© 2026 Aqora Quantum S.A.S.

Terms Privacy Legal Notice

arXiv:2109.15049 · Cryptography

Quantum Identity-Based Encryption from the Learning with Errors Problem

Wenhua Gao, Li Yang, Daode Zhang, Xia Liu

Published Feb 16, 2022• 7 citations

Abstract

To prevent eavesdropping and tampering, network security protocols take advantage of asymmetric ciphers to establish session-specific shared keys with which further communication is encrypted using symmetric ciphers. Commonly used asymmetric algorithms include public key encryption, key exchange, and identity-based encryption (IBE). However, network security protocols based on classic identity-based encryption schemes do not have perfect forward secrecy. To solve this problem, we construct the first quantum IBE (QIBE) scheme based on the learning with errors (LWE) problem, which is also the first cryptographic scheme that applies the LWE problem to quantum encryption. We prove that our scheme is fully secure under the random oracle model and highlight the following advantages: (1) Network security protocols with our QIBE scheme provide perfect forward secrecy. The ciphertext is transmitted in the form of a quantum state unknown to the adversary and cannot be copied and stored. Thus, in network security protocols based on QIBE construction, the adversary does not have any previous quantum ciphertext to decrypt for obtaining the previous session key, even if the private identity key is threatened. (2) Classic key generation centre (KGC) systems can still be used in the QIBE scheme to generate and distribute private identity keys, reducing the cost when implementing this scheme. The classic KGC systems can be used because the master public and secret keys of our scheme are both in the form of classic bits. Finally, we present quantum circuits to implement this QIBE scheme and analyse its required quantum resources for given numbers of qubits, Hadamard gates, phase gates, T gates, and CNOT (controlled-NOT) gates. One of our main findings is that the quantum resources required by our scheme increase linearly with the number of plaintext bits to be encrypted.

DOI: 10.3390/cryptography6010009

Related papers

KDM and Selective Opening Secure IBE Based on the LWE Problem

Jingnan He, Bao Li, Xianhui Lu +2 more

Based on the learning with errors (LWE) problem, we construct an identity-based encryption (IBE) scheme in the standard-model which is secure against the key dependent message (KDM) attacks and the selective opening (SO) attacks. KDM security, which requires that the scheme can still obtain secrecy even if the messages depend on the secret key, is necessary for IBE when updating the identity secret keys with the old ones. SO security, which requires that when the adversary corrupts some fraction of senders, the uncorrupted senders' messages still maintain privacy, is useful for IBE since that one user receives messages from many senders is a natural scenario. Although there is a KDM secure IBE scheme based on LWE constructed by Alperin-Sheriff and Peikert (PKC'12), and a SO secure IBE scheme based on LWE constructed by He et al. (IWSEC'15), those two schemes cannot achieve both of the security requirements at the same time.

•Mar 31, 2017•3 citations

Full Secure Identity-Based Encryption Scheme over Lattices in the Standard Model

Wang Jizhong, Wang Chunxiao

Using a known lattice-based chosen plain-text secure encryption scheme and the Bonsai trees primitive, a identity-based encryption (IBE) scheme is proposed in this paper. A public matrices chosen rule that has been used in a known efficient lattice-based chosen ciphtertext secure encryption scheme is used in this paper to reduce the public key size and the message-to ciphtertext expanse factor. Under the hardness of the decision variant of the learning with errors (LWE) problem, we prove that the proposed IBE scheme is indistinguishable against the adaptive chosen identities and chosen-plaintext attack in the standard model. Since a new public key chosen rule is used in our design scheme, the public key size of the proposed scheme would be short. Moreover, the message-to-ciphtertext expanse factor of this scheme is also controlled efficiently which is nearly closed to that of Gentry's scheme. Due to the quantum intractability of the LWE problem on which the scheme is based, the proposed IBE scheme is secure even in quantum-era.

