Simple quantum password checking

0.12 MB·English

by  J. C. Garcia-Escartin

Simple quantum password checking
Juan Carlos Garc´ıa-Escart´ın∗ and Pedro Chamorro-Posada
Dpto. de Teor´ıa de la Sen˜al y Comunicaciones. ETSI de Telecomunicaci´on. Universidad
de Valladolid. Campus Miguel Delibes. Paseo Bel´en 15. 47011 Valladolid. Spain.
(Dated: January 13, 2015)
We present a quantum password checking protocol where secrecy is protected by the laws of
quantum mechanics. The passwords are encoded in quantum systems that can be compared but
haveadimensiontoosmalltoallowreadingtheencodedbits. Westudytheprotocolunderdifferent
replay attacks and show it is robust even for poorly chosen passwords.
5
The password checking problem appears when two bustagainstpresenttechnology,arenotguaranteedtobe
1
sideswhosharesomecommoninformationwanttoverify hard problems and could, indeed, be broken with quan-
0
2 theothersidealsoknowsit. Weconsidertwoparties,Al- tum computers [7].
iceandBob,whoshareanm-bitstringp(thepassword). In this paper, we propose an alternative password
n
a There can also be an eavesdropper,Eve, trying to either checkingprotocolwheresecurityisderivedfromthelaws
J learn the password or to impersonate Alice or Bob. For of quantum mechanics. The protocol can resist replay

2 simplicity,wedescribethecasewhereAlicetriestoprove attacksandisrobustagainstdictionaryattacks,evenfor
1 heridentitytoBob. Everythingissymmetricforthecon- poorly chosen passwords.
verse case. Previousquantumsolutions to this problemeither use
]
h entangledstates[8–12]orarebuiltontopofthequantum
ImagineAliceandBobcanonlycommunicatethrough
p key distribution protocol BB84 [13–16]. Our protocol is
an insecure classical channel. Alice could send her pass-
-
insteadbasedonquantumfingerprinting[17]. Itencodes
t word in the clear, but Eve could read it undetected and
n data in a quantum system too small to allow full recov-
a later pose as Alice. A widespread solution is the use of
erybutwhichallowsstatecomparison. However,ouren-
u hashfunctions. A hash, orone-way,function H(x) takes
q a string x into an output string of a fixed size that ap- codingfocusesonsecurityratherthanincommunication
[ savings. In that respect, it is more similar to quantum
pearstoberandom. ThefunctionH(x)shouldbeeasyto
public-key cryptography systems [18–22].
1 compute,butdifficulttoinvert. Thefunctionsarechosen
v so that finding x = H−1(H(x)) from H(x) is computa- Weonlyneedthreeprimitives,quantumstateprepara-
2 tion,randomnumbergenerationandquantumstatecom-
tionally hard. If Alice sends H(p), Eve could still copy
2 parison. Quantum state comparison is performed with
the string andimpersonate Alice, but, atleast, the pass-
6
theSWAP testusedinquantumfingerprinting. Thetest
2 word is protected. If the password has some value, for
can detect different states. If we have two input states
0 instance, Alice uses it in other places, this is a small im-
. provement. A greater advantage comes if Alice and Bob withdensitymatricesρandσ,thetestfailsandthestates
01 use hash chains. Alice can send a string Hz(p) which areprovedtobedifferentwithprobability 1−tr2(ρσ). Ifthe
5 results from applying the hash function z times, first to states pass the test, with probability 1+tr(ρσ), they can
2
1 p and then to resulting hash of the previous steps. Bob stillbedifferent. Ifwehavemanycopiesofthestates,we
:
v can keep a record of the zs used in previous identifica- can determine whether they are equal or different with
i tion rounds and keep asking for smaller values of z. Eve high probability if they are different enough (tr(ρσ) is
X
cancapture Hz(p), but she is notable to produce Hy(p) not very close to 1).
