On Deniability in Quantum Key Exchange

Donald Beaver, Syntechnica Llc

Published Dec 3, 2008• 0 citations

Abstract

Abstract. We show that claims of “perfect security ” for keys produced by quantum key exchange (QKE) are limited to “privacy ” and “integrity.” Unlike a one-time pad, QKE does not necessarily enable Sender and Receiver to pretend later to have established a different key. This result is puzzling in light of Mayers ’ “No-Go ” theorem showing the impossibility of quantum bit commitment. But even though a simple and intuitive application of Mayers ’ protocol transformation appears sufficient to provide deniability (else QBC would be possible), we show several reasons why such conclusions are ill-founded. Mayers ’ transformation arguments, while sound for QBC, are insufficient to establish deniability in QKE. Having shed light on several unadvertised pitfalls, we then provide a candidate deniable QKE protocol. This itself indicates further shortfalls in current proof techniques, including reductions that preserve privacy but fail to preserve deniability. In sum, purchasing undeniability with an off-the-shelf QKE protocol is significantly more expensive and dangerous than the mere optic fiber for which “perfect security ” is advertised. 1

Related papers

Revisiting Deniability in Quantum Key Exchange via Covert Communication and Entanglement Distillation

Arash Atashpendar, Guru-Vamsi Policharla, Peter Browne Rønne +1 more

We revisit the notion of deniability in quantum key exchange (QKE), a topic that remains largely unexplored. In the only work on this subject by Donald Beaver, it is argued that QKE is not necessarily deniable due to an eavesdropping attack that limits key equivocation. We provide more insight into the nature of this attack and how it extends to other constructions such as QKE obtained from uncloneable encryption. We then adopt the framework for quantum authenticated key exchange, developed by Mosca et al., and extend it to introduce the notion of coercer-deniable QKE, formalized in terms of the indistinguishability of real and fake coercer views. Next, we apply results from a recent work by Arrazola and Scarani on covert quantum communication to establish a connection between covert QKE and deniability. We propose DC-QKE, a simple deniable covert QKE protocol, and prove its deniability via a reduction to the security of covert QKE. Finally, we consider how entanglement distillation can be used to enable information-theoretically deniable protocols for QKE and tasks beyond key exchange.

arXiv:1812.02245Dec 5, 20182 citations

Deniability in Quantum Cryptography

Arash Atashpendar, Peter B. Roenne, Dimiter Ostrev +1 more

This poster describes ongoing work on deniability in quantum cryptography, an area of research that remains almost entirely unexplored in the quantum information processing literature. Deniability is a well-known and fundamental concept in classical cryptography and it can be defined as the ability for the sender of a message to deny the contents of a message or the very act of having participated in an exchange, e.g. having sent the said message. We discuss deniability in the context of quantum key exchange and address a particular problem, first discovered by Donald Beaver, where he claims that all QKD protocols are undeniable. The claim is that while we do get a one-time pad (OTP) using QKD, it does not provide the property of key equivocation as it is expected in the Shannon sense for a OTP. Intuitively, this difficulty lies in the quantum channel alone and it has to do with the fact that in QKD, while we generate entropy by expanding an initially short pre-shared key into an arbitrary longer secret key, we do so by exchanging information over a quantum as well as a classical channel, which could potentially leave a binding transcript of Alice's decisions to the final secret key. This is in contrast with the implicit assumption that Eve knows nothing about how two given parties have established their shared OTP in the first place. We discuss the importance of deniability in cryptography and its wide range of applications, along with cryptographic primitives other than key exchange where deniability might be a desired property. Finally, we present a series of fundamental open questions in this area of research and discuss quantum cryptographic primitives that lend themselves to devising deniable protocols.

Jun 14, 20170 citations

Quantum Cryptography

Ahmed Mahmoud Abbas

Quantum cryptography is known the most up-to-date in domain of realistic cryptography notably the menace of quantum cryptanalysis which threatens security firmness of public key cryptography. Quantum cryptography has a famous scheme known as Quantum Key Exchange (QKE), that administrates generation and distribution of a secured random key between legitimate channel users depicted as sender and receiver. Consequently, such key could be used as a key for one-time pad hybrid cryptosystems to encrypt and authenticate messages over a quantum channel. (QKE) is based on unifying quantum physics concepts and information theory with conventional cryptographic schemes that target to produce a short secret session key between any two legitimate parties. An important phase in key creation of BB84 protocol is Privacy Amplification phase where two interconnecting parties distill highly secret shared key from a larger body of shared key, which is only partially secret. The two legitimate parties publicly exchange information to create a compressed key free from biased bits known by an eavesdropper.

Advances in information security, privacy, and ethics book seriesMay 20, 20160 citations

Quantum Cryptography

Ahmed Mahmoud Abbas

IGI Global eBooksJan 1, 20180 citations

Quantum cryptography: a practical information security perspective

Kenneth G. Paterson, Fred C. Piper, Ruediger Schack

Quantum Key Exchange (QKE, also known as Quantum Key Distribution or QKD) allows communicating parties to securely establish cryptographic keys. It is a well-established fact that all QKE protocols require that the parties have access to an authentic channel. Without this authenticated link, QKE is vulnerable to man-in-the-middle attacks. Overlooking this fact results in exaggerated claims and/or false expectations about the potential impact of QKE. In this paper we present a systematic comparison of QKE with traditional key establishment protocols in realistic secure communication systems.

arXiv:quant-ph/0406147Jun 21, 200413 citations

Why Quantum Cryptography

Kenneth G. Paterson, Fred C. Piper, Rüdiger Schack

Quantum Key Exchange (QKE, also known as Quantum Key Distribution or QKD) allows communicating parties to securely establish cryptographic keys. It is a well-established fact that all QKE protocols require that the parties have access to an authentic channel. Without this authenticated link, QKE is vulnerable to man-in-the-middle attacks. Unfortunately this fact is frequently overlooked, resulting in exaggerated claims and/or false expectations about the potential impact of QKE. In this paper we present a systematic comparison of QKE with traditional key exchange protocols in realistic secure communication systems. 1

Jan 1, 200437 citations