Future nuclear arms-control agreements may call for reductions of the total number of nuclear weapons and warheads in the world arsenals. Such agreements would require new trusted verification mechanisms to confirm that items presented to inspectors are nuclear warheads and not spoofs. Proliferation and national security concerns require, however, that inspectors gain no warhead design information through this process. To address this paradox, considerable efforts have been directed towards the development of "information barriers." These barriers consist of automated measurement systems that process sensitive information but only display the results of internal analysis in a binary valid/invalid manner. These systems are, by their nature, at risk of electronic tampering and snooping – and their trusted implementation has so far proved extremely difficult to realize. This thesis takes radically different directions to address this challenge. It demonstrates new approaches to information protection and trusted instruments for nuclear warhead verification that are based on the cryptographic concepts of zero-knowledge proofs and physically unclonable functions. To the author's knowledge, this thesis provides the first demonstration of a zero-knowledge physical measurement technique. Using fast neutron differential radiography and superheated emulsion detectors, such a technique can show two objects have identical geometry and opacity to 14-MeV neutrons without revealing what these properties are. This zero-knowledge feature no longer holds when the objects compared are significantly different. Such a technique could form the basis of a template-matching verification system that could confirm the authenticity of nuclear weapons without sharing any secret design information. The thesis then introduces and demonstrates key elements of an optical physical unclonable function sensitive to neutrons and based on superheated emulsions. Such sensors are unique objects that cannot be cloned or simulated. The data they produce are a function of both their internal disordered structure and the physical quantity they measure. Due to their sensitivity against any structural variation, including through neutron irradiation, it is possible to show that they – or the data they have recorded -- have not been tampered with. Such sensors could be used by adversarial parties in sensitive facilities without the risk of being compromised.
Future nuclear arms-control agreements may call for reductions of the total number of nuclear weapons and warheads in the world arsenals. Such agreements would require new trusted verification mechanisms to confirm that items presented to inspectors are nuclear warheads and not spoofs. Proliferation and national security concerns require, however, that inspectors gain no warhead design information through this process. To address this paradox, considerable efforts have been directed towards the development of "information barriers." These barriers consist of automated measurement systems that process sensitive information but only display the results of internal analysis in a binary valid/invalid manner. These systems are, by their nature, at risk of electronic tampering and snooping – and their trusted implementation has so far proved extremely difficult to realize. This thesis takes radically different directions to address this challenge. It demonstrates new approaches to information protection and trusted instruments for nuclear warhead verification that are based on the cryptographic concepts of zero-knowledge proofs and physically unclonable functions. To the author's knowledge, this thesis provides the first demonstration of a zero-knowledge physical measurement technique. Using fast neutron differential radiography and superheated emulsion detectors, such a technique can show two objects have identical geometry and opacity to 14-MeV neutrons without revealing what these properties are. This zero-knowledge feature no longer holds when the objects compared are significantly different. Such a technique could form the basis of a template-matching verification system that could confirm the authenticity of nuclear weapons without sharing any secret design information. The thesis then introduces and demonstrates key elements of an optical physical unclonable function sensitive to neutrons and based on superheated emulsions. Such sensors are unique objects that cannot be cloned or simulated. The data they produce are a function of both their internal disordered structure and the physical quantity they measure. Due to their sensitivity against any structural variation, including through neutron irradiation, it is possible to show that they – or the data they have recorded -- have not been tampered with. Such sensors could be used by adversarial parties in sensitive facilities without the risk of being compromised.
Classical sensor security relies on cryptographic algorithms executed on trusted hardware. This approach has significant shortcomings, however. Hardware can be manipulated, including below transistor level, and cryptographic keys are at risk of extraction attacks. A further weakness is that sensor media themselves are assumed to be trusted, and any authentication and encryption is done ex situ and a posteriori. Here we propose and demonstrate a different approach to sensor security that does not rely on classical cryptography and trusted electronics. We designed passive sensor media that inherently produce secure and trustworthy data, and whose honest and non-malicious nature can be easily established. As a proof-of-concept, we manufactured and characterized the properties of non-electronic, physical unclonable, optically complex media sensitive to neutrons for use in a high-security scenario: the inspection of a military facility to confirm the absence or presence of nuclear weapons and fissile materials.