r
a for y < z. This is a solution in classical networks [1], In our protocol, we apply the SWAP test on pass-
but it is still vulnerable to dictionary attacks in which words that are encoded in symmetric states [23] of di-
Eve compiles a list of the most common passwords and mension D = 2d. We define symmetric states Φ with
j
| i
pre-computestheirhashesandthe hashesoftheirhashes j =0,...,N 1 so that
−
up to a certain depth. If she captures a passing string
oHrizg(ipn)a,lsphaesscwanorldoo[2k].it up in her table and find out the Φj = 1 D−1ei2πNjl l . (1)
| i √D | i
l=0
X
There are password checking protocols, like SPEKE
[3, 4], which are based on Zero Knowledge Proofs [5] We take states which encode both the password and
and avoid dictionary attacks from eavesdroppers (but a random bit string ri in a symmetric state ψpri =
not for a dishonest side [6]). Similary, the SSH proto- Φ with an index j equal to the integer whose
H(p||ri) (cid:12) (cid:11)
col favours the use of public key cryptography coupled binary representation is the output of the has(cid:12)h func-
(cid:12) (cid:11)
with challenge-response authentication. These systems t(cid:12)ion H with an input that is the concatenation of the
are based on the computational difficulty of problems binary strings representing the password p and the ran-
like factoring or the discrete logarithm, which, while ro- domstringr . WeworkwithahashfunctionH(x)withn
i
2
bitsofoutputsothatthereareN =2npossiblepassword can use the unconditionally secure relativistic coin flip-
states that represent the M = 2m possible passwords in ping protocol of Kent [25] or strings whose randomness
a compressed state space. is certified by Bell’s theorem [26].
A useful property of this encoding is that the mixed The basic concept of the protocol can be explained
statethatcomesfromchoosingatrandomwiththesame withasimpleanalogy. Wecanpicturethequantumstate
probability any symmetric state ρ = Φ Φ is the as a piece of paper with a limited size. If we try to write
j j j
| ih |
maximally mixed state as too many words, at some point we need to sacrifice leg-
ibility. The greater the number of words, the more diffi-
1 N−1ρj = 1 1 N−1D−1D−1ei2πj(Nl−m) l m = ceuveltr,ititbisecsotimllepsotsosibmleaktoe cseonmspeaorfewtwhoatshiseewtsriotftepna.peHro.wA-
N N D | ih |
Xj=0 Xj=0 Xl=0 mX=0 quickglancesuffices totell, withgoodaccuracy,whether
1 1 (ei2π(lN−m))j l m = 1 l l = I , the contents are equal or not. If the contents are almost
D N | ih | D | ih | D equal, there will be a good chance of giving a false posi-
l,m j l
X X X tive,butcompletelydifferenttexts,saya pagefullofthe
(2)
letter “a” and one only with numbers, can be told apart
using that the geometric sum of the ei2πj(Nl−m) terms is with high confidence.
In this protocol, the passwordis protected by the lim-
only different from 0 if l =m, when it is N.
itations of the quantum encoding. We have encoded too
With all these elements we can give the password
many bits, n, into a too small state space. From the
checking protocol. We describe the case where Alice
Holevo bound we know we cannot reliably recover more
proves her identity to Bob and both share a password p
than d bits from a D = 2d-dimensional quantum state
of m bits that is hashed to produce n bits.
[27]. FromNayak’sboundwealsoknowthatford<<n,
we also have a small probability of recovering only some
Repeat up to s times:
• of those bits [28]. We use a stronger result from Ben-
1. Alice and Bob generate jointly a random string r Aroya, Regev and de Wolf [29] which limits k-out-of-n
i
of m bits. encodings that allow to recover k bits from the total n
bits of a string. If d < 1 0.72, the probability of
2. Alice prepares a state ψpri in a quantum system recoveringk bits is enxpon2elnnt2ia≈lly small in k. For a small
of a dimension D = 2d with d n and gives it to enough d,theprobabilitytendsto2−k,whichisaslikely
(cid:12) (cid:11) ≪ n
Bob. (cid:12) as guessing the bits by chance.
