Uncloneable encryption is a cryptographic primitive which encrypts a classical message into a quantum ciphertext, such that two quantum adversaries are limited in their capacity of being able to simultaneously decrypt, given the key and quantum side-information produced from the ciphertext. Since its initial proposal and scheme in the random oracle model by Broadbent and Lord [TQC 2020], uncloneable encryption has developed into an important primitive at the foundation of quantum uncloneability for cryptographic primitives. Despite sustained efforts, however, the question of unconditional uncloneable encryption (and in particular of the simplest case, called an uncloneable bit) has remained elusive. Here, we propose a candidate for the unconditional uncloneable bit problem, and provide strong evidence that the adversary's success probability in the related security game converges quadratically as 1 / 2 + 1 / ( 2 K ) , where K represents the number of keys and 1 / 2 is trivially achievable. We prove this bound's validity for K ranging from 2 to 7 and demonstrate the validity up to K = 17 using computations based on the NPA hierarchy. We furthemore provide compelling heuristic evidence towards the general case. In addition, we prove an asymptotic upper bound of 5 / 8 and give a numerical upper bound of ∼ 0.5980 , which to our knowledge is the best-known value in the unconditional model.
Uncloneable encryption is a cryptographic primitive which encrypts a classical message into a quantum ciphertext, such that two quantum adversaries are limited in their capacity of being able to simultaneously decrypt, given the key and quantum side-information produced from the ciphertext. Since its initial proposal and scheme in the random oracle model by Broadbent and Lord [TQC 2020], uncloneable encryption has developed into an important primitive at the foundation of quantum uncloneability for cryptographic primitives. Despite sustained efforts, however, the question of unconditional uncloneable encryption (and in particular of the simplest case, called an uncloneable bit) has remained elusive. Here, we propose a candidate for the unconditional uncloneable bit problem, and provide strong evidence that the adversary's success probability in the related security game converges quadratically as 1 / 2 + 1 / ( 2 K ) , where K represents the number of keys and 1 / 2 is trivially achievable. We prove this bound's validity for K ranging from 2 to 7 and demonstrate the validity up to K = 17 using computations based on the NPA hierarchy. We furthemore provide compelling heuristic evidence towards the general case. In addition, we prove an asymptotic upper bound of 5 / 8 and give a numerical upper bound of ∼ 0.5980 , which to our knowledge is the best-known value in the unconditional model.
We establish quantum uncloneable encryption with unconditional security, preventing two non-communicating adversaries from simultaneously decrypting a single ciphertext − even when both are given the key. Our construction achieves security that approaches the ideal limit at a rate that is exponentially small in the security parameter, without employing any assumptions. Our proof invokes unitary invariance of the shared entangled state and simplifies the adversarial strategies by enforcing this symmetry. Crucially, it then rules out the sender being highly correlated with two non-communicating adversaries at once by an approximation property that we develop, for such unitarily invariant states, which yields a near-optimal bound on the probability of cloning. Consequently, no coordinated strategy beats random guessing of the encrypted bit, establishing unconditional uncloneability. This reveals the existence of an uncloneable bit in Nature and delineates a fundamental, physically enforced cryptographic primitive unavailable in classical settings.
We give an unconditional construction of information-theoretically secure one-time private-key unclonable encryption for one-bit messages, with efficient encryption and decryption and exponentially small unclonable-indistinguishability advantage. Previous work by Bhattacharyya and Culf (Nature Physics, 2026) and Bhattacharyya, Broadbent, and Culf (arXiv:2603.08916) either only showed inverse-polynomial security loss or required inefficient encryption/decryption operations; we avoid both of these caveats.
Our scheme's key is a uniformly random non-identity phase-free Pauli on n qubits, and bit a is encrypted as a random (−1)a eigenstate of that Pauli. We prove that the probability that both receivers recover the bit is at most 1/2+O(2−n/2). By a lower bound due to Broadbent, Culf, and Rochette (arXiv:2510.00903), this is the best probability bound achievable with n-qubit ciphertexts while ensuring perfect correctness (up to the constant hidden in the O(⋅)).
