Applications of single-qubit rotations in quantum public-key cryptography

0.19 MB·English

by  Georgios M. Nikolopoulos

Applications of single-qubit rotations in quantum public-key cryptography
Georgios M. Nikolopoulos
Institute of Electronic Structure and Laser, FORTH,
P. O. Box 1527, Heraklion 711 10, Crete, Greece
(Dated: February 2, 2008)
We discuss cryptographic applications of single-qubit rotations from the perspective of trapdoor
one-wayfunctionsandpublic-keyencryption. Inparticular,wepresentanasymmetriccryptosystem
whose security relies on fundamental principles of quantum physics. A quantum publickey is used
fortheencryptionof messages while decryptionispossible bymeansofaclassical privatekeyonly.
The trapdoor one-way function underlying the proposed cryptosystem maps integer numbers to
quantumstates of a qubitand its inversion can be infeasible by virtueof theHolevo’s theorem.
8
0 PACSnumbers: 03.67.Dd,03.67.Hk
0
2
I. INTRODUCTION lemeveninthepresenceofthemostpowerfuladversaries.
n
Nevertheless, the key management remains one of the
a
J Modern public-key (or else asymmetric) cryptography maindrawbacksofsymmetricencryptionschemes[1]. In
particular,the problempertains to largenetworkswhere
8 reliesonnumericaltrapdoorone-wayfunctions,i.e.,func-
1 tions that are “easy” to compute, but “hard” to invert each entity needs a secret key with every other entity.
without some additionalinformation (the so-calledtrap- Hence, the total number of secret keys scales quadrati-
] cally with the number of users in the network.
door information) [1]. The main characteristic of these
h
p mathematical objects is that they provide the legitimate One solution to the key-management problem is the
- users with a tractable problem, while at the same time use of an unconditionally trusted third party which is
nt any unauthorized user (adversary) has to face a compu- burdened with the key management and acts as a key-
a tationally infeasible problem. This barrier between le- distribution center (KDC). The main problem with this
u gitimate users and adversaries, due to complexity of ef- solution, however,is that the KDC itself becomes an at-
q fort,isthekeyideabehindmostoftheknownpublic-key tractivetarget,whileacompromisedKDCrentersimme-
[
cryptosystems. Each participant in such a cryptosystem diatelyallcommunicationsinsecure. Analternativesolu-

1 has to have a personal key consisting of two parts, i.e., tionto the key-managementproblemisprovidedbycon-
v the public and the secret (also known as private) part. ventional public-key cryptosystems which are very flex-
0 Messages are encrypted with use of the public key and ible but, as we discussed earlier, offer computationally
4
the decryption of the resulting ciphertext is possible by security only.
8
means of the private key. Clearly, an ideal solution to both of the key-
2
. The security of conventional public-key cryptography distribution and management problems is a quantum
1
relies on the hardness of some computational problems public-key (asymmetric) cryptosystem, which combines
0
(e.g., integer factorization problem, discrete logarithm the provablesecurityof QKDprotocolswith the flexibil-
8
0 problem, etc). These numerical problems are considered ity of conventional public-key encryption schemes. The
: to be good candidates for one-way functions (OWFs), development of such a cryptosystem, however, requires
v
and this belief relies mainly on the large amount of re- theexistenceofquantumtrapdoorOWFs. Inparticular,
i
X sources (computing power and time) required for their the one-way property of these functions has to rely on
r solution using the best known algorithms. Nevertheless, fundamental principles of quantum theory, rather than
a the fact that the existence of numerical OWFs has not unproven computational assumptions.
beenprovedrigorouslyuptonow,makesalloftheknown To the best of our knowledge, the number of related
public-key cryptosystems vulnerable to any future ad- theoreticalinvestigationsis rathersmall, andallof them
vancesinalgorithmsandhardware(e.g.,theconstruction pertain to a futuristic scenario where all of the parties
of a quantum computer). involved(legitimate usersandadversaries)possessquan-
In contrast to the computational security offered by tumcomputers. The conceptofquantumOWFwasfirst
conventional public-key schemes, there exist symmetric introducedin[4,5],wheretheauthorsdemonstratedthat
cryptosystems (e.g., one-time pad) which offer provable such a function can be obtained by mapping classical
securityprovidedthatasecrettrulyrandomkeyisshared bit-strings to quantum states of a collection of qubits.
between the entities who wish to communicate. To- Nevertheless, these two papers do not pertain directly
day,the establishmentofsucha key betweentwoparties to public-key encryption, but rather to quantum fin-
can be achieved by means of quantum key-distribution gerprinting [4], and digital signatures [5, 6]. Later on,
(QKD)protocols[2]. Byvirtueoffundamentalprinciples Kawachi et al. [7] investigated the cryptographic prop-
of quantum mechanics that do not allow passive moni- ertiesof the distinguishability problembetweentworan-
toringand cloning ofunknownquantumstates [3], QKD dom coset states with hidden permutation. This prob-
protocolsprovide a solutionto the key-distribution prob- lem can be viewed as a quantum extension of the dis-
2
tinguishability problems between two probability distri- covering the integer s from the given state |φ i) with a
s
butions used in conventional cryptography [1]. Finally, non-negligible probability.
