Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:1903.10237 · IEEE Transactions on Information Theory

Lightweight Authentication for Quantum Key Distribution

Evgeniy O. Kiktenko, Aleksei Malyshev, Maxim A. Gavreev, A. A. Bozhedarov, N. O. Pozhar, M. N. Anufriev, Aleksey K. Fedorov

Published Apr 22, 2020• 44 citations
arXivHTMLPDF

Abstract

Quantum key distribution (QKD) enables unconditionally secure communication between distinct parties using a quantum channel and an authentic public channel. Reducing the portion of quantum-generated secret keys, that is consumed during the authentication procedure, is of significant importance for improving the performance of QKD systems. In the present work, we develop a lightweight authentication protocol for QKD based on a `ping-pong' scheme of authenticity check for QKD. An important feature of this scheme is that the only one authentication tag is generated and transmitted during each of the QKD post-processing rounds. For the tag generation purpose, we design an unconditionally secure procedure based on the concept of key recycling. The procedure is based on the combination of almost universal2polynomial hashing, XOR universal2Toeplitz hashing, and one-time pad (OTP) encryption. We demonstrate how to minimize both the length of the recycled key and the size of the authentication key, that is required for OTP encryption. As a result, in real case scenarios, the portion of quantum-generated secret keys that is consumed for the authentication purposes is below 1%. Finally, we provide a security analysis of the full quantum key growing process in the framework of universally composable security.

DOI
10.1109/tit.2020.2989459

Related papers

Security of Authentication with a Fixed Key in Quantum Key Distribution

Aysajan Abidin, Jan-Åke Larsson

We study the security of a specific authentication procedure of interest in the context of Quantum Key Distribution (QKD). It works as follows: use a secret but fixed Strongly Universal$_2$ (SU$_2$) hash function and encrypt the output tag with a one-time pad (OTP). If the OTP is completely secret, the expected time for an adversary to create a tag for a chosen message is exponential in the tag length. If, however, the OTP is partially known in each authentication round, as is the case in practical QKD protocols, then the picture is different; the adversary's partial knowledge of the OTP in each authentication round gives partial information on the secret hash function, and this weakens the authentication in later rounds. The effect of this is that the lifetime of the system is linear in the length of the fixed key. This is supported by the composability theorem for QKD, that in this setting provides an upper bound to the security loss on the secret hash function, which is exponential in the number of authentication rounds. This needs to be taken into account when using the protocol, since the authentication gets weakened at each subsequent round and thus the QKD generated is key is not as strong as when the authentication is strong. Some countermeasures are discussed at the end of this paper.

arXiv:1109.5168•Sep 23, 2011•10 citations

Authentication in Quantum Key Distribution : Security Proof and Universal Hash Functions

Aysajan Abidin

Quantum Key Distribution (QKD) is a secret key agreement technique that consists of two parts: quantum transmission and measurement on a quantum channel, and classical post-processing on a public communication channel. It enjoys provable unconditional security provided that the public communication channel is immutable. Otherwise, QKD is vulnerable to a man-in-the-middle attack. Immutable public communication channels, however, do not exist in practice. So we need to use authentication that implements the properties of an immutable channel as well as possible. One scheme that serves this purpose well is the Wegman-Carter authentication (WCA), which is built upon Almost Strongly Universal2 (ASU2) hashing. This scheme uses a new key in each authentication attempt to select a hash function from an ASU2 family, which is then used to generate the authentication tag for a message. The main focus of this dissertation is on authentication in the context of QKD. We study ASU2 hash functions, security of QKD that employs a computationally secure authentication, and also security of authentication with a partially known key. Specifically, we study the following. First, Universal hash functions and their constructions are reviewed, and as well as a new construction of ASU2 hash functions is presented. Second, security of QKD that employs a specific computationally secure authentication is studied. We present detailed attacks on various practical implementations of QKD that employs this authentication. We also provide countermeasures and prove necessary and sufficient conditions for upgrading the security of the authentication to the level of unconditional security. Third, Universal hash function based multiple authentication is studied. This uses a fixed ASU2 hash function followed by one-time pad encryption, to keep the hash function secret. We show that the one-time pad is necessary in every round for the authentication to be unconditionally secure. Lastly, we study security of the WCA scheme, in the case of a partially known authentication key. Here we prove tight information-theoretic security bounds and also analyse security using witness indistinguishability as used in the Universal Composability framework.

•Jan 1, 2013•17 citations

An Efficient Algorithm on Quantum Computing With Quantum Key Distribution for Secure Communication

Ganapathy Senthil Murugan

Currently many symmetric key cryptographic tools which are known to be quantum-safe. They all share Secret symmetric keys through an untrusted medium which is usually done with public key methods which are prone to quantum attacks. One among the recommended solutions to the key distribution problem is Quantum Key Distribution (QKD). QKD utilizes an authenticated Communication channel along with a quantum communication channel so that a secret key is generated. Whatever may be the protocol to implement proposed QKD, they all need both a quantum channel, and an authenticated classical. OTP (One Time Pad) is used when two parties wish to communications have to share a key called pad. This pad is a randomly generated key and the length of the key should be equal to the message so it can be sent. The proposed QKD parameters that result in almost 35.67% smaller keys for quantum security and an implementation of QKD in network which is publicly available and usable in practice.

