In this thesis, we present several results along two different lines of research. The first part concerns the study of position-based quantum cryptography, a topic in quantum cryptography. By combining quantum mechanics with special relativity theory, new cryptographic tasks can be developed that use the causality constraints of relativity theory in a constructive way. Position-based cryptography is a type of cryptography that wants to use location as a credential, instead of (or in addition to) a secret key – for instance to create a protocol to send messages that can only be read at one specific location. In the second part we introduce a new notion of computation, catalytic computation, and study this new model within complexity theory. Catalytic computation is a computation that has a small amount of clean space available and is equipped with additional auxiliary space, with the caveat that the additional space is initially in an arbitrary, possibly incompressible, state and must be returned to this state when the computation is finished. The term ‘catalytic’ comes from chemistry, where it refers to a reactant which speeds up a chemical reaction but is not consumed – just like the extra space available to the computation.
In this thesis, we present several results along two different lines of research. The first part concerns the study of position-based quantum cryptography, a topic in quantum cryptography. By combining quantum mechanics with special relativity theory, new cryptographic tasks can be developed that use the causality constraints of relativity theory in a constructive way. Position-based cryptography is a type of cryptography that wants to use location as a credential, instead of (or in addition to) a secret key – for instance to create a protocol to send messages that can only be read at one specific location. In the second part we introduce a new notion of computation, catalytic computation, and study this new model within complexity theory. Catalytic computation is a computation that has a small amount of clean space available and is equipped with additional auxiliary space, with the caveat that the additional space is initially in an arbitrary, possibly incompressible, state and must be returned to this state when the computation is finished. The term ‘catalytic’ comes from chemistry, where it refers to a reactant which speeds up a chemical reaction but is not consumed – just like the extra space available to the computation.
Quantum mechanics, which describes the behaviour of matter and energy on very small scales, is one of the most successful theories in the history of science. Einstein's theory of special relativity, which describes the relationship between space and time, is likewise a highly successful and widely accepted theory. And yet there is a well-documented tension between the two theories, to the extent that it is still not clear that the two can ever be reconciled. This thesis is concerned with furthering the current understanding of the relationship between quantum mechanics and special relativity. In the first part of the thesis we study the behaviour of quantum information in relativistic spacetime. The field of quantum information arose from the realisation that quantum information has a number of crucial properties that distinguish it from classical information, such as the no-cloning property, quantum contextuality, and quantum discord. More recently, it has been realised that placing quantum information under relativistic constraints leads to the emergence of further unique features which are not exhibited by either non-relativistic quantum information or relativistic classical information; as part of this ongoing research programme we develop a new relativistic quantum `paradox' which puts pressure on conventional views about the spatiotemporal persistence of quantum states over time. We then study a new set of relativistic quantum protocols which involve the distribution of entangled states over spacetime, defining one task involving the distribution of the two halves of a known entangled state, and another task involving the distribution of the two halves of an unknown entangled state. The second part of the thesis deals with relativistic quantum cryptography, a field which first began attracting serious attention when it was realised that a cryptographic task known as `bit commitment,' can be implemented with perfect security under relativistic constraints. This result was highly significant, since it is provably impossible to implement bit commitment with perfect security in a purely classical or purely quantum context, and hence bit commitment is an ideal starting point for probing the power of relativistic quantum cryptography. In this thesis we propose several new relativistic quantum bit commitment protocols which have notable advantages over previously known protocols. We then move to a related task, a generalization of zero-knowledge proving which we refer to as knowledge-concealing evidencing of knowledge of a quantum state; we prove no-go theorems concerning the possibility of implementing this task with perfect security, and then set out a relativistic protocol for the task which is asymptotically secure as the dimension of the state in question becomes large. These results have interesting foundational significance above and beyond their applications in the field of cryptography, providing a new perspective on the connections between knowledge, realism and quantum states.