If we choose sd n, Eve would not learn anything
3. Bobperformsaquantumstatecomparisonbetween ≪
from the password, even if she captured all the states in
the received state and a locally generated ψri .
p a full protocol exchange. Usually, Alice and Bob must
- If the states are found to be differe(cid:12)nt, (cid:11)Bob both identify to the other side. In those cases, instead
(cid:12)
aborts the protocol. offirstperformingthesstagesofAliceauthenticatingto
BobandthesstagesofBobconvincingAlice,theyshould
- If the states pass the test, we repeat steps 1
take turns for each stage. If Eve is on any of the sides,
to 3withnew randomstringsr untilwe have
i
shewouldbedetectedearly,beforeshecancapturemany
s positive comparisons.
states. The number of generated states before changing
Forsimplicitywechooserandomstringsofmbits,but the password must be established so that the maximum
any bit number sufficiently larger than n can be used. captured states c still satisfies cd n.
≪
Alice and Bob can each generate random strings if they The k-out-of-nbound also limits the amount ofglobal
input orthogonal states into the SWAP test. They have information an attacker can learn from the password
probability1/2ofpassingthetest,whichcouldbeidenti- state. TheusefulinformationaboutanykbitsofH(p ri)
||
fiedwitha1bit, andprobability1/2offailing(the bitis must be, at most, exponentially small in k. Otherwise,
0). ThejointrandomstringcanbeproducedbytheXOR AliceandBobcoulddeviseacodethatgroupsthe states
ofAlice’sandBob’sstringsiftheycanguaranteethebits withthedifferentvaluesofaglobalproperty,suchasthe
aresimultaneouslyproduced. Forourpurposes,theycan parity of all the bits or the AND function of a group of
also produce r taking one bit from Alice and one from them, and use the attack as a way to send one bit of in-
i
Bob. Aslongasoneofthesidesishonest,thehashfunc- formation with a probability better than the limit close
tion will introduce enough randomization even if only to 0.5 given by the bound.
half the bits of r are random. For a higher security, IfwehaveM possiblecombinationsofparameters,the
i
Alice and Bobcanuse the classicalprotocolof Damg˚ard average probability of passing the SWAP test is related
andLuneman,whichoffersunconditionalsecurityforone totheaveragefidelityF¯ ofallthefidelitiesF =tr(ρ ρ )
k t k
side and computational security, even against quantum between the trial state ρ of an attacker who does not
t
computers, for the other side [24]. Alternatively, they know p and the legitimate pure state ρ which depends
k
3
on the considered parameters. We have, space of ρrp1 ⊗ρanc and then presenting Bob with a sub-
system of the resulting state, represented by the partial
P¯ = 1 M−11+Fk = 1+ M1 kFk = 1+F¯. (3) trace trE [30]. Eve wants to maximize her fidelity
M 2 2 2
k=0 P M−1M−1M−1
X 1
F¯ = tr( (ρr1)ρr2) (7)
Inthe restofthepaperweshowanattackerwhodoesn’t M3 E p p
know anything about p can only produce states with an Xp=0 rX1=0rX2=0
average fidelity F¯ = 1. If D is high enough, the proba- for any combination of p, r and r .
D 1 2
bility of passing the s stages of the protocol and fooling We usearesultbyFiura´ˇsektoboundthis fidelity [31].
Bob into accepting a false Alice is Forinputstates ψ (~x) chosenfromasetofparameters
in
| i
~x, the best approximation to outputs ψ (~x) is given
s out
1 1 s | i
+ 2−s+2−s , (4) by the average fidelity
2 2D ≈ D
(cid:18) (cid:19)
which can be made arbitrarily small. F¯ = ψout(~x) (ψin(~x) ψin(~x)) ψout(~x) d~x, (8)
h |E | ih | | i
There are two main attacks we must avoid. The first Z
is a random state attack. We can consider Eve in- which can be optimized using Lagrange multipliers. For
tends to fool Bob with a trial state ρ that is constant ourdiscreteversionoftheaveragefidelityshowninEqua-
t
for all attempts. She will try to maximize her probabil- tion (7), we need to look at operator
ityofpassingthetestforallthepossiblepasswords. The
M−1M−1M−1
average fidelity for this trial state is 1
Rˆ = (ρr1 ρr2). (9)
M3 p ⊗ p
1 M−1 1 M−1 Xp=0 rX1=0rX2=0
F¯ = tr(ρ ρri)=tr ρ ρri (5)
M Xp=0 t p tM Xp=0 p ! aFnodraHny(pfixred)pin,tahlletshuemvainlure1saonfd0rt2ohNasou1tapnudtsEHqu(pa|t|iro1n)
2
|| −
for the constant, known ri of each stage. When we con- (2) is a good approximation to the final state so that
sider all the possible fixed r , the value of an ideal hash
i
finutnecgteiorsnfrHom(p||0rit)oisNeve1nlywitdhisttrhiebudtieffdertehnrtovuaglhueasllofthpe. Rˆ = M12 ρrp1 ⊗ DI = M1 DI ⊗ DI = DI2.
