If we combine two secure cryptographic systems, is the resulting system still secure?Answering this question is highly nontrivial and has recently sparked a considerable research effort, in particular, in the area of classical cryptography.A central insight was that the answer to the question is yes, but only within a well-specified composability framework and for carefully chosen security definitions.In this article, we review several aspects of composability in the context of quantum cryptography.The first part is devoted to key distribution.We discuss the security criteria that a quantum key distribution (QKD) protocol must fulfill to allow its safe use within a larger security application (e.g. for secure message transmission); and we demonstrate-by an explicit example-what can go wrong if conventional (non-composable) security definitions are used.Finally, to illustrate the practical use of composability, we show how to generate a continuous key stream by sequentially composing rounds of a QKD protocol.In the second part, we take a more general point of view, which is necessary for the study of cryptographic situations involving, for example, mutually distrustful parties.We explain the universal composability (UC) framework and state the composition theorem that guarantees that secure protocols can securely be composed to larger applications.We focus on the secure composition of quantum protocols into unconditionally secure classical protocols.However, the resulting security definition is so strict that some tasks become impossible without additional security assumptions.Quantum bit commitment is impossible in the UC framework even with mere computational security.Similar problems arise in the quantum bounded storage model and we observe a trade-off between the UC and the use of the weakest possible security assumptions.
If we combine two secure cryptographic systems, is the resulting system still secure?Answering this question is highly nontrivial and has recently sparked a considerable research effort, in particular, in the area of classical cryptography.A central insight was that the answer to the question is yes, but only within a well-specified composability framework and for carefully chosen security definitions.In this article, we review several aspects of composability in the context of quantum cryptography.The first part is devoted to key distribution.We discuss the security criteria that a quantum key distribution (QKD) protocol must fulfill to allow its safe use within a larger security application (e.g. for secure message transmission); and we demonstrate-by an explicit example-what can go wrong if conventional (non-composable) security definitions are used.Finally, to illustrate the practical use of composability, we show how to generate a continuous key stream by sequentially composing rounds of a QKD protocol.In the second part, we take a more general point of view, which is necessary for the study of cryptographic situations involving, for example, mutually distrustful parties.We explain the universal composability (UC) framework and state the composition theorem that guarantees that secure protocols can securely be composed to larger applications.We focus on the secure composition of quantum protocols into unconditionally secure classical protocols.However, the resulting security definition is so strict that some tasks become impossible without additional security assumptions.Quantum bit commitment is impossible in the UC framework even with mere computational security.Similar problems arise in the quantum bounded storage model and we observe a trade-off between the UC and the use of the weakest possible security assumptions.
Quantum cryptography is the art and science of exploiting quantum mechanical effects in order to perform cryptographic tasks. While the most well-known example of this discipline is quantum key distribution (QKD), there exist many other applications such as quantum money, randomness generation, secure two- and multi-party computation and delegated quantum computation. Quantum cryptography also studies the limitations and challenges resulting from quantum adversaries-including the impossibility of quantum bit commitment, the difficulty of quantum rewinding and the definition of quantum security models for classical primitives. In this review article, aimed primarily at cryptographers unfamiliar with the quantum world, we survey the area of theoretical quantum cryptography, with an emphasis on the constructions and limitations beyond the realm of QKD.
The emergence of quantum computing has provided new paradigms for cryptography. On the one hand, it poses significant new threats to existing classically cryptographic systems, requiring the community to define new security models that capture what a quantum adversary can do. On the other hand, it gives us new tools to design cryptographic protocols, with weaker assumptions than in the classical world, or even protocols that are impossible classically. In this survey, we first give an overview of new security definitions for classical cryptography, considering quantum adversaries who can either only use local quantum computation (post-quantum security), or even send quantum messages and in particular have access to oracle in superposition (quantum security). We explore these new notions through the examples of commitments, zero-knowledge proofs, encryption, and signatures. Then, we present what is arguably the most famous application of quantum cryptography: quantum key distribution (QKD) protocols that take advantage of unique properties of quantum mechanics to provide secure communication unconditionally. We also explore cryptography beyond QKD, focusing on unclonable cryptography: a family of cryptographic functionalities, built with quantum states, and designed to be resistant to counterfeit by leveraging the “no-cloning” theorem. We examine in particular quantum money, but also the recent notions of unclonable encryption and copy-protection, including related variants. By presenting a comprehensive survey of these topics, this paper aims to provide a thorough understanding of the current landscape and future potential of quantum cryptography.
In this review, we survey the cryptographic task of authentication from the perspective of quantum communication. We review three main flavours of authentication that are often conflated in the literature: authentication of classical messages, authentication of quantum messages, and entity authentication, also covering recent hardware-assisted approaches. We compare representative protocols for each functionality in terms of their security assumptions, set-up requirements, composability, and scalability in large or dynamic networks, and use these criteria to identify and recommend suitable candidates. Finally, applications are surveyed: we provide a detailed case study of authentication and quantum key distribution (QKD), then extend the discussion to protocols beyond QKD, where the role of authentication is more complex. Our take-home message is that an authentication requirement is not an intrinsic limitation of quantum networks: as with all secure communication, each protocol relies on a particular authentication resource, and the security claim of that protocol is meaningful only once the authentication resource and its deployment assumptions are made explicit. At the same time, the existing classical and quantum literature already offers a range of quantum-secure authentication schemes, which can support different applications when carefully matched to the required functionality, assumptions, and security guarantees.
This work is intended as an introduction to cryptographic security and a motivation for the widely used Quantum Key Distribution (QKD) security definition. We review the notion of security necessary for a protocol to be usable in a larger cryptographic context, i.e., for it to remain secure when composed with other secure protocols. We then derive the corresponding security criterion for QKD. We provide several examples of QKD composed in sequence and parallel with different cryptographic schemes to illustrate how the error of a composed protocol is the sum of the errors of the individual protocols. We also discuss the operational interpretations of the distance metric used to quantify these errors.
The rapid advancement of quantum computing poses a significant threat to classical cryptographic systems that rely on the computational hardness of mathematical problems such as integer factorization and discrete logarithm problems. In this context, quantum cryptography has emerged as a promising paradigm for secure communication based on the fundamental principles of quantum mechanics rather than on computational assumptions. This paper presents a comprehensive review of quantum cryptography, with a particular focus on Quantum Key Distribution (QKD), the most mature application. The study discusses the theoretical foundations of quantum security, including superposition, entanglement, and the No-cloning theorem, which collectively enable eavesdropping detection and guarantee information-theoretic security. Furthermore, the review examines major QKD protocols, such as BB84 and E91, as well as their advanced variants designed to address practical vulnerabilities and enhance performance. Recent progress in real-world implementations, including fiber-optic networks, free-space communication, and satellite-based systems such as the Micius satellite, is also analyzed. In addition, the paper highlights critical challenges related to scalability, hardware limitations, and security loopholes arising from imperfect devices. Finally, emerging research directions, including hybrid cryptographic frameworks that integrate quantum and post-quantum approaches, are discussed to provide insights into the future of secure communication. This review aims to provide a structured, up-to-date understanding of quantum cryptography, bridging the gap between theoretical developments and practical implementations, and emphasizing its crucial role in shaping next-generation cybersecurity systems.