In this work, we study position-based cryptography in the quantum setting. The aim is to use the geographical position of a party as its only credential. On the negative side, we show that if adversaries are allowed to share an arbitrarily large entangled quantum state, the task of secure position-verification is impossible. To this end, we prove the following very general result. Assume that Alice and Bob hold respectively subsystems A and B of a (possibly) unknown quantum state ∣ψ⟩∈HA⊗HB. Their goal is to calculate and share a new state ∣φ⟩=U∣ψ⟩, where U is a fixed unitary operation. The question that we ask is how many rounds of mutual communication are needed. It is easy to achieve such a task using two rounds of classical communication, whereas, in general, it is impossible with no communication at all. Surprisingly, in case Alice and Bob share enough entanglement to start with and we allow an arbitrarily small failure probability, we show that the same task can be done using a single round of classical communication in which Alice and Bob exchange two classical messages. Actually, we prove that a relaxed version of the task can be done with no communication at all, where the task is to compute instead a state ∣φ′⟩ that coincides with ∣φ⟩=U∣ψ⟩ up to local operations on A and on B, which are determined by classical information held by Alice and Bob. The one-round scheme for the original task then follows as a simple corollary. We also show that these results generalize to more players. As a consequence, we show a generic attack that breaks any position-verification scheme. On the positive side, we show that if adversaries do not share any entangled quantum state but can compute arbitrary quantum operations, secure position-verification is achievable. Jointly, these results suggest the interesting question whether secure position-verification is possible in case of a bounded amount of entanglement. Our positive result can be interpreted as resolving this question in the simplest case, where the bound is set to zero. In models where secure position-verification is achievable, it has a number of interesting applications. For example, it enables secure communication over an insecure channel without having any preshared key, with the guarantee that only a party at a specific location can learn the content of the conversation. More generally, we show that in settings where secure position-verification is achievable, other position-based cryptographic schemes are possible as well, such as secure position-based authentication and position-based key agreement.
In this thesis, we initiate the study of cryptographic protocols where the identity, or other credentials and inputs, of a party are derived from its geographic location.
We start by considering the central task in this setting, i.e., securely verifying the position of a device. Despite much work in this area, we show that in the Vanilla (or standard) model, this above task (i.e., of secure positioning) is impossible to achieve, even if we assume that the adversary is computationally bounded. In light of the above impossibility result, we then turn to Dziembowski's Bounded Retrieval Model (a variant of Maurer's Bounded Storage Model) and formalize and construct information theoretically secure protocols for two fundamental tasks: Secure Positioning; and Position-Based Key Exchange.
We then show that these tasks are in fact universal in this setting—we show how we can use them to realize Secure Multi-Party Computation.
The main contribution of this thesis is threefold: to place the problem of secure positioning on a sound theoretical footing; to prove a strong impossibility result that simultaneously shows the insecurity of previous attempts at the problem; and to present positive results showing that the bounded-retrieval framework is a fruitful one to study the foundations of position-based cryptography.
This thesis is based on joint works with Vipul Goyal, Ryan Moriarty, and Rafail Ostrovsky.
In this thesis we explore position-based quantum cryptography zooming in on the task of position verification. In position verification, the idea is to use an individual's geographical location as a cryptographic credential. In practice, such protocols can authenticate that a message originated from a specific location or ensure that messages can only be read at a certain location. In a position-verification protocol, the limitations imposed by the speed of light, as described by special relativity, are used to verify that a party is at their claimed location. It has been shown that any QPV protocol can be broken by attackers that use an amount of entanglement exponential in the input size. However, from a practical point of view, not all is lost. We can still hope for QPV protocols that are secure in practice. This raises the problem of designing protocols that are secure in a practical setting. An important problem that arises is that of signal loss. Signal loss can be detrimental as it allows attackers to only answer on a subset of rounds. We investigate several questions related to the practical implementation of such protocols. We propose a new experimentally feasible protocol, which is fully loss-tolerant against attackers restricted to classical communication. Furthermore, we consider the role of allowing quantum communication with no pre-shared entanglement for attackers and show that this setting is strictly stronger than the classical one, indicating that allowing for quantum communication may break security. Conversely, we then show that any protocol secure against classical communication can be transformed into a protocol secure against quantum communication. Finally, we invert the picture, and consider the task of non-local quantum computation (NLQC), which corresponds to the operations of the attackers in a QPV protocol. We connect NLQC to the wider context of information-theoretic cryptography by relating it to a number of other cryptographic primitives.
