Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE

Quantum cryptography and authentication with low key-consumption

Aysajan Abidin, Christoph Pacher, Thomas Lorünser, Jan-Åke Larsson, Momtchil Peev

Published Oct 6, 2011• 3 citations
Publisher

Abstract

Quantum Key Distribution (QKD - also referred to as Quantum Cryptography) is a technique for secret key agreement. It has been shown that QKD rigged with Information-Theoretic Secure (ITS) authentication (using secret key) of the classical messages transmitted during the key distribution protocol is also ITS. Note, QKD without any authentication can trivially be broken by man-in-the-middle attacks. Here, we study an authentication method that was originally proposed because of its low key consumption; a two-step authentication that uses a publicly known hash function, followed by a secret strongly universal2 hash function, which is exchanged each round. This two-step authentication is not information-theoretically secure but it was argued that nevertheless it does not compromise the security of QKD. In the current contribution we study intrinsic weaknesses of this approach under the common assumption that the QKD adversary has access to unlimited resources including quantum memories. We consider one implementation of Quantum Cryptographic protocols that use such authentication and demonstrate an attack that fully extract the secret key. Even including the final key from the protocol in the authentication does not rule out the possibility of these attacks. To rectify the situation, we propose a countermeasure that, while not information-theoretically secure, restores the need for very large computing power for the attack to work. Finally, we specify conditions that must be satisfied by the two-step authentication in order to restore information-theoretic security.

DOI
10.1117/12.898344

Related papers

Authentication in Quantum Key Distribution : Security Proof and Universal Hash Functions

Aysajan Abidin

Quantum Key Distribution (QKD) is a secret key agreement technique that consists of two parts: quantum transmission and measurement on a quantum channel, and classical post-processing on a public communication channel. It enjoys provable unconditional security provided that the public communication channel is immutable. Otherwise, QKD is vulnerable to a man-in-the-middle attack. Immutable public communication channels, however, do not exist in practice. So we need to use authentication that implements the properties of an immutable channel as well as possible. One scheme that serves this purpose well is the Wegman-Carter authentication (WCA), which is built upon Almost Strongly Universal2 (ASU2) hashing. This scheme uses a new key in each authentication attempt to select a hash function from an ASU2 family, which is then used to generate the authentication tag for a message. The main focus of this dissertation is on authentication in the context of QKD. We study ASU2 hash functions, security of QKD that employs a computationally secure authentication, and also security of authentication with a partially known key. Specifically, we study the following. First, Universal hash functions and their constructions are reviewed, and as well as a new construction of ASU2 hash functions is presented. Second, security of QKD that employs a specific computationally secure authentication is studied. We present detailed attacks on various practical implementations of QKD that employs this authentication. We also provide countermeasures and prove necessary and sufficient conditions for upgrading the security of the authentication to the level of unconditional security. Third, Universal hash function based multiple authentication is studied. This uses a fixed ASU2 hash function followed by one-time pad encryption, to keep the hash function secret. We show that the one-time pad is necessary in every round for the authentication to be unconditionally secure. Lastly, we study security of the WCA scheme, in the case of a partially known authentication key. Here we prove tight information-theoretic security bounds and also analyse security using witness indistinguishability as used in the Universal Composability framework.

•Jan 1, 2013•17 citations

Weaknesses of Authentication in Quantum Cryptography and Strongly Universal Hash Functions

Aysajan Abidin

Authentication is an indispensable part of Quantum Cryptography, which is an unconditionally secure key distribution technique based on the laws of nature. Without proper authentication, Quantum Cryptography is vulnerable to “man-in-the-middle” attacks. Therefore, to guarantee unconditional security of any Quantum Cryptographic protocols, the authentication used must also be unconditionally secure. The standard in Quantum Cryptography is to use theWegman-Carter authentication, which is unconditionally secure and is based on the idea of universal hashing. In this thesis, we first investigate properties of a Strongly Universal hash function family to facilitate understanding the properties of (classical) authentication used in Quantum Cryptography. Then, we study vulnerabilities of a recently proposed authentication protocol intended to rule out a "man-in-the-middle" attack on Quantum Cryptography. Here, we point out that the proposed authentication primitive is not secure when used in a generic Quantum Cryptographic protocol. Lastly, we estimate the lifetime of authentication using encrypted tags when the encryption key is partially known. Under simplifying assumptions, we derive that the lifetime is linearly dependent on the length of the authentication key. Experimental results that support the theoretical results are also presented.