Whenthenumberofth−ehashoutputbitsnissufficiently Xp Xr1 (cid:18) (cid:19) Xp (cid:18) (cid:19) (10)
smaller than the number of the password bits m, the Fidelity F¯ is bounded by the dimension of the input
sum gives a uniform averageon all the possible symmet- Hilbert space dim and the largest eigenvalue R of
max
ric states and the result is close to the completely mixed Rˆ [31]. In our caseH, I has eigenvalues 1 and
D2 D2
state of Equation (2). The average fidelity can then be
approximated by F¯ dim R =D 1 = 1. (11)
≤ H max D2 D
I 1 1
F¯ =tr ρt = tr(ρt)= (6) WecanextendtheresultstothecasewhereEvecaptures
D D D
(cid:18) (cid:19) up to c states ρr1,ρr2,...,ρrc and wants to approximate
p p p
ifρ ispure,orsmallerformixedtrialstates. Essentially, the next state in the sequence ρc+1. Now
t p
p randomizes the state. The attacker sees a maximally
1
mixedstateandcannotdobetter thanrandomguessing. F¯ = tr( (ρr1 ρr2 ρrc)ρrc+1)
Thereisasecondimportantfamilyofattacks. Evecan Mc+2 E p ⊗ p ⊗···⊗ p p
try a replay attack in which she captures and stores p,r1,.X..,rc,rc+1 (12)
previous legitimate interchanges between Alice and Bob and
and uses the captured states to impersonate Alice. The
1
random strings ri prevent Eve from directly using her Rˆ = Mc+2 (ρrp1⊗ρrp2⊗···⊗ρrpc⊗ρprc+1). (13)
stored states, but she can try to modify them to fool
p,r1,.X..,rc,rc+1
Bob.
The simplestcase is one in whichEve captures a state We can proceed in a way similar to the single captured
ρr1 and wants to produce a state as close to the next state scenario and show
p
astnaytealilnowtehde opproertaotcioolnρorpn2 athsepcoaspsitbulree.dEstvaetec.anThpeermfoormst Rˆ = I (14)
Dc+1
generaltransformationallowedbyquantummechanicsis
acompletelypositivemapE(ρrp1)=trE(U(ρrp1⊗ρanc)U†) and
whichcombines the effects ofadding an ancillarysystem 1 1
ρanc,performingaunitaryoperationU inthelargerstate F¯ ≤dimH⊗cRmax =DcDc+1 = D. (15)
4
There are two caveats. First, the bound breaksdown af- TEC2010-21303-C04-04.
ter anumber ofcapturedstates. We assumeEvedoesn’t
knowasinglebitofp. Ifshedid,theaverageofEquation
(12) is not the quantity to maximize and the proof is no
longer valid. The bound holds as long as cd n so that
≪ ∗ [email protected]
Eve cannot guess the bits from p. We already keep this
[1] L. Lamport, “Password authentication with insecure
bound in order to protect the password.
communication,” Commun. ACM24 (1981).
There might be insecure particular cases, but, for
[2] D. V. Klein, “‘Foiling the cracker’: A survey of, and
random ris, they must be rare on average. After s improvements to, password security,” in Proceedings of
stages, the probability of fooling the system still tends the 2nd USENIX Security Workshop (1990) pp.5–14.
to 2−s+2−s s. Bob can also keep a list of all the previ- [3] D. P. Jablon, “Strong password-only authenticated key
D
ously used r s to avoid repetition or weak special cases. exchange,” SIGCOMM Computer Communication Re-
i view 26 (1996).