besides quantum OWFs there have been also investiga- Actually, by definition the inversion of a quantum
tionsonOWFswhichrelyon“hard”problemsappearing OWF is a hard problem for everyone (legitimate users
inotherareasofphysicssuchasstatisticalphysics[8],op- and eavesdroppers). For cryptographic applications,
tics [9], and mesoscopicphysics of disorderedmedia [10]. however, authorized users should be able to identify the
In this paper we establish a theoretical framework for state of the quantum system, and thus inverse the map
quantumpublic-keyencryptionbasedonqubitrotations. s 7→ |φ i, more efficiently than any unauthorized party.
s
Inparticular,weexplorethetrapdoorandone-wayprop- Hence,itisessentialtointroduceatrapdoorinformation
ertiesoffunctionsthatmapintegernumbersontosingle- which makes the inversion of the map computationally
qubit states. Moreover, we present an asymmetric cryp- feasible for anyone who possesses it.
tosystem which is provably secure even against powerful Having introduced the notion of quantum trapdoor
quantum eavesdropping strategies. OWFs in a rather general theoretical framework, in the
followingwespecializethepresentdiscussiontoapartic-
ular family of such functions based on single-qubit rota-
II. QUANTUM TRAPDOOR (ONE-WAY) tions.
FUNCTIONS
Inthissectionweintroducethenotionofthequantum B. A quantum trapdoor function based on
single-qubit rotations
trapdoor OWF, that maps integer numbers to quantum
statesofaphysicalsystem. Thediscussioninvolvesasce-
nariowherealloftheparties(legitimateusersandadver- Forthesakeofsimplicity,wewillpresentourquantum
saries) possess quantum computers and are only limited trapdoorOWFinthe contextofsingle-qubitstateslying
by the laws of physics. on the x−z plane of the Bloch-sphere. The main idea
can be easily extended to qubit states that lie on the
three-dimensional Bloch sphere.
A. Definition and properties Let us denote by {|0zi, |1zi} the eigenstates of the
Pauli operator Zˆ = (|0 ih0 | − |1 ih1 |), which form
z z z z
Definition. Consider two sets S and Q which involve an orthonormalbasis in the Hilbert space of a qubit H2.
numbers and quantum states of a physical system, re- A general qubit state lying on the x−z plane can be
spectively. AquantumOWFisamapM:S7→Q,which written as |ψ(θ)i=cos(θ/2) |0zi+sin(θ/2) |1zi, where
is “easy” to perform, but “hard” to invert. A quantum 0≤θ <2π. Henceunliketheclassicalbitwhichcanstore
OWFwhoseinversionbecomesfeasiblebymeansofsome adiscretevariabletakingonlytworealvalues(thatis“0”
information (trapdoor information) is a quantum trap- and“1”),aqubitmayrepresentacontinuumofstateson
door OWF. the x−z Blochplane. Introducingthe rotationoperator
Throughout this work we will focus on quantum trap- about the y axis, Rˆ(θ) = e−iθYˆ/2 with Yˆ = i(|1zih0z| −
door OWFs whose input is an integer s ∈ Z := |0 ih1 |), wemay alternativelywrite |ψ(θ)i=Rˆ(θ)|0 i.
n z z z
{0,1,...,n − 1|n ∈ N}, and its output is the state of The input ofthe proposedquantumtrapdoorfunction
aquantumsystem,say |φsi. Toelaboratefurtheronthe isarandomintegersuniformlydistributedoverZ2n with
terms “easy” and “hard”, consider a quantum system n ∈ N, and a qubit initially prepared in |0 i. Thus, n-
z
initially preparedin some state |0iandletH be the cor- bit strings suffice as labels to identify the input s for
respondingHilbert space. Fora randomlychosens∈Z fixed n. For given values of n ∈ N and s ∈ Z , the
n 2n
we apply an operation Oˆ(s) : H 7→ H on the system, qubitstateisrotatedbysθ aroundthey-axiswithθ =
n n
which changes the initial state |0i → |φ i = Oˆ(s)|0i. π/2n−1. Hence, for some fixed n ∈ N, the output of the
s
ThesetofallpossibleoutputstatesofthequantumOWF OWF pertains to the class of states Qn ={|ψs(θn)i|s ∈
is Q ≡ {|φsi|s ∈ Zn}, and belongs to H. If the map Z2n,θn =π/2n−1}, with
M:Z 7→Q is a bijection there is a unique s ∈Z such
n n
that |0i→ |φsi, i.e., M is one-to-one and |Zn|=|Q|. |ψs(θn)i ≡ Rˆ(sθn)|0zi
The map s 7→ |φ i must be “easy” to compute in the sθ sθ
s n n
= cos |0 i+sin |1 i. (1)
sense that, for a givens∈Zn, the transformationonthe (cid:18) 2 (cid:19) z (cid:18) 2 (cid:19) z
system’s state |0i → |φ i, can be performed efficiently
s
on a quantum computer with polynomial resources. On Clearly, both of the input and output sets (i.e., Z and
2n
theotherhand,inorderforthemaps7→ |φ itoserveas Q , respectively) remain unknown if n is not revealed.