International journal of communication•May 14, 2020•2 citations

Send the Key in Cleartext: Halving Key Consumption while Preserving Unconditional Security in QKD Authentication

Claudia De Lazzari, Francesco Stocco, Edoardo Signorini +7 more

Quantum Key Distribution (QKD) protocols require Information-Theoretically Secure (ITS) authentication of the classical channel to preserve the unconditional security of the distilled key. Standard ITS schemes are based on one-time keys: once a key is used to authenticate a message, it must be discarded. Since QKD requires mutual authentication, two independent one-time keys are typically consumed per round, imposing a non-trivial overhead on the net secure key rate. In this work, we present the authentication-with-response scheme, a novel ITS authentication scheme based on $\varepsilon$-Almost Strongly Universal$_2$ ($\varepsilon$-ASU$_2$) functions, whose IT security can be established in the Universal Composability (UC) framework. The scheme achieves mutual authentication consuming a single one-time key per QKD round, halving key consumption compared to the state-of-the-art.

quant-pharXiv:2603.25496•Mar 27, 2026•0 citations

Authentication Methods for Quantum Key Distribution: Challenges and Perspectives

Giacomo Fregona, Claudia De Lazzari, Damiano Giani +7 more

In this article, we investigate the issue of authenticating the classical post-processing components of a QKD protocol through an insecure channel. Our analysis starts with state-of-the-art solutions and subsequently introduces an authentication scheme aiming at both Information Theoretic Security and resiliency from particular denial-of-service attacks targeting the authentication procedure. The proposed strategy combines -Almost Strongly Universal hashing for unconditional protection and computationally-secure Message Authentication Codes for DoS detection capability. Specifically, we consider the protocol security in a typical QKD scenario, taking into account partially weak authentication keys. Moreover, we add practical considerations related to authentication parameters and experimentally evaluate the performance of the proposed system in terms of computational complexity and key consumption in a reasonable use case.

NATO science for peace and security series. D, Information and communication security•Feb 19, 2024•2 citations

Quantum Coin-Flipping-Based Authentication

Stefan Raß, Peter Schartner, Michaela Greiler

Quantum cryptographic key distribution (QKD) is a promising candidate for achieving unconditional security, making the renowned one-time pad encryption technically feasible for building computer networks. However, although well-developed theoretical foundations perfectly ensure protection against eavesdropping, no natural mechanism is yet able to successfully repel an adversary sitting between Alice and Bob, performing QKD with both and re-encrypting each message after heaving read it in plain text. Authentication is hence of crucial importance, and normally applied to all messages that are related to the public discussion part of the QKD protocol. We present an analysis of a scenario, in which authentication is postponed until the end of the QKD protocol. This yields to reduced computational effort, as well as simple and tight bounds on the amount of pre-shared key material. Our solution relies on a combination of quantum key distribution and quantum coin-flipping, which ensures non- controllability of the QKD key. Based on this assumption, we can apply a standard fingerprint comparison for authentication, to guard the protocol against a person-in-the-middle attack.