International Conference on P2P, Parallel, Grid, Cloud and Internet Computing (3PGCIC)•Nov 1, 2015•3 citations

Full secure identity-based encryption scheme with short public key size over lattices in the standard model

Fenghe Wang, Zhenhua Liu, Chunxiao Wang

An efficient identity-based encryption (IBE) scheme over lattice is proposed in this paper. Under the hardness of the learning with errors (LWE) problem, the proposed scheme is semantic secure against adaptive chosen identity and chosen plaintext attack in the standard model. To improve the efficiency of the lattice-based IBE scheme, unlike the identity string is encoded into a matrix by a group of public matrices in several known constructions, the identity string of l bits is encoded into a vector with the help of l+1 vectors in this paper. With the help of this idea, we achieve the private key extraction of IBE scheme at the same lattice. Then, the public key of the proposed scheme only consists of one n×m matrix and l+1 vectors, compared with that the public keys of the known lattice-based IBE schemes all consist as a group of n×m matrices. Hence, the public key size of this scheme is shorter than that of the known constructions.

International Journal of Computer Mathematics•Mar 16, 2015•20 citations

Sender-side Public Key Deniable Encryption Scheme Based on LWE

Wenyuan WU, Jiatong ZHENG, Feng Yong

Deniable encryption is an intriguing scheme against the problem of information leakage caused by adversary coercion. Previously proposed deniable schemes cannot resist the attack of quantum computers and there are few implementations of these schemes. Aiming at this problem, a deniable encryption scheme based on learning with errors (LWE) and related implementations were proposed. The scheme can resist the quantum attack, and also can deny the plaintext to any fake plaintext, so that the sender can resist the adversary’s coercive attack. Firstly, by using the indistinguishability of the LWE problem, a subset with low density named “translucent set” was constructed in a uniform space. The “translucent set” was used to construct the ciphertexts of bits 0 and 1, which enabled one-way deniability of a single bit and reduced the error rate. Then, a plaintext coding method was proposed to realize two-way deniability of a single bit so that the sender could deny the original plaintext to any fake plaintext. The theoretical analyses were given to show the deniability, security (IND–CPA), correctness, complexity and ciphertext expansion rate of the scheme. Finally, the scheme was implemented by C++, and experiments had been done for the error rate, ciphertext expansion rate, encryption and decryption efficiency. The experimental results showed that the error rate and ciphertext expansion rate were consistent with the theoretical results. Compared with other deniable schemes based on the quadratic residual problem, the proposed scheme has obvious advantages in anti-quantum attack, efficiency and ciphertext expansion rate. Specifically, the encryption efficiency is improved by 70%, and the ciphertext expansion rate is reduced to 1/3 of above schemes.

•Jan 1, 2020•0 citations

On Quantum Chosen-Ciphertext Attacks and Learning with Errors

Gorjan Alagic, Stacey Jeffery, Māris Ozols +1 more

Quantum computing is a significant threat to classical public-key cryptography. In strong "quantum access" security models, numerous symmetric-key cryptosystems are also vulnerable. We consider classical encryption in a model which grants the adversary quantum oracle access to encryption and decryption, but where the latter is restricted to non-adaptive (i.e., pre-challenge) queries only. We define this model formally using appropriate notions of ciphertext indistinguishability and semantic security (which are equivalent by standard arguments) and call it QCCA1 in analogy to the classical CCA1 security model. Using a bound on quantum random-access codes, we show that the standard PRF-based encryption schemes are QCCA1-secure when instantiated with quantum-secure primitives. We then revisit standard IND-CPA-secure Learning with Errors (LWE) encryption and show that leaking just one quantum decryption query (and no other queries or leakage of any kind) allows the adversary to recover the full secret key with constant success probability. In the classical setting, by contrast, recovering the key requires a linear number of decryption queries. The algorithm at the core of our attack is a (large-modulus version of) the well-known Bernstein-Vazirani algorithm. We emphasize that our results should not be interpreted as a weakness of these cryptosystems in their stated security setting (i.e., post-quantum chosen-plaintext secrecy). Rather, our results mean that, if these cryptosystems are exposed to chosen-ciphertext attacks (e.g., as a result of deployment in an inappropriate real-world setting) then quantum attacks are even more devastating than classical ones.

