A vendor has several secrets which he regards as of equal worth and importance. He is willing to sell any of these secrets to a buyer. The bargain is said to be secure when the following two conditions are satisfied: 1) the buyer can only obtain one secret if he pays for only one secret, and 2) the vendor will not be able to find out which secret the buyer picked. This cryptographic problem is customarily called all-or-nothing disclosure of secrets (ANDOS). Previous ANDOS schemes have a few defects: neither the number of the secrets is restricted within narrow limits, nor the security is desirable. In this paper, we propose two new and novel ANDOS protocols in quantum computing environment. The first protocol is shown to be as secure as a classical one. The second protocol is based on unambiguous state discrimination, which is proven to be secure in quantum world. Moreover, all our schemes have no limitation on the number of the secrets to be sold.
A vendor has several secrets which he regards as of equal worth and importance. He is willing to sell any of these secrets to a buyer. The bargain is said to be secure when the following two conditions are satisfied: 1) the buyer can only obtain one secret if he pays for only one secret, and 2) the vendor will not be able to find out which secret the buyer picked. This cryptographic problem is customarily called all-or-nothing disclosure of secrets (ANDOS). Previous ANDOS schemes have a few defects: neither the number of the secrets is restricted within narrow limits, nor the security is desirable. In this paper, we propose two new and novel ANDOS protocols in quantum computing environment. The first protocol is shown to be as secure as a classical one. The second protocol is based on unambiguous state discrimination, which is proven to be secure in quantum world. Moreover, all our schemes have no limitation on the number of the secrets to be sold.
Secure two-party protocols are of significant research and application value. All-or-Nothing Disclosure of Secrets (ANDOS) is such a kind of cryptographic task. It involves two parties, a vendor and a buyer. The vendor, say Alice, who disposes of several secrets and is willing to sell any of them to the buyer, say Bob, with the guarantee that no information about the other secrets will be obtained. Furthermore, Bob can freely choose his secret and wants to ensure that Alice can obtain on information about which of her secrets he has picked. In this paper, we present a new quantum ANDOS scheme which achieves the same functionality, but which is of unconditional security.
Based on quantum uncertainty and quantum entanglement, an quantum allor-nothing oblivious transfer protocol is proposed. It is illustrated in detail that the protocol is unconditionally secure. The distinct merit of the present protocol lies in that it is not based on quantum bit commitment. The full utilization of the entanglement makes the protocol different from previous insecure ones, thus its security is not restricted by the no-go theorem of twoparty secure computations. Typeset using REVTEX 1 The research on the oblivious transfer (OT) problem may be traced back to more than twenty years ago [1,2]. Kilian [3] pointed out later that OT is very important in two-party and multi-party protocols. This is because in most symmetrical protocols, the participants always know each others ’ data. If some participants are dishonest or try to get extra information, the protocols become insecure. OT can create some secret between the participants and break this symmetry. Thus it can be used to implement multi-party protocols such as
We call quantum security the area of IT security dealing with scenarios where one or more parties have access to quantum hardware. This encompasses both the fields of post-quantum cryptography (that is, traditional cryptography engineered to be resistant against quantum adversaries), and quantum cryptography (that is, security protocols designed to be natively run on a quantum infrastructure, such as quantum key distribution). Moreover, there exist also hybrid models, where traditional cryptographic schemes are somehow `mixed' with quantum operations in certain scenarios. Even if a fully-fledged, scalable quantum computer has yet to be built, recent results and the pace of research in its realization call for attention, lest we suddenly find ourselves one day with an obsolete security infrastructure. For this reason, in the last two decades research in quantum security has experienced an exponential growth in interest and investments. In this work, we propose the first systematic classification of quantum security scenarios, and for each of them we recall the main tools and results, as well as presenting new ones. We achieve this goal by identifying four distinct quantum security classes, or domains, each of them encompassing the security notions and constructions related to a particular scenario. We start with the class QS0, which is `classical cryptography' (meaning that no quantum scenario is considered), where we present some classical constructions and results as a preliminary step. Regarding post-quantum cryptography, we introduce the class QS1, where we discuss in detail the problems arising when designing a classical cryptographic object meant to be resistant against adversaries with local quantum computing power, and we provide a classification of the possible quantum security reductions in this scenario when considering provable security. Moreover, we present results about the quantum security and insecurity of the Fiat-Shamir transformation (a useful tool used to turn interactive identification schemes into digital signatures), and ORAMs (protocols used to outsource a database in a private way). In respect to hybrid classical-quantum models, in the security class QS2 we discuss in detail the possible scenarios where these scenarios arise, and what a correct formalization should be in terms of quantum oracle access. We also provide a novel framework for the quantum security (both in terms of indistinguishability and semantic security) of secret-key encryption schemes, and we give explicit secure constructions, as well as impossibility results. Finally, in the class QS3 we consider all those cryptographic constructions designed to run natively on quantum hardware. We give constructions for quantum encryption schemes (both in the secret- and public-key scenario), and we introduce transformations for obtaining such schemes by conceptually simpler schemes from the class QS2. Moreover, we introduce a quantum version of ORAM, called quantum ORAM (QORAM), aimed at outsourcing in a private way a database composed of quantum data. In proposing a suitable security model and an explicit construction for QORAMs, we also introduce a technique of independent interest which models a quantum adversary able to extract information from a quantum system without disturbing it `too much'. We believe that the framework we introduce in this work will be a valuable tool for the scientific community in addressing the challenges arising when formalizing sound constructions and notions of security in the quantum world.