s n
aquantumOWF,itsinversionmustbea“hard”problem For a given pair of integers {n,s}, the function s 7→
by virtue offundamental principles of quantum mechan- |ψ (θ )i is easy to compute since it involves single-qubit
s n
ics. In other words, given a state |φ i chosen at random rotationsonly. Inparticular,itisknownthatanysingle-
s
fromQ,thereisnoefficientquantumalgorithmthatsuc- qubit operation can be simulated to an arbitrary accu-
ceeds in performing the inverse map |φ i 7→ s (i.e., re- racyǫ>0,byaquantumalgorithminvolvingauniversal
s
3
setofgates(i.e.,Hadamard,phase,controlled-NOT,and amount of information one may have on c, the number
π/8gates)[3]. Moreover,thissimulationisefficientsince m will also remain unknown. The one-way and trap-
itsimplementationrequiresanoverheadofresourcesthat door properties of the map s 7→ |ψ (θ )i will become
s n
scales polynomially with log(ǫ−1). clearer in the following, through the security analysis of
Inversion of the map s 7→ |ψ (θ )i means to recover an asymmetric quantum encryption scheme.
s n
s from a given qubit state |ψ (θ )i chosen at random
s n
from an unknown set Q . Nevertheless, let us consider
n
for the time being that n is known. In this case, the III. QUANTUM PUBLIC-KEY ENCRYPTION
inversion of the map reduces to the problem of discrim-
ination between various non-orthogonalstates chosen at
In this section we introduce an asymmetric cryptosys-
random from a known set Q . The number of non-
n tem based on the quantum trapdoor OWF presented in
orthogonal states increases as we increase n, whereas
Sec. II. In analogy to classical asymmetric cryptosys-
for n >> 1 we have for the nearest-neighbor overlap
tems, in the proposed protocol the encryption and the
hψ (θ )|ψ (θ )i=cos(θ /2)→1. Hence, a projective
s n s+1 n n decryption keys are different. In the following we de-
von Neumann measurement cannot distinguish between
scribe the three stages of the protocol.
allof the states for n>>1,since the number of possible
Stage 1 — Key generation. Each user participating
outcomes in such a measurement is restricted by the di-
in the cryptosystem generates a key consisting of a pri-
mensions of the state space of the system (i.e., qubit in
vate part d, and a public part e, as determined by the
our case).
following steps.
One has therefore, to resort to more general mea-
surements which can be always described formally by 1. Choose a random positive integer n≫1.
a positive operator-valuedmeasure (POVM) involving a
number of non-negative operators [3]. In the theoreti- 2. Choose a random integer string s of length N i.e.,
cal framework of POVMs, an input state is associated s = (s ,s ,...,s ), with s chosen independently
1 2 N j
withaparticularoutcomeofthemeasurement,whileop- from Z .
2n
timization is typically performed with respect to vari-
ous quantities (e.g., probability of inconclusive results, 3. Prepare N qubits in the state |0 i⊗N.
z
mutual information, conditional probabilities, etc). It is
worth noting, however, that some of these strategies are 4. Apply a rotationRˆ(j)(s θ ) onthe jth qubit, with
j n
not applicable for the states of the set Q , since they θ = π/2n−1. Thus, the state of the jth qubit
n n
are not linearly independent when n > 2 (e.g., see Ref. becomes |ψ (θ )i =Rˆ(j)(s θ )|0 i, andisofthe
sj n j j n z
[11]). Inanycase,accordingto Holevo’stheorem[3], the form (1).
classicalinformation that can be extracted from a single
qubit by means of a POVM is at most 1 bit, whereas n 5. The private key is d={n,s}, while the public key
bitsrequiredtoidentifythe randomlychosens∈Z2n for is e = {N, |Ψ(spk)(θn)i}, with the N-qubit state
sfix7→ed|nψ.(Hθe)nicea,ctwseasseaeqthuaatntfuomr aOgWivFenthna≫t is1“tehaesym”atpo |Ψ(spk)(θn)i≡ Nj=1 |ψsj(θn)ij.
s n
N
perform but hard to invert. Actually, the inversion may
Clearly in the proposed protocol, the private key is clas-
become even harder if n is not publicly announced, thus
sicalwhereasthepublickeyisquantumasitinvolvesthe
rendering the sets from which s and |ψ (θ )i are chosen
s n state of N qubits. Moreover, note that each user may
(that is, Z and Q , respectively) practically unknown
2n n produce multiple copies of his/her own public key as the
(see also discussion in Sec. IV).
quantum state is known, and thus its copying does not
The map s 7→ |ψ (θ )i may also act as a trapdoor
s n violate the no-cloning theorem.