•Jan 1, 2010•5 citations

Security of Authentication with a Fixed Key in Quantum Key Distribution

Aysajan Abidin, Jan-Åke Larsson

We study the security of a specific authentication procedure of interest in the context of Quantum Key Distribution (QKD). It works as follows: use a secret but fixed Strongly Universal$_2$ (SU$_2$) hash function and encrypt the output tag with a one-time pad (OTP). If the OTP is completely secret, the expected time for an adversary to create a tag for a chosen message is exponential in the tag length. If, however, the OTP is partially known in each authentication round, as is the case in practical QKD protocols, then the picture is different; the adversary's partial knowledge of the OTP in each authentication round gives partial information on the secret hash function, and this weakens the authentication in later rounds. The effect of this is that the lifetime of the system is linear in the length of the fixed key. This is supported by the composability theorem for QKD, that in this setting provides an upper bound to the security loss on the secret hash function, which is exponential in the number of authentication rounds. This needs to be taken into account when using the protocol, since the authentication gets weakened at each subsequent round and thus the QKD generated is key is not as strong as when the authentication is strong. Some countermeasures are discussed at the end of this paper.

arXiv:1109.5168•Sep 23, 2011•10 citations

Unconditionally Secure Authentication in Quantum Key Distribution

Sufyan T. F. Al-Janabi

Quantum key distribution (QKD) is a method using some properties of quantum mechanics to create a secret shared cryptographic key even if an eavesdropper has access to unlimited computational power. All QKD protocols require that the parties have access to an authentic channel. Otherwise, QKD is vulnerable to man-in-the-middle attacks. This paper studies QKD from this point of view, emphasizing the necessity and sufficiency of using unconditionally secure authentication in QKD. In this work, a new technique of using unconditionally secure authentication is proposed for quantum cryptosystems. This technique is based on a hybrid of normal application of authentication codes and the so-called “counter-based” authentication method such that to achieve a better trade-off between security and efficiency (in terms of the required size of initially shared secret data). Based on this strategy, an authenticated version of a typical QKD protocol (the well-known BB84 protocol) is described. Some advantages of our protocol in comparison to other proposals are also highlighted.

i-manager’s Journal on Software Engineering•Mar 15, 2007•4 citations

A new secure model for quantum key distribution protocol

Rishi Dutt Sharma, Асок Де

All Classical cryptographic methods used in our life based on mathematical ideas & computational assumption are actually unsafe, so quantum cryptography is proposed nowadays Quantum key distribution (QKD) promises secure key agreement by using quantum mechanical systems. QKD will be an important part of future cryptographic infrastructures. It can provide long-term confidentiality for encrypted information without reliance on computational assumptions. Although QKD still requires authentication to prevent man-in-the-middle attacks. Firstly, In this paper At quantum key distribution protocol process is introduced. Secondly, several improvements to the basic steps of two references are reviewed because of its defects, mainly about identity authentication in order to prevent communication partners' counterfeit, including errors removing, estimating Attacker's information, secrecy enhancement, etc. At last, based upon original improvements reserved selectively, the whole process of quantum key distribution protocol after improvement & then comparison is introduced in detail.

IEEE International Conference on Industrial and Information Systems (ICIIS)•Aug 1, 2011•13 citations

The Case for Quantum Key Distribution

Quantum key distribution (QKD) promises secure key agreement by using quantum mechanical systems. We argue that QKD will be an important part of future cryptographic infrastructures. It can provide long-term confidentiality for encrypted information without reliance on computational assumptions. Although QKD still requires authentication to prevent man-in-the-middle attacks, it can make use of either information-theoretically secure symmetric key authentication or computationally secure public key authentication: even when using public key authentication, we argue that QKD still offers stronger security than classical key agreement. 1