Leibniz international proceedings in informatics•Jan 1, 2019•0 citations

Efficient Quantum Public-Key Encryption From Learning With Errors

Javad Doliskani

Our main result is a quantum public-key encryption scheme based on the Extrapolated Dihedral Coset problem (EDCP) which is equivalent, under quantum polynomial-time reductions, to the Learning With Errors (LWE) problem. For limited number of public keys (roughly linear in the security parameter), the proposed scheme is information-theoretically secure. For polynomial number of public keys, breaking the scheme is as hard as solving the LWE problem. The public keys in our scheme are quantum states of size $\tilde{O}(n)$ qubits. The key generation and decryption algorithms require $\tilde{O}(n)$ qubit operations while the encryption algorithm takes $O(1)$ qubit operations.

arXiv:2105.12790•May 26, 2021•2 citations

To prevent eavesdropping and tampering, network security protocols take advantage of asymmetric ciphers to establish session-specific shared keys with which further communication is encrypted using symmetric ciphers. Commonly used asymmetric algorithms include public key encryption, key exchange, and identity-based encryption (IBE). However, network security protocols based on classic identity-based encryption schemes do not have perfect forward secrecy. To solve this problem, we construct the first quantum IBE (QIBE) scheme based on the learning with errors (LWE) problem, which is also the first cryptographic scheme that applies the LWE problem to quantum encryption. We prove that our scheme is fully secure under the random oracle model and highlight the following advantages: (1) Network security protocols with our QIBE scheme provide perfect forward secrecy. The ciphertext is transmitted in the form of a quantum state unknown to the adversary and cannot be copied and stored. Thus, in network security protocols based on QIBE construction, the adversary does not have any previous quantum ciphertext to decrypt for obtaining the previous session key, even if the private identity key is threatened. (2) Classic key generation centre (KGC) systems can still be used in the QIBE scheme to generate and distribute private identity keys, reducing the cost when implementing this scheme. The classic KGC systems can be used because the master public and secret keys of our scheme are both in the form of classic bits. Finally, we present quantum circuits to implement this QIBE scheme and analyse its required quantum resources for given numbers of qubits, Hadamard gates, phase gates, T gates, and CNOT (controlled-NOT) gates. One of our main findings is that the quantum resources required by our scheme increase linearly with the number of plaintext bits to be encrypted.

Based on the learning with errors (LWE) problem, we construct an identity-based encryption (IBE) scheme in the standard-model which is secure against the key dependent message (KDM) attacks and the selective opening (SO) attacks. KDM security, which requires that the scheme can still obtain secrecy even if the messages depend on the secret key, is necessary for IBE when updating the identity secret keys with the old ones. SO security, which requires that when the adversary corrupts some fraction of senders, the uncorrupted senders' messages still maintain privacy, is useful for IBE since that one user receives messages from many senders is a natural scenario. Although there is a KDM secure IBE scheme based on LWE constructed by Alperin-Sheriff and Peikert (PKC'12), and a SO secure IBE scheme based on LWE constructed by He et al. (IWSEC'15), those two schemes cannot achieve both of the security requirements at the same time.

Using a known lattice-based chosen plain-text secure encryption scheme and the Bonsai trees primitive, a identity-based encryption (IBE) scheme is proposed in this paper. A public matrices chosen rule that has been used in a known efficient lattice-based chosen ciphtertext secure encryption scheme is used in this paper to reduce the public key size and the message-to ciphtertext expanse factor. Under the hardness of the decision variant of the learning with errors (LWE) problem, we prove that the proposed IBE scheme is indistinguishable against the adaptive chosen identities and chosen-plaintext attack in the standard model. Since a new public key chosen rule is used in our design scheme, the public key size of the proposed scheme would be short. Moreover, the message-to-ciphtertext expanse factor of this scheme is also controlled efficiently which is nearly closed to that of Gentry's scheme. Due to the quantum intractability of the LWE problem on which the scheme is based, the proposed IBE scheme is secure even in quantum-era.