OWF when it involves two consecutive rotations. To
Stage 2 — Encryption. Assume now that one of
demonstratethis fact,let us assumethatafter Rˆ(sθ ), a
n the users (Bob) wants to send Alice an r-bit message
second rotation Rˆ(mθn) is applied to the same qubit, m = (m1,m2,...,mr), with mj ∈ {0,1} and r ≤ N.
with a randomly chosen integer m ∈ Z2n such that Toencryptthe message,heshoulddothefollowingsteps
s + m = c mod 2n. The state of the qubit after without altering the order of the public-key qubits:
the second rotation becomes |ψ (θ )i = Rˆ(cθ )|0 i =
c n n z
Rˆ(mθ )Rˆ(sθ )|0 i. Having access to the qubit before 1. Obtain Alice’s authenticpublic key e. If r>N, he
n n z
andafter the secondrotation(i.e., giventhe qubit states shouldaskAlicetoincreasethelengthofherpublic
|ψ (θ )i and |ψ (θ )i), we areinterested in deducing m. key.
s n c n
This task, however, requires substantial information on
both of the numbers s and c, which is not possible for 2. Encrypt the jth bit of his message, say mj, by
n ≫ 1. More precisely, as discussed earlier, in this case applying the rotation Rˆ(j)(m π) on the corre-
j
only negligible information can be extracted from the sponding qubit of the public key, whose state
state |ψ (θ )i about the randomly chosen s, which thus becomes |ψ (θ )i =Rˆ(j)(m π)|ψ (θ )i .
s n sj,mj n j j sj n j
remains practically unknown. Hence, irrespective of the
4
3. The quantum ciphertext (or else cipher state) is Authenticationisacrucialrequirementforsecure,clas-
the new state of the N qubits, i.e., |Ψ(sc,m) (θn)i = sical or quantum, encryption schemes since without it
N |ψ (θ )i , and is sent back to Alice. anyencryptionschemeisvulnerabletoanimpersonation
j=1 sj,mj n j attack [1]. In modern cryptography, secrecy (confiden-
N
Notethat,attheendoftheencryptionstage,themes- tiality)andauthenticityaretreatedasdistinctandinde-
sage has been encoded in the first r qubits of the cipher pendentcryptographicgoals[1]. Inparticular,public-key
state. Thus, in the decryption stage Alice may focus on encryption aims at confidentiality whereas other crypto-
this part of the cipher state, discarding the remaining graphicgoals(suchasdataintegrity,authentication,and
N−r qubits,whichdonotcarryanyadditionalinforma- non-repudiation) are provided by other cryptographic
tion. primitives including message authentication codes, dig-
Stage 3 — Decryption. To recover the plaintext m ital signatures, and fingerprints. Following the same at-
(c) titude, throughout this section we focus on the security
from the cipher state |Ψs,m(θn)i, Alice has to perform
provided by the quantum encryption scheme under con-
the following steps.
sideration.
1. Undo her initial rotations, i.e., to apply Toemphasize,however,theimportanceofauthenticity,
Rˆ(j)(s θ )−1 on the j-th qubit of the cipher- in the encryption stage of the protocol described in Sec.
j n
text. III it is explicitly stated that Bob should be able to ob-
tain an authentic copy of Alice’s public key. A quantum
2. Measure each qubit of the ciphertext in the basis digitalsignaturescheme forauthenticationpurposeswas
{|0zi, |1zi}. proposedin[5],andreliesonmappingclassicalbit-strings
tomulti-qubitstates. Webelievethatthemainresultsof
In discussing the decryption stage, we would like to
[5]canbealsoadaptedtothesingle-qubitOWFdiscussed
point out that the above two steps are basically equiv-
here. Nevertheless, the creation of public certificates for
alent to a von Neumann measurement which projects
quantum keys is not an easy task, since digitally signing
the jth qubit onto the basis {|ψ (θ )i,Rˆ(π)|ψ (θ )i}.
sj n sj n an unknownqubit state is not possible [12]. In any case,
Moreover, it is worth recalling here that Rˆ(j)(α)−1 = authenticationofquantummessagesremainsaninterest-
Rˆ(j)(α)† = Rˆ(j)(−α), while different rotations around ingquestioninthe fieldofquantumcryptography,but it
the same axis commute, i.e., [Rˆ(j)(α),Rˆ(j)(β)]=0. is beyond the scope of this paper.
IV. SECURITY B. Secrecy of the private key
The primary objective of an adversary(eavesdropper) Theprivatekeyofeachentityconsistsoftwopartsi.e.,
is to recoverthe plaintextfromthe cipherstate intended d = {n,s}. The first part is a randomly chosen positive
forAlice. Onthe otherhand,thereisalwaysamoream- integer with the only constraint being n ≫ 1. Never-
bitious objective pertaining to the recover of the private theless, to present quantitative estimates on the entropy
key from Alice’s public key. A cryptosystem is consid- of the private key, in the following we consider that n is
eredtobebrokenwithaccomplishmentofanyofthetwo uniformly distributed over a finite interval N˜ = [nl,nu],
objectives,butinthelattercasetheadversaryhasaccess with nl ≫ 1. Thus, the entropy of the first part of the
to all of the messages sent to Alice. In this section we private key is H(n) = log2(|N˜|), where |N˜| denotes the
discuss various security issues related to the encryption number of elements in N˜. The secondpartof the private
scheme of Sec. III key involves a random integer string s, which is encoded
on the state of the N qubits of the public key. For a
given value of n, say n = ν, each random element of s
A. Distribution of public keys is chosen independently and has a uniform distribution
over Z . Hence the sting s is also uniformly distributed
2ν
In contrast to symmetric cryptosystems, in an asym- over ZN2ν ≡ {(a1,a2,...,aN)|aj ∈ Z2ν}, and its entropy
is given by H(s|n = ν) = Nν. The entropy of the en-
metric cryptosystem a KDC is burdened with the dis-
tireprivatekeyisgivenbythejointentropyH(n,s),i.e.,
tribution of public keys whose secrecy is not required.