International Conference on Communications•Jun 1, 2009•6 citations
Quantum key distribution (QKD) enables unconditionally secure communication between distinct parties using a quantum channel and an authentic public channel. Reducing the portion of quantum-generated secret keys, that is consumed during the authentication procedure, is of significant importance for improving the performance of QKD systems. In the present work, we develop a lightweight authentication protocol for QKD based on a `ping-pong' scheme of authenticity check for QKD. An important feature of this scheme is that the only one authentication tag is generated and transmitted during each of the QKD post-processing rounds. For the tag generation purpose, we design an unconditionally secure procedure based on the concept of key recycling. The procedure is based on the combination of almost universal2polynomial hashing, XOR universal2Toeplitz hashing, and one-time pad (OTP) encryption. We demonstrate how to minimize both the length of the recycled key and the size of the authentication key, that is required for OTP encryption. As a result, in real case scenarios, the portion of quantum-generated secret keys that is consumed for the authentication purposes is below 1%. Finally, we provide a security analysis of the full quantum key growing process in the framework of universally composable security.
We study the security of a specific authentication procedure of interest in the context of Quantum Key Distribution (QKD). It works as follows: use a secret but fixed Strongly Universal2_22​ (SU2_22​) hash function and encrypt the output tag with a one-time pad (OTP). If the OTP is completely secret, the expected time for an adversary to create a tag for a chosen message is exponential in the tag length. If, however, the OTP is partially known in each authentication round, as is the case in practical QKD protocols, then the picture is different; the adversary's partial knowledge of the OTP in each authentication round gives partial information on the secret hash function, and this weakens the authentication in later rounds. The effect of this is that the lifetime of the system is linear in the length of the fixed key. This is supported by the composability theorem for QKD, that in this setting provides an upper bound to the security loss on the secret hash function, which is exponential in the number of authentication rounds. This needs to be taken into account when using the protocol, since the authentication gets weakened at each subsequent round and thus the QKD generated is key is not as strong as when the authentication is strong. Some countermeasures are discussed at the end of this paper.
Quantum Key Distribution (QKD) is a secret key agreement technique that consists of two parts: quantum transmission and measurement on a quantum channel, and classical post-processing on a public communication channel. It enjoys provable unconditional security provided that the public communication channel is immutable. Otherwise, QKD is vulnerable to a man-in-the-middle attack. Immutable public communication channels, however, do not exist in practice. So we need to use authentication that implements the properties of an immutable channel as well as possible. One scheme that serves this purpose well is the Wegman-Carter authentication (WCA), which is built upon Almost Strongly Universal2 (ASU2) hashing. This scheme uses a new key in each authentication attempt to select a hash function from an ASU2 family, which is then used to generate the authentication tag for a message. The main focus of this dissertation is on authentication in the context of QKD. We study ASU2 hash functions, security of QKD that employs a computationally secure authentication, and also security of authentication with a partially known key. Specifically, we study the following. First, Universal hash functions and their constructions are reviewed, and as well as a new construction of ASU2 hash functions is presented. Second, security of QKD that employs a specific computationally secure authentication is studied. We present detailed attacks on various practical implementations of QKD that employs this authentication. We also provide countermeasures and prove necessary and sufficient conditions for upgrading the security of the authentication to the level of unconditional security. Third, Universal hash function based multiple authentication is studied. This uses a fixed ASU2 hash function followed by one-time pad encryption, to keep the hash function secret. We show that the one-time pad is necessary in every round for the authentication to be unconditionally secure. Lastly, we study security of the WCA scheme, in the case of a partially known authentication key. Here we prove tight information-theoretic security bounds and also analyse security using witness indistinguishability as used in the Universal Composability framework.
Currently many symmetric key cryptographic tools which are known to be quantum-safe. They all share Secret symmetric keys through an untrusted medium which is usually done with public key methods which are prone to quantum attacks. One among the recommended solutions to the key distribution problem is Quantum Key Distribution (QKD). QKD utilizes an authenticated Communication channel along with a quantum communication channel so that a secret key is generated. Whatever may be the protocol to implement proposed QKD, they all need both a quantum channel, and an authenticated classical. OTP (One Time Pad) is used when two parties wish to communications have to share a key called pad. This pad is a randomly generated key and the length of the key should be equal to the message so it can be sent. The proposed QKD parameters that result in almost 35.67% smaller keys for quantum security and an implementation of QKD in network which is publicly available and usable in practice.
Quantum Key Distribution (QKD) protocols require Information-Theoretically Secure (ITS) authentication of the classical channel to preserve the unconditional security of the distilled key. Standard ITS schemes are based on one-time keys: once a key is used to authenticate a message, it must be discarded. Since QKD requires mutual authentication, two independent one-time keys are typically consumed per round, imposing a non-trivial overhead on the net secure key rate. In this work, we present the authentication-with-response scheme, a novel ITS authentication scheme based on ε\varepsilonε-Almost Strongly Universal2_22​ (ε\varepsilonε-ASU2_22​) functions, whose IT security can be established in the Universal Composability (UC) framework. The scheme achieves mutual authentication consuming a single one-time key per QKD round, halving key consumption compared to the state-of-the-art.
In this article, we investigate the issue of authenticating the classical post-processing components of a QKD protocol through an insecure channel. Our analysis starts with state-of-the-art solutions and subsequently introduces an authentication scheme aiming at both Information Theoretic Security and resiliency from particular denial-of-service attacks targeting the authentication procedure. The proposed strategy combines -Almost Strongly Universal hashing for unconditional protection and computationally-secure Message Authentication Codes for DoS detection capability. Specifically, we consider the protocol security in a typical QKD scenario, taking into account partially weak authentication keys. Moreover, we add practical considerations related to authentication parameters and experimentally evaluate the performance of the proposed system in terms of computational complexity and key consumption in a reasonable use case.
Quantum cryptographic key distribution (QKD) is a promising candidate for achieving unconditional security, making the renowned one-time pad encryption technically feasible for building computer networks. However, although well-developed theoretical foundations perfectly ensure protection against eavesdropping, no natural mechanism is yet able to successfully repel an adversary sitting between Alice and Bob, performing QKD with both and re-encrypting each message after heaving read it in plain text. Authentication is hence of crucial importance, and normally applied to all messages that are related to the public discussion part of the QKD protocol. We present an analysis of a scenario, in which authentication is postponed until the end of the QKD protocol. This yields to reduced computational effort, as well as simple and tight bounds on the amount of pre-shared key material. Our solution relies on a combination of quantum key distribution and quantum coin-flipping, which ensures non- controllability of the QKD key. Based on this assumption, we can apply a standard fingerprint comparison for authentication, to guard the protocol against a person-in-the-middle attack.