The unclonable bit question asks whether quantum encryption can prevent an adversary from producing two systems that both reveal the plaintext once the key is disclosed. We introduce and study Pauli Encodings, a simple class of one-bit encryption schemes whose ciphertexts are normalized eigenspace projectors of Pauli strings. For every Pauli Encoding with K Pauli strings, we prove a universal lower bound 1/2+1/(2K) on the optimal monogamy-of-entanglement winning probability, together with sharper bounds for several structured families. We then establish two limitations of natural approaches to unclonable security. First, if the Pauli strings are restricted to strings of X and Z of length n, the encoding is not secure. Second, we identify a universal 3/4 obstruction showing that arguments based only on pairwise guessing marginals cannot establish unclonable-indistinguishable security. When the Pauli strings all pairwise anticommute, the protocol becomes the one studied in [Quantum 10, 2157 (2026)]. We exploit the symmetry of this protocol to solve the third level of the natural semidefinite programming relaxation obtaining an asymptotic upper bound of approximately 0.5556 on the winning probability. Finally, we prove strong unclonable-indistinguishable security against bounded-local-dimension adversaries and strong indistinguishability security for several efficient Pauli families. First-level NPA computations provide additional numerical evidence towards the strong unclonable-indistinguishable security.
Uncloneable encryption, first introduced by Broadbent and Lord (TQC 2020) is a quantum encryption scheme in which a quantum ciphertext cannot be distributed between two non-communicating parties such that, given access to the decryption key, both parties cannot learn the underlying plaintext. In this work, we introduce a variant of uncloneable encryption in which several possible decryption keys can decrypt a particular encryption, and the security requirement is that two parties who receive independently generated decryption keys cannot both learn the underlying ciphertext. We show that this variant of uncloneable encryption can be achieved device-independently, i.e., without trusting the quantum states and measurements used in the scheme, and that this variant works just as well as the original definition in constructing quantum money. Moreover, we show that a simple modification of our scheme yields a single-decryptor encryption scheme, which was a related notion introduced by Georgiou and Zhandry. In particular, the resulting single-decryptor encryption scheme achieves device-independent security with respect to a standard definition of security against random plaintexts. Finally, we derive an ``extractor'' result for a two-adversary scenario, which in particular yields a single-decryptor encryption scheme for single bit-messages that achieves perfect anti-piracy security without needing the quantum random oracle model.
One of the key distinctions between classical and quantum information is given by the no-cloning theorem: unlike bits, arbitrary qubits cannot be perfectly copied. This fact has been the inspiration for many quantum cryptographic protocols. In this thesis, we introduce a new cryptographic functionality called uncloneable encryption. This functionality allows the encryption of a classical message such that two collaborating but non-communicating adversaries may not both simultaneously recover the message, even when the encryption key is revealed. We achieve this functionality by using Wiesner’s conjugate coding scheme to encrypt the message. We show that the adversaries cannot both obtain all the necessary information for the correct decryption with high probability. Quantum-secure pseudorandom functions, modelled as random oracles, are then used to ensure that any partial information that the adversaries obtain does not give them an advantage in recovering the message.
We give, to our knowledge, the first plain-model, one-time information-theoretically secure, efficient unclonable encryption scheme for one classical bit. Previous work by Bhattacharyya and Culf (Nature Physics, 2026) and Bhattacharyya, Broadbent, and Culf either only showed 1/poly(λ) security loss or required inefficient encryption/decryption operations. We avoid both of these caveats; in doing so, we obtain (to our knowledge) the first plain-model construction of many-time secure 1→2 unclonable encryption for arbitrary polynomial-length messages, assuming the existence of pseudorandom function-like states (Bartusek and Goldin).
The key is a uniformly random non-identity phase-free Pauli on n qubits, and bit a is encrypted as a random (−1)a eigenstate of that Pauli. The scheme is exponentially secure; we prove that the probability that both receivers recover the bit is at most 21+212n/(4n−1)=21+O(2−n/2). By a lower bound due to Broadbent, Culf, and Rochette, this is the best probability bound achievable with n-qubit ciphertexts (up to the constant hidden in the O(⋅)).
The main conceptual idea is to leverage, in a precise spectral sense, the balanced commutation-anticommutation structure of the Pauli group. The proof is intricate but completely elementary and makes use of standard spectral bound techniques. The main technical workhorse is a standalone linear-algebraic lemma that informally relates the positivity of two different operators, each capturing the intuition that if the two receivers can individually decrypt unusually often then they must also disagree often.
GPT-5.6 Sol Ultra found this proof in an extended conversation with the author and drafted a preliminary version of this paper. The author is fully accountable for the correctness of this paper.