Nevertheless, the KDC has to verify still the public key H(d)=H(n)+H(s|n)=log2(|N˜|)+ ν∈N˜p(ν)H(s|n=
of each entity participating in the cryptosystem. Typi- ν)=log(|N˜|)+N(n +n)/2. P
u l
cally, in conventional cryptography the outcome of this Letus estimate now the classicalinformationone may
verification is a public certificate which consists of two extract from the quantum public key. For a given value
parts; a data part which contains the public key as well of n = ν, the jth element of s is chosen at random
as informationabout its owner,andthe verificationpart from Z2ν, and the corresponding qubit of the public
withthesignatureoftheKDCoverthedatapart. Hence, key is prepared in the pure state |ψ (θ )i . From an
sj ν j
such a certificate essentially guarantees the authenticity, adversary’s point of view, however, who does not have
or else integrity, of the public key of each entity. access to s , the jth qubit of the public key is pre-
j
5
pared in a pure state chosen at random from the set whichdefinesanupperboundonthenumberofcopiesof
Q = {|ψ (θ )i | s ∈ Z ;θ = π/2ν−1}, with all the public key that can be issued. This is in contrast to
n=ν sj ν j 2ν ν
the states being equally probable. Accordingly, one can conventional public-key cryptosystems, where there are
easily show that for ν > 2, the density operator for the no such limitations.
jth qubit is of the form To summarize, the secrecy of the private key is guar-
anteed by the fact that the public key is quantum and
1 2ν−1 11 unknown to every one except Alice. Moreover, the state
σ(j)(θ )= |ψ (θ )i hψ (θ )| = . (2a)
pk n=ν 2ν sj ν jj sj ν 2 of each public-key qubit is chosen at random and inde-
sXj=0 pendentlyoftheotherqubitstates. Inotherwords,there
isnoredundancyorpatterninthe publickey,thatcould
Summing over all possible values of n and taking into
be explored by a potential adversary. Information gain
accountitsuniformdistributionoverN˜,weobtainρ(pjk) = onthe state ofthe public key(andthus the private key),
|N˜|−1 nσp(jk)(θn) = 11/2. Moreover, each qubit is pre- can be obtained only by performing measurements on
paredPindependently of the others, and thus the state of the public-key qubits, at the expense of disturbing irre-
the entire public key reads versibly their state. In any case, according to Holevo’s
theorem,thisinformationgaincannotexceedonebitper
11⊗N qubit and thus, for k copies of the public key simulta-
ρpk = p(n,s)|Ψ(spk)(θn)ihΨ(spk)(θn)| = 2N , neously in circulation, the private key is secret as long
nX∈N˜s∈XZ2n as condition (3b) is satisfied. Furthermore, by virtue of
(2b) the no-cloning theorem [3], Eve cannot create additional
while we obtain for the corresponding von Neumann en- copies of Alice’s quantum public key, besides the copies
tropy S(e)= N S(ρ(j))=N. providedby Alice or the KDC. In particular,the fidelity
j=1 pk
The secrecyPof the private key d is guaranteed by the ofthe cloneforeachpublic-keyqubitis smallerthanone
Holevo’s theorem. In particular, let us denote by I(x,d) [13] and thus, the fidelity of the public-key clone drops
the mutual information between the private key, and a exponentially with the key length N.
variable containing the information an adversary (Eve) Finally, it is worth noting that according to the key-
may have obtained by performing quantum measure- generation stage of Sec. III, there is a one-to-one corre-
ments on the public key. Since the public-key qubits are spondencebetweentheprivatekeyandthepublickey. As
preparedatrandomandindependentlyinpurestates,we aresult,anyinformationanadversarymayobtainabout
have from Holevo’s theorem I(x,d) ≤S(e)=N. Hence, thestateofthejthpublic-keyqubit |ψ (θ )i ,isimme-
sj n j
I(x,d)≪H(d) provided diatelyassociatedwiththethejthelementoftheprivate
strings. Onemayalterthissituation,byapplyingaran-
log (|N˜|)+Nn¯ ≫N, (3a) dompermutationΠonthepublic-keyqubits,beforethey
2
becomepubliclyavailable. Inthiscase,thejthelementof
where n¯ =(nu+nl)/2. Clearly, to satisfy condition (3a) the private string s is mapped to the state of the Π(j)th
it is sufficient to have either n¯ ≫ 1 or log (|N˜|) >> N. qubit(i.e.,s 7→ |ψ (θ )i ),whichisunknowntoEve
2 j sj n Π(j)
In the protocol of the previous section, both of these if Π is unknown. Hence, even if Eve were able to know
requirementsarefulfilledsimultaneouslysincenischosen precisely the state of each public-key qubit, she would
at random from the set of positive integers N with the have to guess the right permutation in order to deduce
constraintn>>1. Hence,theinequalityI(x,d)≪H(d) theprivatestrings. Fromanotherpointofview,permut-
alsoholdsthatis,Eve’sinformationgainismuchsmaller ingthe public-keyqubitsforagivenprivatekeyisequiv-
thantheentropyoftheprivatekeyd,whichthusremains alent to preparing the public-key qubits in states deter-
practicallyunknowntoher. Accordingly,theconditional minedbyapermutationoftheprivatestringΠ(s),which
entropy H(d|x) is given by H(d|x) ≡ H(d)−I(x,d) ≈ is unknown to Eve. In this case, the private key consists
H(d),whichestablishestheuniformityoftheprivatekey of three parts, i.e., d′ = (n,s,Π). The corresponding
overD=N˜×Z ,afterthe measurementsonthepublic- jointentropyisgivenbyH(d′)=H(d)+H(Π|s,n),with
2n
key state. H(d) defined earlier. Accordingly, the left-hand side of
So, we have seen that by making the public key avail- Eqs. (3) increases by H(Π|s,n), whereas the maximum
able to every one, we do not compromise the security information gain for a potential adversary is determined
of the protocol for n ≫ 1, i.e., the public key may re- by the Holevo’s bound and remains constant.
