We propose the first error-tolerant secure key leasing (SKL) for public-key encryption. As with SKL in prior works, our protocol consists of a lessor and lessee. In the protocol, the lessor encodes its secret key into quantum states and leases the key to the lessee. Then, the lessor can ask the lessee to return the secret key at a later point. The lessor is able to check whether the lessee has returned its key honestly. However, our protocol works even when the leased secret key is subject to noise. The lessee decrypts the ciphertext correctly, and the lessor verifies the return of the secret key correctly when the amount of error is below a certain threshold. Our improved protocol does not change the encoding of the secret key, and thus adds no overhead to the quantum information processing. Our most significant result is a framework to analyze the trade-off between robustness against error and security. We bridge the security of the error-tolerant SKL and that of the error-tolerant certified deletion with shortened codes, which is a relatively less explored concept in coding theory.
We propose the first error-tolerant secure key leasing (SKL) for public-key encryption. As with SKL in prior works, our protocol consists of a lessor and lessee. In the protocol, the lessor encodes its secret key into quantum states and leases the key to the lessee. Then, the lessor can ask the lessee to return the secret key at a later point. The lessor is able to check whether the lessee has returned its key honestly. However, our protocol works even when the leased secret key is subject to noise. The lessee decrypts the ciphertext correctly, and the lessor verifies the return of the secret key correctly when the amount of error is below a certain threshold. Our improved protocol does not change the encoding of the secret key, and thus adds no overhead to the quantum information processing. Our most significant result is a framework to analyze the trade-off between robustness against error and security. We bridge the security of the error-tolerant SKL and that of the error-tolerant certified deletion with shortened codes, which is a relatively less explored concept in coding theory.
It is well known that quantum computers, when fully realized, pose a threat to most cryptosystems deployed today. On the other hand, quantum information is also known to enhance classical cryptography, in terms of improved security and efficiency. Surprisingly, quantum information can also provide guarantees that are completely impossible to attain classically. The class of quantum cryptographic primitives called unclonable primitives fall into this category, with quantum money being a canonical example. Intuitively, quantum money allows a bank to distribute currency in the form of quantum states that provably resist counterfeiting due to the no-cloning theorem of quantum mechanics. This is in sharp contrast to classical information, for which there is no fundamental barrier that prevents its duplication. This work focusses on another up-and-coming unclonable primitive referred to as secure key leasing (SKL). This is a notion that allows to encode secret keys into a quantum state that can be temporarily leased. For example, it allows decryption keys of a public-key encryption scheme to be leased, enabling the recipient to decrypt ciphertexts while it possesses the quantum state. Later, the recipient can provide a proof of deletion which ensures that they have effectively ``lost'' access to the leased key. SKL is especially useful for software distributors that wish to provide trial period access. It allows them to provide access to their service via leased quantum keys, where they can incentivize timely deletion using a refund. In more detail, this dissertation studies SKL schemes in the setting of collusion, where multiple users can be leased independently generated quantum keys that provide access to the same underlying secret-key. It involves the study of meaningful notions of collusion-resistant security in this context, which are more realistic for real world applications than schemes secure in the standalone (single-key/single-user) setting. Then, new constructions are provided to realize these notions, with an emphasis on utilizing standard/well-understood cryptographic assumptions. Another major focus of the work is on providing modular approaches to constructing collusion-resistant SKL. In this light, novel compilers for different variants of the primitive are motivated and explored in detail.
Inspired by the no-cloning theorem in quantum theory, a variety of quantum cryptographic primitives with unclonable functionalities, such as secure key leasing and copy protection, have been proposed and attracted significant attention. However, trapdoor functions (TDFs), fundamental primitives in public-key cryptography, have not been extensively studied in these areas. In this work, we initiate a study of TDFs in both secure key leasing and copy protection settings. We first introduce the definition of TDFs with secure key leasing (TDF-SKL), which enables leasing and deleting of quantum trapdoors. We formalize TDF-SKL both with and without domain sampler, and give a construction of TDF-SKL without domain sampler based on the LWE assumption and a construction of TDF-SKL with domain sampler based on any standard PKE schemes combined with hinting pseudorandom generators [Koppula and Waters, CRYPTO 2019]. Next, we define TDFs with copy protection (TDF-CP), where the inversion functionality is copy protected by a quantum trapdoor. We establish a construction of TDF-CP assuming indistinguishability obfuscation and the LWE assumption, following a modular framework of copy protection proposed by Ananth and Behera [CRYPTO 2024]. We also present applications of TDF-SKL and TDF-CP. Existing constructions of public-key encryption with secure key leasing (PKE-SKL) and single-decryptor encryption (SDE) suffer from a critical vulnerability: quantum decryption keys may be destroyed after decrypting maliciously chosen ciphertexts. We construct PKE-SKL schemes and SDE schemes with robust quantum decryption keys that remain reusable after decrypting arbitrary ciphertexts from TDF-SKL and TDF-CP, respectively.