An efficient identity-based encryption (IBE) scheme over lattice is proposed in this paper. Under the hardness of the learning with errors (LWE) problem, the proposed scheme is semantic secure against adaptive chosen identity and chosen plaintext attack in the standard model. To improve the efficiency of the lattice-based IBE scheme, unlike the identity string is encoded into a matrix by a group of public matrices in several known constructions, the identity string of l bits is encoded into a vector with the help of l+1 vectors in this paper. With the help of this idea, we achieve the private key extraction of IBE scheme at the same lattice. Then, the public key of the proposed scheme only consists of one n×m matrix and l+1 vectors, compared with that the public keys of the known lattice-based IBE schemes all consist as a group of n×m matrices. Hence, the public key size of this scheme is shorter than that of the known constructions.

Deniable encryption is an intriguing scheme against the problem of information leakage caused by adversary coercion. Previously proposed deniable schemes cannot resist the attack of quantum computers and there are few implementations of these schemes. Aiming at this problem, a deniable encryption scheme based on learning with errors (LWE) and related implementations were proposed. The scheme can resist the quantum attack, and also can deny the plaintext to any fake plaintext, so that the sender can resist the adversary’s coercive attack. Firstly, by using the indistinguishability of the LWE problem, a subset with low density named “translucent set” was constructed in a uniform space. The “translucent set” was used to construct the ciphertexts of bits 0 and 1, which enabled one-way deniability of a single bit and reduced the error rate. Then, a plaintext coding method was proposed to realize two-way deniability of a single bit so that the sender could deny the original plaintext to any fake plaintext. The theoretical analyses were given to show the deniability, security (IND–CPA), correctness, complexity and ciphertext expansion rate of the scheme. Finally, the scheme was implemented by C++, and experiments had been done for the error rate, ciphertext expansion rate, encryption and decryption efficiency. The experimental results showed that the error rate and ciphertext expansion rate were consistent with the theoretical results. Compared with other deniable schemes based on the quadratic residual problem, the proposed scheme has obvious advantages in anti-quantum attack, efficiency and ciphertext expansion rate. Specifically, the encryption efficiency is improved by 70%, and the ciphertext expansion rate is reduced to 1/3 of above schemes.

Quantum computing is a significant threat to classical public-key cryptography. In strong "quantum access" security models, numerous symmetric-key cryptosystems are also vulnerable. We consider classical encryption in a model which grants the adversary quantum oracle access to encryption and decryption, but where the latter is restricted to non-adaptive (i.e., pre-challenge) queries only. We define this model formally using appropriate notions of ciphertext indistinguishability and semantic security (which are equivalent by standard arguments) and call it QCCA1 in analogy to the classical CCA1 security model. Using a bound on quantum random-access codes, we show that the standard PRF-based encryption schemes are QCCA1-secure when instantiated with quantum-secure primitives. We then revisit standard IND-CPA-secure Learning with Errors (LWE) encryption and show that leaking just one quantum decryption query (and no other queries or leakage of any kind) allows the adversary to recover the full secret key with constant success probability. In the classical setting, by contrast, recovering the key requires a linear number of decryption queries. The algorithm at the core of our attack is a (large-modulus version of) the well-known Bernstein-Vazirani algorithm. We emphasize that our results should not be interpreted as a weakness of these cryptosystems in their stated security setting (i.e., post-quantum chosen-plaintext secrecy). Rather, our results mean that, if these cryptosystems are exposed to chosen-ciphertext attacks (e.g., as a result of deployment in an inappropriate real-world setting) then quantum attacks are even more devastating than classical ones.

Our main result is a quantum public-key encryption scheme based on the Extrapolated Dihedral Coset problem (EDCP) which is equivalent, under quantum polynomial-time reductions, to the Learning With Errors (LWE) problem. For limited number of public keys (roughly linear in the security parameter), the proposed scheme is information-theoretically secure. For polynomial number of public keys, breaking the scheme is as hard as solving the LWE problem. The public keys in our scheme are quantum states of size

\tilde{O}(n)

qubits. The key generation and decryption algorithms require

\tilde{O}(n)

qubit operations while the encryption algorithm takes

O(1)

qubit operations.