slide-63
SLIDE 63

What I couldn’t explain in 17 min…

QIND-CCA2: Use identity test to detect challenge decryption, again by comparing two games quantum authenticated encryption? Could define as QUF+QIND-CCA2, but… …alternative real vs. ideal characterization (Shrimpton, 2004) is made for the identity testing technique!

slide-64
SLIDE 64

What I couldn’t explain in 17 min…

QIND-CCA2: Use identity test to detect challenge decryption, again by comparing two games quantum authenticated encryption? Could define as QUF+QIND-CCA2, but… …alternative real vs. ideal characterization (Shrimpton, 2004) is made for the identity testing technique! separate definition: QAE

⟹

slide-65
SLIDE 65

What I couldn’t explain in 17 min…

QIND-CCA2: Use identity test to detect challenge decryption, again by comparing two games quantum authenticated encryption? Could define as QUF+QIND-CCA2, but… …alternative real vs. ideal characterization (Shrimpton, 2004) is made for the identity testing technique! separate definition: QAE

⟹

simple construction from pseudorandom functions and unitary 2-designs

slide-66
SLIDE 66

Taxonomy of quantum security

new notions

slide-67
SLIDE 67

Conclusion

  • Generalizing authenticity and integrity security notions (and adaptive CCA security) to

quantum is complicated by the fact that states from different stages of an algorithm cannot be compared

  • Divide and conquer! If it is impossible to check two properties in one game, use two

(indistinguishable) games!

  • That way we get quantum versions of the integrity notions used in modern crypto.
  • They can be fulfilled and have nice relationships.
  • Is QAE=QUF+QIND-CCA2?
  • Relationship to quantum world notions?

What’s left to do?