In our daily lives, people or devices frequently need to learn their location for many reasons as some services depend on the absolute location or the proximity. The outcomes of positioning systems can have critical effects e.g., on military, emergency. Thus, the security of these systems is quite important. In this thesis, we concentrate on many security aspects of position in cryptography. The first part of this thesis focuses on the theory of distance bounding. A distance bounding protocol is a two-party authentication protocol between a prover and a verifier which considers the distance of the prover as a part of his/her credential. It aims to defeat threats by malicious provers who try to convince that they are closer to the verifier or adversaries which seek to impersonate a far-away prover. In this direction, we first study the optimal security bounds that a distance bounding protocol can achieve. We consider the optimal security bounds when we add some random delays in the distance computation and let the prover involve distance computation. Then, we focus on solving the efficiency problem of public-key distance bounding because the public-key cryptography requires much more computations than the symmetric-key cryptography. We construct two generic protocols (one without privacy, one with) which require fewer computations on the prover side compared to the existing protocols while keeping the highest security level. Then, we describe a new security model involving a tamper-resistant hardware. This model is called the secure hardware model (SHM). We define an all-in-one security model which covers all the threats of distance bounding and an appropriate privacy notion for SHM. The second part of this thesis is to fill the gap between the distance bounding and its real-world applications. We first consider contactless access control. We define an integrated security and privacy model for access control using distance bounding (DB) to defeat relay attacks. We show how a secure DB protocol can be converted to a secure contactless access control protocol. Regarding privacy (i.e., keeping anonymity in a strong sense to an active adversary), we show that the conversion does not always preserve privacy, but it is possible to study it on a case by case basis. Then, we consider contactless payment systems. We design an adversarial model and define formally the contactless payment security against malicious cards and malicious terminals. Accordingly, we design a contactless payment protocol and show its security in our security model. The last part of this thesis focuses on positioning. We consider two problems related to positioning systems: localization and proof of location. In localization, a user aims to find its position by using a wireless network. In proof of location, a user wants to prove his/her position e.g., to have access to a system or authorize itself. We first formally define the problem of localization and construct a formal security model. We describe algorithms and protocols for localization which are secure in our model. Proof of location has been considered formally by Chandran et al. in CRYPTO 2009 and it was proved that achieving security is not possible in the vanilla model. By integrating the localization and the secure hardware model, we obtain a model where we can achieve proof of location.
While quantum position verification aims to certify a prover's location using quantum information, existing security definitions only guarantee that part of the successful adversarial party is in the claimed location. This leaves open the possibility that a distributed team of adversaries can jointly simulate a prover in a way that defeats the intended meaning of `being at a location' in position-based cryptography. We introduce stronger notions of position verification that we call quantum localization, which requires that there is a specified, unclonable state at the verified spacetime point-and that this state can be found nowhere else. We show that quantum localization leads naturally to a meaningful notion of trajectory verification, in which quantum information is verifiably tracked through space and time. We construct quantum localization and trajectory verification protocols using quantum anchor states, which generalize coset states from unclonable cryptography. The security of our schemes is proven in the classical oracle (i.e. ideal obfuscation) model, which can be heuristically instantiated in the plain model using post-quantum indistinguishability obfuscation. We also introduce and instantiate the concept of functionality localization, which guarantees that the adversary has the ability to compute a secret function at the verified spacetime point, and this function cannot be computed anywhere else. This raises the intriguing possibility of localizing computational capabilities in space and time. More broadly, we believe our notions of quantum localization and subsequent feasibility results provide stronger foundations for position-based cryptography. At a conceptual level, our results also explore the tight link between two fundamental notions in physics-location and information-thus serving as a natural foundation for cryptographic capabilities tied to physical spacetime.