veal only negligible information about the private key. Inthe followingwe analyzethe securityofourencryp-
When multiple copies ofthe public key,sayk,are simul- tion scheme, against various types of attacks aiming at
taneously in circulation, Eve’s mutual information with the recoverof the plaintext and/or the private key, from
the key increases, but is again upper bounded as follows the quantum ciphertext. These attacks are generaliza-
I(x,d) ≤ Nk. In this case, secrecy of the private key is tionsofthecorrespondingattacksonconventionalasym-
always guaranteed if metric encryption schemes [1]. In contrast, however, to
their classical counterparts, in the quantum attacks Eve
log (|N˜|)+Nn¯ ≫Nk, (3b) does not know the state of the quantum public key, but
2
6
is allowed to perform arbitrary operations and measure- key. First of all, recall that Bob encrypts his message
ments on it. The only assumption in the following anal- m∈{0,1}r, by transforming the state of the public key
ysis is that Alice’s decryption device is manufactured so as follows
thatisautomaticallydeactivatedwhenitperformskcon-
secutive decryptions on N-qubit states. In this way we ρpk −m→ρc =Rˆ˜m(r)(π)ρpkRˆ˜m(r)†(π). (5)
guarantee that no more than k copies of Alice’s public
As mentioned above, the mixed state ρ remains in-
key will be used. When these copies are exhausted, Al- pk
variant under these rotations, and thus all of the possi-
ice must generate a new pair of keys (e′,d′), and update
ble messages yield the same cipher state, i.e., ρ = ρ .
accordingly her decryption device. To this end, the old c pk
Hence,Evecannotdistinguishbetweendistinctmessages,
private key may act as a quantum password, which en-
and the encryption scheme under consideration is prov-
sures authorized access to the decryption device.
ably secure [14].
Finally, note that a protocol which is secure against
chosen-plaintext attacks, is also secure against less pow-
C. Chosen-plaintext attack
erfulattacks,suchastheciphertext-onlyandtheknown-
plaintext attacks [1]. In the following, we analyze the
Typically, in a chosen-plaintext attack, Eve is al-
forward-search attack, that is a chosen-plaintext attack
lowed to obtain a number of plaintext-ciphertext pairs
adapted to small message spaces.
of her choice. More precisely, given k copies of Alice’s
public-key state ρ , and k plaintexts in binary form
pk
{a1,a2,...,ak}, with aj ∈ {0,1}rj and rj ≤ N, she D. Forward-search attack
obtains a sequence of cipher states {ρ(1),ρ(2),...,ρ(k)},
e e e
where The forward-search attack can be very efficient (at
least for conventional cryptosystems) when the number
ρe(j) =Rˆ˜a(rjj)(π)ρpkRˆ˜a(rjj)†(π). of all possible messages is small. In this case, Eve may
obtain multiple copies of Alice’s public-key, and create
The collective rotation on r qubits is defined as
j the ciphertexts corresponding to each possible message.
rj Subsequently, she may try to deduce the encrypted mes-
Rˆ˜x(rj)(ϕ)≡ Rˆ(i)(xiϕ). (4) sage, by comparing the unknown ciphertext with the ci-
Oi=1 phertexts in her database.
For the encryption scheme under consideration, how-
Subsequently, Eve may explore her database,in order to ever,thecrucialinformationisnottheactualangleofthe
decryptanunknownmessageencryptedwithAlice’spub- rotation,butratherwhethera public-keyqubithasbeen
lickey,orgainfurtherinformationonAlice’sprivatekey. rotated or not (see stage 2 in Sec. III). Hence, instead
For the sake of simplicity, and without loss of generality, of creating her own plaintext-ciphertext database, it is
in the following we assume that rj =N, ∀ j. sufficient for Eve to compare the cipher state sent from
Let us discuss first whether Eve can gain significant Bob to Alice, with a copy of Alice’s public-key.
information, by encrypting plaintexts (i.e., obtaining ci- To analyze this attack, let us focus on an 1-bit mes-
pher states) of her choice. As discussed in the previous sage m ∈ {0,1}. Bob encodes his message by applying
subsection, Eve can obtain only negligible information the rotation R(mπ) on Alice’s public-key qubit, which
about the private key, by performing measurements on is prepared in a state |ψ (θ )i chosen at random from
s n
thepublic-keyqubits. Thus,forEvetheprivatekeyisun- Q , for some n ≫ 1. To deduce Bob’s message, Eve
n
known, and uniformly distributed over D. Accordingly, performs a SWAP test [4] between the cipher qubit sent
the state of the public key ρpk is chosen at random from fromBobtoAlice,andacopyofAlice’spublic-keyqubit.