These bounds show the protocol is resistant to eaves-
[4] P. MacKenzie, “On the security of the SPEKE
droppers that try to learn the password or perform a
password-authenticated key exchange protocol,” Cryp-
replayattack. Theprotocoloffersandadditionallayerof
tology ePrint Archive, Report 2001/057 (2001),
security beyond that of systems based on computational http://eprint.iacr.org/.
complexity. Security is based on physical limitations. [5] S.Goldwasser,S.Micali andC.Rackoff,“Theknowledge
The protocol protects against adversaries with a quan- complexity of interactive proof systems,” SIAM Journal
tum computer and is independent of technological as- on Computing 18 (1989).
[6] D.P.Jablon,“Extendedpasswordkeyexchangeprotocols
sumptions. A hashH(x) which is difficult to invertwith
immunetodictionary attack,”in Enabling Technologies:
present technology could be broken with better comput-
Infrastructure for Collaborative Enterprises, 1997. Pro-
ers. This has happened with algorithms like MD5 [32]. ceedings., SixthIEEEWorkshops on (1997)pp.248–255.
Similarly, the systems that use public key cryptography [7] P. W. Shor, “Polynomial-time algorithms for prime fac-
areusuallyoptimizedforspeedandcouldbebrokenwith torization and discrete logarithms on a quantum com-
better computers. In our protocol, if we choose a small puter,” SIAMJournal on Computing 26, 1484 (1997).
enough dimension D, the password is unreadable even [8] H. N. Barnum, “Quantum secure identification using
entanglement andcatalysis,” arXiv:quant-ph/9910072v1
for future technologies.
(1999).
Using quantum systems also gives additional protec-
[9] H. Barnum, C. Crepeau, D. Gottesman, A. Smith and
tion from dictionary attacks. If we choose a bad pass- A. Tapp, “Authentication of quantum messages,” in
wordbfromareducedsetofpossiblepasswordsofsizeB Foundations of Computer Science, 2002. Proceedings.
so that D B < 2m, Eve still cannot look up the cap- The 43rd Annual IEEE Symposium on (2002) pp. 449–
≪
tured states in a pre-computed table. If she could find 458.
[10] B.-S. Shi, J. Li, J.-M. Liu, X.-F. Fan and G.-C. Guo,
the password, she would have an encoding that allowed
“Quantumkeydistributionandquantumauthentication
to squeeze more than d bits into a D-dimensional state.
based on entangled state,” Physics Letters A 281, 83 –
A bad password choice would not reduce the security
87 (2001).
of the system as long as B is sufficiently larger than N. [11] X. Li and D. Zhang, “Quantum information authenti-
If we suspect passwords are chosen from a smaller set, cation using entangled states,” in Digital Telecommuni-
like a small dictionary of English words, our proofs are cations, , 2006. ICDT ’06. International Conference on
nolongervalidandtherecouldexistadvancedimperson- (2006) pp. 64–64.
[12] M. Hotta and M. Ozawa, “A protocol of quantum au-
ation attacks. If passwords are chosen freely, it could be
thenticationwithsecurequantumpasswords,”AIPCon-
safer to send a hash q = H′(b) that takes the passwords
ference Proceedings 1110, 388–391 (2009).
into astringwitha smallersizen′ whichis smallenough
[13] C.H.BennettandG.Brassard,“Quantumcryptography:
to make bad passwords produce randomly distributed q Publickeydistributionandcointossing,”Proceedingsof
strings and, at the same time, is large enough to make IEEE international Conference on Computers, Systems
cd n′. This reduces the number of password reuses, and Signal Processing, Bangalore, India , 175 (1984).
but≪preserves the properties of the original scheme. [14] M. Duˇsek, O. Haderka, M. Hendrych and R. Myˇska,
“Quantumidentificationsystem,”PhysicalReviewA60,
The protocol has been given in a general form with
149–156 (1999).
threesimpleprimitivesthatdonotrequireafullquantum
[15] D. Ljunggren, M. Bourennane and A. Karlsson,
computer. A practical realization of the protocol can be
“Authority-based user authentication in quantum key
deployedontopofexistingsystemsasanadditionalmea- distribution,” Physical Review A 62, 022305 (2000).
sure of security. There is a relatively simple implemen- [16] I. Damg˚ard, S. Fehr, C. Lunemann, L. Salvail and C.
tation with optical primitives where state preparation is Schaffner, Improving the Security of Quantum Protocols
feasible and the SWAP test can be performed with the via Commit-and-Open, Lecture Notes in Computer Sci-
ence, Vol. 5677 (Springer Berlin Heidelberg, 2009) pp.
