Physical unclonable functions have been shown to be a useful resource of randomness for implementing various cryptographic tasks including entity authentication. All the related entity authentication protocols that have been discussed in the literature so far, either they are vulnerable to an emulation attack, or they are limited to short distances. Hence, quantum-safe remote entity authentication over large distances remains an open question. In the first part of this work, we discuss the requirements that an entity authentication protocol has to offer, to be useful for remote entity authentication in practice. Subsequently, we propose a protocol, which can operate over large distances, and offers security against both classical and quantum adversaries. The proposed protocol relies on standard techniques, it is fully compatible with the infrastructure of existing and future photonic networks, and it can operate in parallel with other quantum protocols, including QKD protocols.
Physical unclonable functions have been shown to be a useful resource of randomness for implementing various cryptographic tasks including entity authentication. All the related entity authentication protocols that have been discussed in the literature so far, either they are vulnerable to an emulation attack, or they are limited to short distances. Hence, quantum-safe remote entity authentication over large distances remains an open question. In the first part of this work, we discuss the requirements that an entity authentication protocol has to offer, to be useful for remote entity authentication in practice. Subsequently, we propose a protocol, which can operate over large distances, and offers security against both classical and quantum adversaries. The proposed protocol relies on standard techniques, it is fully compatible with the infrastructure of existing and future photonic networks, and it can operate in parallel with other quantum protocols, including QKD protocols.
Abstract Authentication is a fundamental building block of secure quantum networks, essential for quantum cryptographic protocols and often debated as a key limitation of quantum key distribution in security standards. Most quantum-safe authentication schemes rely on small pre-shared keys or post-quantum computational assumptions. In this work, we introduce a new authentication approach that combines hardware assumptions, particularly physical unclonable functions (PUFs), along with fundamental quantum properties of non-local states, such as local indistinguishability, to achieve provable security in entanglement-based protocols. We propose two protocols for different scenarios in entanglement-enabled quantum networks. The first protocol, referred to as the offline protocol, requires pre-distributed entangled states but no quantum communication during the authentication phase. It enables a server to authenticate clients at any time with only minimal classical communication. The second, an online protocol, requires quantum communication but only necessitates entangled state generation on the Prover ’s side. For this, we introduce a novel hardware module, the hybrid entangled PUF. Both protocols use weakly secure, off-the-shelf classical PUFs as their hardware module, yet we prove that quantum properties such as local indistinguishability enable exponential security for authentication, even in a single round. We provide full security analysis for both protocols and establish them as the first entanglement-based extension of hardware-based quantum authentication. These protocols are suitable for implementation across various platforms, particularly photonics-based ones, and offer a practical and flexible solution to the long-standing challenge of authentication in quantum communication networks.
In this review, we survey the cryptographic task of authentication from the perspective of quantum communication. We review three main flavours of authentication that are often conflated in the literature: authentication of classical messages, authentication of quantum messages, and entity authentication, also covering recent hardware-assisted approaches. We compare representative protocols for each functionality in terms of their security assumptions, set-up requirements, composability, and scalability in large or dynamic networks, and use these criteria to identify and recommend suitable candidates. Finally, applications are surveyed: we provide a detailed case study of authentication and quantum key distribution (QKD), then extend the discussion to protocols beyond QKD, where the role of authentication is more complex. Our take-home message is that an authentication requirement is not an intrinsic limitation of quantum networks: as with all secure communication, each protocol relies on a particular authentication resource, and the security claim of that protocol is meaningful only once the authentication resource and its deployment assumptions are made explicit. At the same time, the existing classical and quantum literature already offers a range of quantum-secure authentication schemes, which can support different applications when carefully matched to the required functionality, assumptions, and security guarantees.
The rapid advances in quantum computing pressure the existing essential cryptographic algorithms. In this context, Quantum Key Distribution (QKD) has been proposed as a quantum safe solution for key distribution. However, current QKD systems require an authenticated classical channel which relies on pre-shared symmetric keys that are manually distributed and do not guarantee the identity of the hardware that hosts them. This paper proposes a novel scheme, the Physically Unclonable Quantum Key Distribution (PU-QKD) system, to intrinsically authenticate the communicating endpoints in QKD. The PU-QKD scheme leverages classical Physical Unclonable Functions (PUFs) to encode the data transmission in discrete variable QKD protocols (e.g., BB84). Our scheme maintains the information-theoretic security of QKD protocols by integrating the PUF as an additional layer. Authentication is bound to hardware, providing a robust fingerprint, while lower post-processing overhead increases key rates. Additionally, the proposed scheme is resilient against state-of-the-art PUF vulnerabilities, such as modeling attacks.
Quantum Key Distribution (QKD) enables Information-Theoretically Secure (ITS) key exchange, robust even against future quantum computing threats. However, a fundamental limitation of QKD is the requirement for an authenticated classical channel, which necessitates a pre-shared secret key. In this work, we address this challenge by adopting a Hybrid Entangled Physical Unclonable Function (PUF) protocol for authentication. We demonstrate that this PUF-based method generates an ITS initial key under minimal explicit hardware assumptions. This approach allows us to experimentally perform a fully ITS-authenticated entanglement-based QKD protocol that relies solely on such assumptions, effectively eliminating the need for pre-shared secrets. This represents a significant step towards the practical realization of quantum network protocols using lightweight, readily available hardware assumptions, without weakening security guarantees.
The Internet of Things (IoT) has ushered in significant advancements in networked technologies, yet it simultaneously raises concerns about the security and privacy of connected devices. Traditional authentication methods based on cryptographic protocols are increasingly vulnerable to attacks as the number of devices grows and attackers develop more sophisticated strategies. In this paper, we propose a novel quantum-based authentication method using Quantum Physical Unclonable Functions (QPUFs) to address the security challenges in IoT devices. Quantum PUFs exploit the inherent quantum properties of devices to generate unique, unclonable responses to challenges, providing a high level of security and resilience against attacks such as cloning, spoofing, and interception. We present the architecture of the proposed quantum authentication system, discuss the challenge-response protocol, and evaluate the system’s performance. Experimental results show that this approach offers strong security guarantees with minimal computational overhead. We Evaluate the Security, Scalability of our approach in simulated adverse IoT environment.
Quantum key distribution protocols allow two honest distant parties to establish a common truly random secret key in the presence of powerful adversaries, provided that the two users share a short secret key beforehand. This pre-shared secret key is used mainly for authentication purposes in the post-processing of classical data that have been obtained during the quantum communication stage, and it prevents a man-in-the-middle attack. The necessity of a pre-shared key is usually considered to be the main drawback of quantum key distribution protocols, and it becomes even stronger for large networks involving more than two users. Here, we discuss the conditions under which physical unclonable functions can be integrated in currently available quantum key distribution systems in order to facilitate the generation and the distribution of the necessary pre-shared key with the smallest possible cost in the security of the systems. Moreover, the integration of physical unclonable functions in quantum key distribution networks allows for real-time authentication of the devices that are connected to the network.