the ensemble {p(d), |Ψ(spk)(θn)i}, and is thus given by Inthis way,she will learnwhether the cipher-qubitstate
Eq. (2b). Note now that this maximally mixed state has been rotated with respect to the state of the public-
remains invariant under Eve’s rotations [16], and thus key qubit. Such a test, succeeds with average probabil-
anyplaintexta ismappedtothe samecipherstate,i.e., ity p = 3/4. Moreover, at the end of the test the
j suc
a 7→ ρ . Hence, on average, there is no information twoqubitsareentangled,andEvecannotdistinguishbe-
j pk
gain for Eve. The same conclusion can be drawn on the tween them. Hence, she cannot compare Bob’s cipher
basis of Holevo’s theorem. In particular, since the state state with the public-key state more than once.
of the public key is unknown to Eve, the cipher state is Alice and Bob can reduce considerably p , by en-
suc
also unknown to her. Hence, Eve can extract at most coding the message on the state of two, or more
Nk bits of information from measurements on all of the public-key qubits. For instance, using two public-key
k cipher states, which is negligible in view of condition qubits in the state |ψ (θ )i ⊗ |ψ (θ )i , the mes-
s1 n 1 s2 n 2
(3b). sage “0” is encoded by applying an operation randomly
The remaining question is whether Eve can use her chosen from the set {Rˆ(1)(0)Rˆ(2)(0),Rˆ(1)(π)Rˆ(2)(π)},
plaintext-ciphertext database, in order to decrypt Bob’s whereas “1” is encoded using an operation from the
message,whichhasbeenencryptedwiththe samepublic set {Rˆ(1)(0)Rˆ(2)(π),Rˆ(1)(π)Rˆ(2)(0)}. Thus, to deduce
7
Bob’s message, Eve has to identify correctly the opera- withthecollectiverotationsgivenbyEq. (4). Evelearns
tions performed on both qubits. In this case, Eve suc- only the outcomes of the projective measurements per-
ceeds with probability p = (3/4)2 ≈ 0.56; that is, formed at the end of the decryption stage. According to
suc
slightly better than random guessing. In general, when Holevo’s theorem, however, these outcomes cannot pro-
each bit of a message is encoded to α qubits, Eve has to vide her with more than N bits of classical information
perform α successive SWAP tests to deduce it, and the about the private key. Of course Eve has the chance to
average success probability is (3/4)α; that is worse than perform up to k such decryptions, but as long as condi-
random guessing for α>3. tion(3b)issatisfied,herinformationgainisnotsufficient
Intheforward-searchattackdiscussedabove,Eveper- to determine the private key.
forms independent (individual) SWAP tests between the
correspondingqubitsofthecipherstateandacopyofthe
public key. The question arises here is whether Eve may V. DISCUSSION
increase her probability of success, by performing collec-
tive measurements on all the qubits of the cipher state
In conclusion, we have discussed cryptographic ap-
and the public key. This issue deserves further investi-
plications of single-qubit rotations in the framework of
gation, and will be addressed elsewhere. Nevertheless,
quantum trapdoor (one-way)functions. We also demon-
the mere fact that each public-key qubit is prepared at
strated how such a function can be used as a basis for
random and independently of the others, suggests that
a quantum public-key cryptosystem, whose security, in
the optimalattack (i.e., the attack thatmaximizes Eve’s
contrasttoitsclassicalcounterparts,reliesonfundamen-
probabilityofsuccess),involvesonlyindividualmeasure-
tal principles of quantum mechanics. More precisely, in
ments on various qubit pairs, consisting of the corre-
the proposed encryption scheme, each user creates a key
sponding qubits of the cipher state and the public key.
consisting of two parts: a private key, which is purely
In particular, as discussed in Sec. IVB, there is no re-
classical, and a public key, which involves a number of
dundancy or pattern in the public key (and thus in the
qubits prepared independently in states specified by the
cipherstate)whichcouldbeexploredinacollectivemea-
private key. The sender encrypts his message on the re-
surement.
cipients public key by rotating the state of its qubits. A
potentialadversarycannotdeducetheencryptedmessage
without knowing the recipient’s private key.
