Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:1201.4407 · Physical Review Letters

Memory Attacks on Device-Independent Quantum Cryptography

Jonathan Barrett, Roger Colbeck, Adrian Kent

Published Jan 2, 2013• 174 citations
arXivHTMLPDF

Abstract

Device-independent quantum cryptographic schemes aim to guarantee security to users based only on the output statistics of any components used, and without the need to verify their internal functionality. Since this would protect users against untrustworthy or incompetent manufacturers, sabotage, or device degradation, this idea has excited much interest, and many device-independent schemes have been proposed. Here we identify a critical weakness of device-independent protocols that rely on public communication between secure laboratories. Untrusted devices may record their inputs and outputs and reveal information about them via publicly discussed outputs during later runs. Reusing devices thus compromises the security of a protocol and risks leaking secret data. Possible defenses include securely destroying or isolating used devices. However, these are costly and often impractical. We propose other more practical partial defenses as well as a new protocol structure for device-independent quantum key distribution that aims to achieve composable security in the case of two parties using a small number of devices to repeatedly share keys with each other (and no other party).

DOI
10.1103/physrevlett.110.010503

Related papers

Fully Device-Independent Quantum Key Distribution

Umesh V. Vazirani, Thomas Vidick

Quantum cryptography promises levels of security that are impossible to replicate in a classical world. Can this security be guaranteed even when the quantum devices on which the protocol relies are untrusted? This central question dates back to the early 1990s when the challenge of achieving device-independent quantum key distribution was first formulated. We answer this challenge by rigorously proving the device-independent security of a slight variant of Ekert's original entanglement-based protocol against the most general (coherent) attacks. The resulting protocol is robust: While assuming only that the devices can be modeled by the laws of quantum mechanics and are spatially isolated from each other and from any adversary's laboratory, it achieves a linear key rate and tolerates a constant noise rate in the devices. In particular, the devices may have quantum memory and share arbitrary quantum correlations with the eavesdropper. The proof of security is based on a new quantitative understanding of the monogamous nature of quantum correlations in the context of a multiparty protocol.

arXiv:1210.1810•Physical Review Letters•Sep 29, 2014•494 citations

Quantum cryptography with malicious devices

Marcos Curty, Hoi‐Kwong Lo

The current paradigm for the security of quantum key distribution (QKD) relies on the legitimate users of the system trusting their devices, which include both the quantum communication components and the classical post-processing units. However, in view of the memory attacks recently proposed against device-independent QKD, as well as the many hardware and software Trojan Horse attacks that threaten the security of conventional cryptography today, such trust is a very strong and unjustified assumption. Here we review a recent proposal to solve this problem based on the use of verifiable secret sharing and redundancies. We show that this approach can deliver secret key rates which are comparable to those obtained in an ideal scenario with honest devices.

SPIE Quantum Information Science and Technology•Oct 8, 2018•1 citation

Reusing devices with memory in device independent quantum key distribution

Matthew McKague, Lana Sheridan

Recently, it has been suggested [3] that device independent approaches to quantum key distribution may be of limited utility, since standard protocols could leak key to the adversary when devices are used repeatedly. We propose a means by which devices with memories could be reused from one run of a quantum key distribution protocol to the next while bounding the leakage to Eve, under the assumption that one run of the protocol could be completed securely using devices with memories.

arXiv:1209.4696•Sep 21, 2012•2 citations

An input-randomness-free device-independent cryptographic protocol for quantum networks

Lorenzo Caramelli

As our foundational understanding of quantum information theory broadens, it remains to be seen whether novel foundational developments will lead to corresponding applications. Promising branches are quantum networks and quantum cryptography, which are more intertwined by the day. In particular, a fascinating phenomena is that in networks with independent sources, Bell nonlocality can take place without the need for measurement settings for the parties, i.e. in each round, each source is asked to produce the same state and each party measures the same measurement. This is in stark contrast to standard Bell nonlocality, where seed randomness is necessary to certify nonlocality and through it, randomness of the outcomes. Building on nonlocality without seed randomness in networks, we propose a device-independent quantum key distribution protocol (which can be extended to quantum conference key agreement if it involves more than 2 parties) which allows for the generation of shared secret keys without the need for input randomness. We rely on recent results on nonlocality in networks and its robustness, showing how in a ring network with $N$ bipartite sources, one must only make standard assumptions in order to run the protocol, while no trust is required from the devices themselves. We thus give a device-independent proof of security under this network assumption in the IID setting. In summary, we propose a first-of-a-kind protocol for Device-Independent Quantum Key Distribution which is native to the network setting, and which does not demand input randomness from the parties in order to produce output randomness.