Hong-Ou-Mandeleffect [33, 34]. A detailed implementa-
408–427.
tion will be presented elsewhere.
[17] H. Buhrman, R. Cleve, J. Watrous and R. de Wolf,
This work has been funded by MICINN project
5
“Quantum fingerprinting,” Physical Review Letters 87, (2010).
167902 (2001). [27] A.S. Holevo, “Some estimates of the information trans-
[18] G. M. Nikolopoulos, “Applications of single-qubit rota- mitted byquantumcommunication channels,”Problems
tionsinquantumpublic-keycryptography,”PhysicalRe- of Information Transmission 9, 177–183 (1973).
view A 77, 032348 (2008). [28] A.Nayak,“Optimallowerboundsforquantumautomata
[19] G. M. Nikolopoulos, “Erratum: Applications of single- andrandomaccesscodes,”inProceedingsofthe40thAn-
qubit rotations in quantum public-key cryptography,” nual Symposium on Foundations of Computer Science,
Physical Review A 78, 019903 (2008). FOCS ’99 (1999).
[20] G. M. Nikolopoulos and L. M. Ioannou, “Determinis- [29] A. Ben-Aroya, O. Regev and R. de Wolf, “A hyper-
tic quantum-public-key encryption: Forward search at- contractive inequality for matrix-valued functions with
tackandrandomization,” PhysicalReviewA79,042327 applications to quantum computing and LDCs,” Foun-
(2009). dations of Computer Science, Annual IEEE Symposium
[21] L. M. Ioannou and M. Mosca, “Public-key cryptog- on , 477–486 (2008).
raphy based on bounded quantum reference frames,” [30] K. Kraus, States, Effects, and Operations. Fundamental
arXiv:0903.5156v3 (2009). Notions of Quantum Theory, Lecture Notes in Physics,
[22] L. M. Ioannou and M. Mosca, “Unconditionally- Vol. 190 (Springer-Verlag, 1983).
secure and reusable public-key authentication,” [31] J. Fiur´aˇsek, “Extremal equation for optimal completely
arXiv:1108.2887v1 (2011). positive maps,” Phys. Rev.A 64, 062310 (2001).
[23] M.Ban,K.Kurokawa,R.Momose andO.Hirota,“Opti- [32] X. Wang and H. Yu, “How to break
mummeasurementsfordiscriminationamongsymmetric MD5 and other hash functions,” in
quantumstatesandparameterestimation,”International Advances in Cryptology – EUROCRYPT 2005, Lec-
Journal of Theoretical Physics 36, 1269–1288 (1997). ture Notes in Computer Science, Vol. 3494, edited by
[24] I. Damg˚ard and C. Lunemann, Quantum-Secure Coin- Ronald Cramer (Springer Berlin Heidelberg, 2005) pp.
Flipping and Applications, Lecture Notes in Computer 19–35.
Science,Vol.5912(SpringerBerlinHeidelberg,2009)pp. [33] L. Schwarz and S. J. van Enk, “Detecting the drift of
52–69. quantum sources: Not the de Finetti theorem,” Phys.
[25] A.Kent,“Cointossingisstrictlyweakerthanbitcommit- Rev. Lett.106, 180501 (2011).
ment,” Physical Review Letters 83, 5382–5384 (1999). [34] J. C. Garcia-Escartin and P. Chamorro-Posada, “The
[26] S. Pironio, A. Acin, S. Massar, A. Boyer de la Giroday, SWAP test and the Hong-Ou-Mandel effect are equiv-
D. N. Matsukevich, P. Maunz, S. Olmschenk, D. Hayes, alent,” Phys. Rev.A 87, 052330 (2013).
L.Luo,T.A.Manning and C.Monroe, “Random num-
berscertifiedbyBell’stheorem,”Nature464,1021–1024