Security Analysis of Quantum Cryptographic Protocols

Ivan Popescu, Helena Ivanov

Quantum Key Distribution (QKD) provides information-theoretic security guaranteed by the laws of physics rather than computational hardness -- making it the primary tool for quantum-secure communication against harvest-now-decrypt-later quantum threats. This paper proposes the Quantum Cryptographic Protocol Design and Analysis (QCPDA) framework, evaluating six quantum cryptographic protocols -- BB84, E91, MDI-QKD, Twin-Field QKD (TF-QKD), Quantum Digital Signatures (QDS), and Quantum Secret Sharing (QSS) -- across five dimensions: unconditional security, key generation rate, maximum secure distance, noise tolerance, and implementation complexity. TF-QKD achieves the longest secure distance (605 km on ultra-low-loss fibre) but lowest key rate. MDI-QKD eliminates all detector side-channels at moderate key rates. BB84 achieves the highest composite QCPDA score (8.24) due to commercial maturity. QCPDA provides a protocol selection guide mapping deployment scenarios (metropolitan, intercity, long-haul, multi-party) to optimal protocols, and discusses the complementary roles of QKD and NIST post-quantum cryptography standards for quantum-secure infrastructure.

Anindita Banerjee

Hong Lai

Quantum cryptography including quantum key distribution and quantum secret sharing, a fundamental branch in quantum information processing, is the process whereby two or more parties agree on a key for subsequent cryptographic use. The goal of quantum cryptography is to establish a secure key in an insecure communication environment, leading to the difficulty of the protocols' design and analysis. In this thesis we focus on the design and analysis of secure and efficient protocols of two or more parties in quantum settings.

Gilles Brassard A, Norbert Lütkenhaus, Tal Mor +1 more

Benjamin Benčina, Benjamin Dowling, Varun Maram +1 more

The Secure Shell (SSH) protocol is one of the first security protocols on the Internet to upgrade itself to resist attacks against future quantum computers, with the default adoption of the “quantum (otherwise, classically)” secure hybrid key exchange in OpenSSH from April 2022. However, there is a lack of a comprehensive security analysis of this quantum-resistant version of SSH in the literature: related works either focus on the hybrid key exchange in isolation and do not consider security of the overall protocol, or analyze the protocol in security models which are not appropriate for SSH, especially in the “post-quantum” setting. In this paper, we remedy the state of affairs by providing a thorough post-quantum cryptographic analysis of SSH. We follow a “top-down” approach wherein we first prove security of SSH in a more appropriate model, namely, our post-quantum extension of the so-called authenticated and confidential channel establishment (ACCE) protocol security model; our extension which captures “harvest now, decrypt later” attacks could be of independent interest. Then we establish the cryptographic properties of SSH's underlying primitives, as concretely instantiated in practice, based on our protocol-level ACCE security analysis: for example, we prove relevant cryptographic properties of “Streamlined NTRU Prime”, a key encapsulation mechanism (KEM) which is used in recent versions of OpenSSH and TinySSH, in the quantum random oracle model, and address open problems related to its analysis in the literature. Notably, our ACCE security analysis of post-quantum SSH relies on the weaker notion of IND-CPA security of the ephemeral KEMs used in the hybrid key exchange. This is in contrast to prior works which rely on the stronger assumption of IND-CCA secure ephemeral KEMs. Hence we conclude the paper with a discussion on potentially replacing IND-CCA secure KEMs in current post-quantum implementations of SSH with simpler and faster IND-CPA secure counterparts, and also provide the corresponding benchmarks.

Peter P. Rohde