•Jan 1, 2009•0 citations
Quantum Key Distribution (QKD - also referred to as Quantum Cryptography) is a technique for secret key agreement. It has been shown that QKD rigged with Information-Theoretic Secure (ITS) authentication (using secret key) of the classical messages transmitted during the key distribution protocol is also ITS. Note, QKD without any authentication can trivially be broken by man-in-the-middle attacks. Here, we study an authentication method that was originally proposed because of its low key consumption; a two-step authentication that uses a publicly known hash function, followed by a secret strongly universal2 hash function, which is exchanged each round. This two-step authentication is not information-theoretically secure but it was argued that nevertheless it does not compromise the security of QKD. In the current contribution we study intrinsic weaknesses of this approach under the common assumption that the QKD adversary has access to unlimited resources including quantum memories. We consider one implementation of Quantum Cryptographic protocols that use such authentication and demonstrate an attack that fully extract the secret key. Even including the final key from the protocol in the authentication does not rule out the possibility of these attacks. To rectify the situation, we propose a countermeasure that, while not information-theoretically secure, restores the need for very large computing power for the attack to work. Finally, we specify conditions that must be satisfied by the two-step authentication in order to restore information-theoretic security.
Quantum Key Distribution (QKD) is a secret key agreement technique that consists of two parts: quantum transmission and measurement on a quantum channel, and classical post-processing on a public communication channel. It enjoys provable unconditional security provided that the public communication channel is immutable. Otherwise, QKD is vulnerable to a man-in-the-middle attack. Immutable public communication channels, however, do not exist in practice. So we need to use authentication that implements the properties of an immutable channel as well as possible. One scheme that serves this purpose well is the Wegman-Carter authentication (WCA), which is built upon Almost Strongly Universal2 (ASU2) hashing. This scheme uses a new key in each authentication attempt to select a hash function from an ASU2 family, which is then used to generate the authentication tag for a message. The main focus of this dissertation is on authentication in the context of QKD. We study ASU2 hash functions, security of QKD that employs a computationally secure authentication, and also security of authentication with a partially known key. Specifically, we study the following. First, Universal hash functions and their constructions are reviewed, and as well as a new construction of ASU2 hash functions is presented. Second, security of QKD that employs a specific computationally secure authentication is studied. We present detailed attacks on various practical implementations of QKD that employs this authentication. We also provide countermeasures and prove necessary and sufficient conditions for upgrading the security of the authentication to the level of unconditional security. Third, Universal hash function based multiple authentication is studied. This uses a fixed ASU2 hash function followed by one-time pad encryption, to keep the hash function secret. We show that the one-time pad is necessary in every round for the authentication to be unconditionally secure. Lastly, we study security of the WCA scheme, in the case of a partially known authentication key. Here we prove tight information-theoretic security bounds and also analyse security using witness indistinguishability as used in the Universal Composability framework.
Authentication is an indispensable part of Quantum Cryptography, which is an unconditionally secure key distribution technique based on the laws of nature. Without proper authentication, Quantum Cryptography is vulnerable to “man-in-the-middle” attacks. Therefore, to guarantee unconditional security of any Quantum Cryptographic protocols, the authentication used must also be unconditionally secure. The standard in Quantum Cryptography is to use theWegman-Carter authentication, which is unconditionally secure and is based on the idea of universal hashing. In this thesis, we first investigate properties of a Strongly Universal hash function family to facilitate understanding the properties of (classical) authentication used in Quantum Cryptography. Then, we study vulnerabilities of a recently proposed authentication protocol intended to rule out a "man-in-the-middle" attack on Quantum Cryptography. Here, we point out that the proposed authentication primitive is not secure when used in a generic Quantum Cryptographic protocol. Lastly, we estimate the lifetime of authentication using encrypted tags when the encryption key is partially known. Under simplifying assumptions, we derive that the lifetime is linearly dependent on the length of the authentication key. Experimental results that support the theoretical results are also presented.
We study the security of a specific authentication procedure of interest in the context of Quantum Key Distribution (QKD). It works as follows: use a secret but fixed Strongly Universal2_22​ (SU2_22​) hash function and encrypt the output tag with a one-time pad (OTP). If the OTP is completely secret, the expected time for an adversary to create a tag for a chosen message is exponential in the tag length. If, however, the OTP is partially known in each authentication round, as is the case in practical QKD protocols, then the picture is different; the adversary's partial knowledge of the OTP in each authentication round gives partial information on the secret hash function, and this weakens the authentication in later rounds. The effect of this is that the lifetime of the system is linear in the length of the fixed key. This is supported by the composability theorem for QKD, that in this setting provides an upper bound to the security loss on the secret hash function, which is exponential in the number of authentication rounds. This needs to be taken into account when using the protocol, since the authentication gets weakened at each subsequent round and thus the QKD generated is key is not as strong as when the authentication is strong. Some countermeasures are discussed at the end of this paper.
Quantum key distribution (QKD) is a method using some properties of quantum mechanics to create a secret shared cryptographic key even if an eavesdropper has access to unlimited computational power. All QKD protocols require that the parties have access to an authentic channel. Otherwise, QKD is vulnerable to man-in-the-middle attacks. This paper studies QKD from this point of view, emphasizing the necessity and sufficiency of using unconditionally secure authentication in QKD. In this work, a new technique of using unconditionally secure authentication is proposed for quantum cryptosystems. This technique is based on a hybrid of normal application of authentication codes and the so-called “counter-based” authentication method such that to achieve a better trade-off between security and efficiency (in terms of the required size of initially shared secret data). Based on this strategy, an authenticated version of a typical QKD protocol (the well-known BB84 protocol) is described. Some advantages of our protocol in comparison to other proposals are also highlighted.
All Classical cryptographic methods used in our life based on mathematical ideas & computational assumption are actually unsafe, so quantum cryptography is proposed nowadays Quantum key distribution (QKD) promises secure key agreement by using quantum mechanical systems. QKD will be an important part of future cryptographic infrastructures. It can provide long-term confidentiality for encrypted information without reliance on computational assumptions. Although QKD still requires authentication to prevent man-in-the-middle attacks. Firstly, In this paper At quantum key distribution protocol process is introduced. Secondly, several improvements to the basic steps of two references are reviewed because of its defects, mainly about identity authentication in order to prevent communication partners' counterfeit, including errors removing, estimating Attacker's information, secrecy enhancement, etc. At last, based upon original improvements reserved selectively, the whole process of quantum key distribution protocol after improvement & then comparison is introduced in detail.
Quantum key distribution (QKD) promises secure key agreement by using quantum mechanical systems. We argue that QKD will be an important part of future cryptographic infrastructures. It can provide long-term confidentiality for encrypted information without reliance on computational assumptions. Although QKD still requires authentication to prevent man-in-the-middle attacks, it can make use of either information-theoretically secure symmetric key authentication or computationally secure public key authentication: even when using public key authentication, we argue that QKD still offers stronger security than classical key agreement. 1