Glaser, Barak, and Goldston recently described an approach for nuclear warhead verification based on the cryptographic concept of a zero-knowledge protocol (ZKP).The verification approach included both procedural elements and a physical implementation.A group of Sandia National Laboratories researchers, whose expertise include radiation instrumentation design and development, cryptography, and arms control verification implementation, jointly reviewed the paper and identified specific challenges to implementing the approach as well as some opportunities.This paper compares the ZKP concept as presented by Glaser et al., to other warhead verification concepts and approaches described in the literature.The paper also summarizes challenges and opportunities for elements of this (new) approach.We note that ZKP as used in cryptography is a useful model for the arms control verification problem, but find that the direct analogy to arms control breaks down quickly.For example, fault tolerance in cryptographic ZKP is achieved by brute force repetition of the challenge/response procedure; in arms control, repeated measurements can be expensive.The ZKP methodology fits within the general class of template-based verification techniques, where template in this case refers to a reference measurement that is used for comparison.Template methods in general confirm that a given object is like another object that has already been accepted as a warhead by some other means.This can be a powerful verification approach, but requires independent means to trust the authenticity of the reference warhead -a standard that may be difficult to achieve.Note that this use of template differs from that of Glaser et al., who use the term to describe the accepted reference warhead.In the ZKP approach as described, the reference warhead must be presentwith inspector confidence in its provenance-at each subsequent confirmation measurement.This imposes significant additional constraints on maintaining continuity of knowledge of the reference between inspections.Despite some technical challenges, the concept of last-minute selection of the pre-loads and equipment could be a valuable component of a verification regime.In addition, the neutron transmission image using a bubble detector array is an interesting idea that can be considered for template measurements independently of ZKP..
How does one prove a claim about a highly sensitive object such as a nuclear weapon without revealing information about the object? This paradox has challenged nuclear arms control for more than five decades. We present a mechanism in the form of an interactive proof system that can validate the structure and composition of an object, such as a nuclear warhead, to arbitrary precision without revealing either its structure or composition. We introduce a tomographic method that simultaneously resolves both the geometric and isotopic makeup of an object. We also introduce a method of protecting information using a provably secure cryptographic hash that does not rely on electronics or software. These techniques, when combined with a suitable protocol, constitute an interactive proof system that could reject hoax items and clear authentic warheads with excellent sensitivity in reasonably short measurement times.
Nuclear disarmament treaties are not sufficient in and of themselves to neutralize the existential threat of the nuclear weapons. Technologies are necessary for verifying the authenticity of the nuclear warheads undergoing dismantlement before counting them toward a treaty partner's obligation. Here we present a concept that leverages isotope-specific nuclear resonance phenomena to authenticate a warhead's fissile components by comparing them to a previously authenticated template. All information is encrypted in the physical domain in a manner that amounts to a physical zero-knowledge proof system. Using Monte Carlo simulations, the system is shown to reveal no isotopic or geometric information about the weapon, while readily detecting hoaxing attempts. This nuclear technique can dramatically increase the reach and trustworthiness of future nuclear disarmament treaties.
Disarmament treaties have been the driving force towards reducing the large nuclear stockpile assembled during the Cold War. Further efforts are built around verification protocols capable of authenticating nuclear warheads while preventing the disclosure of confidential information. This type of problem falls under the scope of zero-knowledge protocols, which aim at multiple parties agreeing on a statement without conveying any information beyond the statement itself. A protocol capable of achieving all the authentication and security requirements is still not completely formulated. Here we propose a protocol that leverages the isotopic capabilities of NRF measurements and the classification abilities of neural networks. Two key elements guarantee the security of the protocol, the implementation of the template-based approach in the network's architecture and the use of homomorphic inference. Our results demonstrate the potential of developing zero-knowledge protocols for the verification of nuclear warheads using Siamese networks on encrypted spectral data.
We discuss the question of how physical statements can be proven over digital communication channels between two parties (a "prover" and a "verifier") residing in two separate local systems. Examples include: (i) "a certain object in the prover's system has temperature X°C", (ii) "two certain objects in the prover's system are positioned at distance X", or (iii) "a certain object in the prover's system has been irreversibly altered or destroyed". As illustrated by these examples, our treatment goes beyond classical security sensors in considering more general physical statements. Another distinctive aspect is the underlying security model: We neither assume secret keys in the prover's system, nor do we suppose classical sensor hardware in his system which is tamper-resistant and trusted by the verifier. Without an established name, we call this new type of security protocol a "virtual proof of reality" or simply a "virtual proof" (VP). In order to illustrate our novel concept, we give example VPs based on temperature sensitive integrated circuits, disordered optical scattering media, and quantum systems. The corresponding protocols prove the temperature, relative position, or destruction/modification of certain physical objects in the prover's system to the verifier. These objects (so-called "witness objects") are prepared by the verifier and handed over to the prover prior to the VP. Furthermore, we verify the practical validity of our method for all our optical and circuit-based VPs in detailed proof-of-concept experiments. Our work touches upon, and partly extends, several established concepts in cryptography and security, including physical unclonable functions, quantum cryptography, interactive proof systems, and, most recently, physical zero-knowledge proofs. We also discuss potential advancements of our method, for example "public virtual proofs" that function without exchanging witness objects between the verifier and the prover.