•Dec 19, 2025•0 citations

Measurement Device Independent Quantum Dialogue

Arpita Maitra

Very recently, the experimental demonstration of Quantum Secure Direct Communication (QSDC) with state-of-the-art atomic quantum memory has been reported (Phys. Rev. Lett., 2017). Quantum Dialogue (QD) falls under QSDC where the secrete messages are communicated simultaneously between two legitimate parties. The successful experimental demonstration of QSDC opens up the possibilities for practical implementation of QD protocols. Thus, it is necessary to analyze the practical security issues of QD protocols for future implementation. Since the very first proposal for QD by Nguyen (Phys. Lett. A, 2004) a large number of variants and extensions have been presented till date. However, all of those leak half of the secret bits to the adversary through classical communications of the measurement results. In this direction, motivated by the idea of Lo et al. (Phys. Rev. Lett., 2012), we propose a Measurement Device Independent Quantum Dialogue (MDI-QD) scheme which is resistant to such information leakage as well as side channel attacks. In the proposed protocol, Alice and Bob, two legitimate parties, are allowed to prepare the states only. The states are measured by an untrusted third party (UTP) who may himself behave as an adversary. We show that our protocol is secure under this adversarial model. The current protocol does not require any quantum memory and thus it is inherently robust against memory attacks. Such robustness might not be guaranteed in the QSDC protocol with quantum memory (Phys. Rev. Lett., 2017).

arXiv:1704.01323•Apr 5, 2017•1 citation

Device-independent two-party cryptography secure against sequential attacks

Jędrzej Kaniewski, Stephanie Wehner

The goal of two-party cryptography is to enable two parties, Alice and Bob, to solve common tasks without the need for mutual trust. Examples of such tasks are private access to a database, and secure identification. Quantum communication enables security for all of these problems in the noisy-storage model by sending more signals than the adversary can store in a certain time frame. Here, we initiate the study of device-independent (DI) protocols for two-party cryptography in the noisy-storage model. Specifically, we present a relatively easy to implement protocol for a cryptographic building block known as weak string erasure and prove its security even if the devices used in the protocol are prepared by the dishonest party. DI two-party cryptography is made challenging by the fact that Alice and Bob do not trust each other, which requires new techniques to establish security. We fully analyse the case of memoryless devices (for which sequential attacks are optimal) and the case of sequential attacks for arbitrary devices. The key ingredient of the proof, which might be of independent interest, is an explicit (and tight) relation between the violation of the Clauser–Horne–Shimony–Holt inequality observed by Alice and Bob and uncertainty generated by Alice against Bob who is forced to measure his system before finding out Alice's setting (guessing with postmeasurement information). In particular, we show that security is possible for arbitrarily small violation.