E. Chosen-ciphertext attack Onemighthavenoticedhereexternalsimilaritiesofthe
proposedencryptionschemetotheY00protocol[15]. To
avoidany misunderstandings,we wouldlike to point out
In this scenario, Eve has access to Alice’s decryp-
some crucial differences between the two schemes. First
tion device, but not to the private key. Providing judi-
of all, the security of the Y00 protocol is claimed to rely
ciouslychosencipher states,she receivesthecorrespond-
on quantum noise which renders the discrimination of
ing plaintexts. The only restrictionis that Alice’s device
closelyspacedmesoscopicstatesimpossible. Onthecon-
doesnotallowmorethankdecryptionsonN-qubitstates
trary,the security of the proposedpublic-key encryption
with the same private key. As before, Eve’s objective is
scheme relies on the Holevo’s bound and the no-cloning
to deduce the private key, or decrypt Bob’s message at
theorem. Second, the Y00 is a symmetric encryption
a later instant, when she does not have access to the
scheme whereas the present work involves asymmetric
decryption device.
cryptosystems(differentkeysareusedforencryptionand
The chosen-ciphertext attack can be analyzed along
decryption). Third, in the Y00 protocol the two legiti-
the lines of the previous sections. Let us discuss briefly,
mate users share a short secret key in advance, which is
for instance, the security of the private key. In a chosen-
expanded in the course of the protocol. No secret infor-
ciphertext attack Eve can prepare arbitrary multi-qubit
mation is necessary for the functionality of the present
states, not necessarily related to the public key. For in-
protocol.
stance, Eve may ask for the decryption of an N-qubit
Various security issues pertaining to the proposed
state ρ , where the qubits are entangled among them-
e asymmetric encryption scheme, have been analyzed in
selves as well as with another ancillary system. Never-
the context of a futuristic scenario, where all of the en-
theless,assoonasthe qubits areinput tothe decryption
tities participatinginthe cryptosystempossessquantum
device, Eve has no access to them. First, the decryption
computers, and are connected via ideal quantum chan-
device undoes the initial rotations on the qubits, as de-
nels. There are various questions yet to be explored, es-
termined by the private key d. For Eve, who does not
pecially in connection with the extension of the present
have access to the private key, the input state is trans-
ideas to more realistic scenarios, where the legitimate
formedto a state ρ′ randomly chosenfrom the ensemble
e users are limited by current technology. For instance, in
{p(d),Rˆ˜s(r)†(θn)ρeRˆ˜(sr)(θn)}, i.e., thepresenceofalossyquantumchannel,quantumerror-
correction codes can be used to increase the robustness
ρe −d→ρ′e = p(d)Rˆ˜(sr)†(θn)ρeRˆ˜(sr)(θn), (6) of the protocol. We have already seen that by encoding
dX∈D 1 bit on two qubits we make the encryptionmore robust
8
against the forward-searchattack. over, such investigations might lead to the development
In any case, the purpose of the present work was to ofpracticalpublic-keyencryptionschemes,orotherprov-
introducecertainbasicideasunderlyingquantumpublic- ably secure quantum cryptographic primitives (e.g., dig-
keyencryption,andsetanappropriatetheoreticalframe- ital signatures, hash functions, etc).
work. Wealsodemonstratedhowfundamentalproperties
of quantum systems and certain theorems of quantum
mechanics may provide a barrier, due to complexity of
VI. ACKNOWLEDGMENTS
effort,betweenlegitimate usersandadversaries,whichis
the cornerstone of quantum public-key encryption. We
hope that our results and discussion will stimulate fur- I am grateful to S. J. van Enk and P. Lambropou-
ther investigations on these topics, so that light is shed los for helpful comments and discussions. The work was
on crucial questions, pertaining to the power and the supportedin partby the EC RTN EMALI (contractNo.
limitationsofasymmetricquantumcryptography. More- MRTN-CT-2006-035369).
[1] A.Menezes,P.vanOorschotandS.Vanstone,Handbook [9] X. Peng, H. Wei, and P. Zhang, Opt. Lett. 31, 3579
of Applied Cryptography (CRC Press, 1996). (2006).
[2] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. [10] R. Pappu, B. Recht, J. Taylor, and N. Gershenfeld, Sci-
Mod. Phys. 74, 145 (2002). ence 297, 2026 (2002).
[3] M. A. Nielsen and I. L. Chuang, Quantum Computation [11] A. Chefles, Phys. Lett. A 239, 339 (1998).
andQuantum Information(CambridgeUniversityPress, [12] M. Curty, D. J. Santos, E. Perez, and P. Garcia-
Cambridge, London,2000). Fernandez, Phys. Rev.A 66, 022301 (2002).
[4] H.Buhrman,R.Cleve,J.Watrous,andR.deWolf,Phys. [13] V. Scarani, S. Iblisdir, N. Gisin, and A.Acin, Rev.Mod.
Rev.Lett. 87, 167902 (2001). Phys. 77, 1225 (2005).
[5] D. Gottesman and I. L. Chuang, e-print [14] P. O. Boykin and V. Roychowdhury, Phys. Rev. A 67,
qunt-ph/0105032. 042317 (2003).
[6] E. Andersson, M. Curty, and I. Jex, Phys. Rev. A 74, [15] H. P .Yuen, e-print quant-ph/0311061; G. A. Barbosa,
022304 (2006). E.Corndorf,P.Kumar,andH.P.Yuen,Phys.Rev.Lett
[7] A. Kawachi, T. Koshiba, H. Nishimura, and T. Ya- 90, 227901 (2003).
makami, Lect. Notes on Computer Science 3494, 268 [16] Actually, the state (2b) remains invariant even under a
(2005). generalquantumoperation(completelypositivemap)E:
[8] Y. Kabashima, T. Murayama, and D. Saad, Phys. Rev. ρ→E(ρ)=PiEˆiρEˆi†, with PiEˆiEˆi† =11.
Lett.84, 2030 (2000).