Currently, theoretical and experimental work in the field of quantum cryptography is being carried out in many research centers around the world. Over the past two decades since the start of active research, many quantum cryptographic protocols have been proposed, a significant number of laboratory experiments have been performed on their practical implementation, important work has been done to prove the resistance of the proposed protocols to certain types of attacks, and the first commercial quantum key distribution systems have been developed. However, there are still many tasks and problems in the field of quantum cryptography, the solution of which is of great scientific and technical importance. So, in particular, such a promising direction as quantum protocols for direct secure communication requires further development, allowing, under certain conditions, to transfer secret information without encryption, both between two and between a large number of users. Currently, such protocols have been developed using two-and three-particle entangled states, but there are almost no similar protocols with entangled states of a larger number of qubits that do not require large quantum memory for their implementation and, at the same time, have a large information capacity. Therefore, the development of new quantum direct secure communication protocols with increased information capacity, the analysis of their resistance to attacks, as well as the determination of the best protocols according to the criteria of resistance and information capacity.
The security of digital goods buyers and sellers is unbalanced. Of course, the property of sellers is protected; for example, when customers acquire digital books or films from Internet's merchants, they only receive the products they have paid for. Unfortunately, the buyers' privacy is rarely respected: purchases are often — without the buyers' knowledge — monitored, recorded, analysed, and sometimes sold to marketing companies. As a consequence, even if the customers do not intend to acquire additional products, their computer screens are later invaded with targeted advertisements. The main purpose of this thesis is to propose some methods to restore the balance and guarantee the buyers' privacy, while protecting the interests of the sellers. To this end, it is worth looking into the area of cryptography and more specifically, it is worth studying and designing some protocols called distributed oblivious transfer (DOT) protocols. A DOT protocol allows a party A to obtain one of the secret pieces of information (a secret for short) held by a party B so that the following two fundamental conditions are satisfied: • A chooses the secrets she wishes to obtain and does not obtain anything on the secrets she has not chosen, • B does not learn which secret was obtained by A. Furthermore, to improve the availability of the information, the protocol is distributed. That is, the party B transmits his secret information to m servers and the party A needs to contact at least k of these servers to obtain the chosen secret. The servers are not fully trusted, neither by A, nor by B. Therefore, from the information exchanged with A and B, no coalition of servers should be able to learn the secrets of B or the choice of A. The results of a preliminary literature review are surprising. In fact, the number of publications on DOT protocols is small (fewer than 20) compared to, for example, the number of publications on a similar concept, secret sharing (100s of publications). And yet, oblivious transfer is a fundamental component of more complex cryptographic protocols such as multi-party computation protocols, which allow a group of participants to securely calculate any function of their joint secret inputs. So, one could expect many variants, for example of the original DOT protocol introduced in 2002 by Naor and Pinkas [74], to fulfil the requirements of specific scenarios. The design of variants of DOT protocols in traditional cryptography has been the guiding thread of my research. My contribution mainly consists in (a) a critical analysis of the existing protocols, demonstrating their limitations, weaknesses, and in some cases, flaws; and (b) the design of the following protocols,well adapted to some specific situations: A Strongly Secure DOT Protocol. This DOT protocol addresses the most important weakness of unconditionally secure, one-round, polynomial interpolation-based DOT protocols: after the protocol has been executed, if the party A corrupts only one server, she can learn all the secrets of the party B. The protocol is secure even if A corrupts up to k - 1 servers. A Verifiable DOT Protocol. The party A should obtain the secret she has chosen, even when some servers are controlled by a malicious adversary whose objective is to sabotage the protocol. This is the case with this protocol, assuming that the adversary cannot control more than k - 1 servers. A Multiple Secrets DOT Protocol. When the party A wishes to obtain n > 1 secrets, the current protocols have to be executed n times. In this context, they are inefficient. The DOT protocol introduced here allows the party A, by contacting in the same session k - 1 + n servers, to collect n secrets. Adaptive DOT Protocols. The previous protocol allows the party A to request several secrets. However, the request of one secret may depend on the values of secrets already obtained. Two efficient protocols are presented in this scenario. The first one allows A to receive a limited number of secrets and therefore, is well adapted to a single receiver. For several receivers, a second protocol is proposed. This second protocol accepts an unlimited number of queries, but requires communications amongst the servers. A Threshold DOT protocol. Most existing DOT protocols rely on threshold secret sharing schemes. In a k-threshold protocol or scheme, security is guaranteed not only when k parties are contacted, but also when more than k parties are contacted. However, the existing DOT protocols based on k-threshold secret sharing schemes require an additional mechanism to control that exactly k servers are contacted, which is an under-utilisation of the underlying functionality. The proposed protocol is the first k-threshold DOT protocol which allows the party A to contact as many servers as she wishes to obtain the chosen secret, provided that at least k servers are contacted. This research is limited to unconditionally secure protocols, i.e., protocols whose security does not depend on mathematical (unproven) assumptions; within the limits of the given security models, the protocols are secure even against an adversary with unlimited computing power and time. In brief, the results presented in this thesis are a significant advance to the state of the art research on DOT protocols because on one hand, they point out the weaknesses of the DOT protocols most commonly accepted by the cryptographic community and on the other hand, they contribute to the cryptographic field through the design of new protocols, secure and efficient.
Recently, Yang et al. proposed a kind of quantum cryptographic schemes based on secret sharing. The main idea is drawn from the case, where any n participants who share a secret K can co-operate as K does. This process can be applied to encryption, authentication, signature and so on. Unfortunately, since there is no identity authentication of the share’s holder, these schemes inherit the limitation of secret sharing in practice. If some participants do not follow the protocol, the protocol would be a failure at last. Moreover, these schemes encounter another serious attack. Any two participants can co-operate to defeat the schemes by sending different shares to the parties unknown to the distributor of the secret K, such that these parties can execute the protocol as well. The attack proves that it is not enough for quantum cryptographic schemes that only the secret key is secure.