In the context of classical information, every message is composed of 0s and 1s; these messages can generally be copied at will. However, when quantum phenomena are used to model information, this guarantee no longer exists. This difference gives rise to a range of cryptographic possibilities when one considers encoding certain messages as quantum information. In our case, we analyze a potential benefit of encoding part of an encryption scheme’s ciphertext as quantum information. We call this type of ciphertext a quantum ciphertext. In particular, quantum ciphertexts are useful when one wants to be able to prove the deletion of the plaintext underlying a ciphertext. Since classical ciphertexts can be copied, clearly such feat is impossible using classical information alone. However, we show that quantum encodings allow such certified deletion. More precisely, we show that it is possible to encrypt classical data into a quantum ciphertext such that the recipient of the ciphertext can produce a classical string which proves to the originator that the recipient has relinquished any chance of recovering the plaintext, should the decryption key be revealed. Our scheme is feasible with current quantum technology: the honest parties only require quantum devices for single-qubit preparation and measurements, and the scheme is robust against noise in these devices. Furthermore, we provide a proof of security which requires only a finite amount of communication, and which therefore avoids the common technique of relying on the analysis of an asymptotic case.
We present the first construction of a computational Certified Deletion Property (CDP) achievable with classical communication, derived from the compilation of the non-local Magic Square Game (MSG). We leverage the KLVY compiler to transform the non-local MSG into a 2-round interactive protocol, rigorously demonstrating that this compilation preserves the game-specific CDP. Previously, the quantum value and rigidity of the compiled game were investigated. We emphasize that we are the first to investigate CDP (local randomness in [Fu and Miller, Phys. Rev. A 97, 032324 (2018)]) for the compiled game. Then, we combine this CDP with the framework [Kitagawa, Morimae, and Yamakawa, Eurocrypt 2025] to construct Secure Key Leasing with classical Lessor (cSKL). SKL enables the Lessor to lease the secret key to the Lessee and verify that a quantum Lessee has indeed deleted the key. In this paper, we realize cSKL for PKE, PRF, and digital signature. Compared to prior works for cSKL, we realize cSKL for PRF and digital signature for the first time. In addition, we succeed in weakening the assumption needed to construct cSKL.
Quantum public-key encryption (PKE), where public-keys and/or ciphertexts can be quantum states, is an important primitive in quantum cryptography. Unlike classical PKE (e.g., RSA or ECC), quantum PKE can leverage quantumsecure cryptographic assumptions or the principles of quantum mechanics for security. It has great potential in providing for secure cryptographic systems under potentially weaker assumptions than is possible classically. In addition, it is of both practical and theoretical interest, opening the door to novel cryptographic systems not possible with classical information alone. While multiple quantum PKE schemes have been proposed, they require a large number of qubits acting coherently, and are not practical on current noisy quantum devices. In this paper, we design a practical quantum PKE scheme, taking into account the constraints of current NISQ devices. Specifically, we design a PKE scheme with quantum-classical public keys and classical ciphertexts, that is noise-resilient and only requires a small number of qubits acting coherently. In addition, our design provides tradeoffs in terms of efficiency and the number of qubits that are required.
We consider error correction in quantum key distribu-tion. To avoid that Alice and Bob unwittingly end up with different keys precautions must be taken. Before running the error correction protocol, Bob and Al-ice normally sacrifice some bits to estimate the error rate. To reduce the probability that they end up with different keys to an acceptable level, we show that a large number of bits must be sacrificed. Instead, if Alice and Bob can make a good guess about the er-ror rate before the error correction, they can verify that their keys are similar after the error correction protocol. This verification can be done by utilizing properties of Low Density Parity Check codes used in the error correction. We compare the methods and show that by verification it is often possible to sac-rifice less bits without compromising security. The improvement is heavily dependent on the error rate and the block length, but for a key produced by the IdQuantique system Clavis2, the increase in the key rate is approximately 5 percent. We also show that for systems with large fluctuations in the error rate a combination of the two methods is optimal.