arXiv:1601.06752•New Journal of Physics•May 6, 2016•39 citations
Device-independent quantum cryptographic schemes aim to guarantee security to users based only on the output statistics of any components used, and without the need to verify their internal functionality. Since this would protect users against untrustworthy or incompetent manufacturers, sabotage, or device degradation, this idea has excited much interest, and many device-independent schemes have been proposed. Here we identify a critical weakness of device-independent protocols that rely on public communication between secure laboratories. Untrusted devices may record their inputs and outputs and reveal information about them via publicly discussed outputs during later runs. Reusing devices thus compromises the security of a protocol and risks leaking secret data. Possible defenses include securely destroying or isolating used devices. However, these are costly and often impractical. We propose other more practical partial defenses as well as a new protocol structure for device-independent quantum key distribution that aims to achieve composable security in the case of two parties using a small number of devices to repeatedly share keys with each other (and no other party).
Quantum cryptography promises levels of security that are impossible to replicate in a classical world. Can this security be guaranteed even when the quantum devices on which the protocol relies are untrusted? This central question dates back to the early 1990s when the challenge of achieving device-independent quantum key distribution was first formulated. We answer this challenge by rigorously proving the device-independent security of a slight variant of Ekert's original entanglement-based protocol against the most general (coherent) attacks. The resulting protocol is robust: While assuming only that the devices can be modeled by the laws of quantum mechanics and are spatially isolated from each other and from any adversary's laboratory, it achieves a linear key rate and tolerates a constant noise rate in the devices. In particular, the devices may have quantum memory and share arbitrary quantum correlations with the eavesdropper. The proof of security is based on a new quantitative understanding of the monogamous nature of quantum correlations in the context of a multiparty protocol.
The current paradigm for the security of quantum key distribution (QKD) relies on the legitimate users of the system trusting their devices, which include both the quantum communication components and the classical post-processing units. However, in view of the memory attacks recently proposed against device-independent QKD, as well as the many hardware and software Trojan Horse attacks that threaten the security of conventional cryptography today, such trust is a very strong and unjustified assumption. Here we review a recent proposal to solve this problem based on the use of verifiable secret sharing and redundancies. We show that this approach can deliver secret key rates which are comparable to those obtained in an ideal scenario with honest devices.
As our foundational understanding of quantum information theory broadens, it remains to be seen whether novel foundational developments will lead to corresponding applications. Promising branches are quantum networks and quantum cryptography, which are more intertwined by the day. In particular, a fascinating phenomena is that in networks with independent sources, Bell nonlocality can take place without the need for measurement settings for the parties, i.e. in each round, each source is asked to produce the same state and each party measures the same measurement. This is in stark contrast to standard Bell nonlocality, where seed randomness is necessary to certify nonlocality and through it, randomness of the outcomes. Building on nonlocality without seed randomness in networks, we propose a device-independent quantum key distribution protocol (which can be extended to quantum conference key agreement if it involves more than 2 parties) which allows for the generation of shared secret keys without the need for input randomness. We rely on recent results on nonlocality in networks and its robustness, showing how in a ring network with NNN bipartite sources, one must only make standard assumptions in order to run the protocol, while no trust is required from the devices themselves. We thus give a device-independent proof of security under this network assumption in the IID setting. In summary, we propose a first-of-a-kind protocol for Device-Independent Quantum Key Distribution which is native to the network setting, and which does not demand input randomness from the parties in order to produce output randomness.
Very recently, the experimental demonstration of Quantum Secure Direct Communication (QSDC) with state-of-the-art atomic quantum memory has been reported (Phys. Rev. Lett., 2017). Quantum Dialogue (QD) falls under QSDC where the secrete messages are communicated simultaneously between two legitimate parties. The successful experimental demonstration of QSDC opens up the possibilities for practical implementation of QD protocols. Thus, it is necessary to analyze the practical security issues of QD protocols for future implementation. Since the very first proposal for QD by Nguyen (Phys. Lett. A, 2004) a large number of variants and extensions have been presented till date. However, all of those leak half of the secret bits to the adversary through classical communications of the measurement results. In this direction, motivated by the idea of Lo et al. (Phys. Rev. Lett., 2012), we propose a Measurement Device Independent Quantum Dialogue (MDI-QD) scheme which is resistant to such information leakage as well as side channel attacks. In the proposed protocol, Alice and Bob, two legitimate parties, are allowed to prepare the states only. The states are measured by an untrusted third party (UTP) who may himself behave as an adversary. We show that our protocol is secure under this adversarial model. The current protocol does not require any quantum memory and thus it is inherently robust against memory attacks. Such robustness might not be guaranteed in the QSDC protocol with quantum memory (Phys. Rev. Lett., 2017).
The goal of two-party cryptography is to enable two parties, Alice and Bob, to solve common tasks without the need for mutual trust. Examples of such tasks are private access to a database, and secure identification. Quantum communication enables security for all of these problems in the noisy-storage model by sending more signals than the adversary can store in a certain time frame. Here, we initiate the study of device-independent (DI) protocols for two-party cryptography in the noisy-storage model. Specifically, we present a relatively easy to implement protocol for a cryptographic building block known as weak string erasure and prove its security even if the devices used in the protocol are prepared by the dishonest party. DI two-party cryptography is made challenging by the fact that Alice and Bob do not trust each other, which requires new techniques to establish security. We fully analyse the case of memoryless devices (for which sequential attacks are optimal) and the case of sequential attacks for arbitrary devices. The key ingredient of the proof, which might be of independent interest, is an explicit (and tight) relation between the violation of the Clauser–Horne–Shimony–Holt inequality observed by Alice and Bob and uncertainty generated by Alice against Bob who is forced to measure his system before finding out Alice's setting (guessing with postmeasurement information). In particular, we show that security is possible for arbitrarily small violation.