Abstract In addition to the quantum channel, an auxiliary classical authentic communication channel is required for quantum key distribution. To provide unconditional security in quantum cryptography, which based on the fundamental laws of quantum mechanics, information-theoretic authentication is required, and not authentication based on computational complexity. The paper provides a security proof of information-theoretic authentication in quantum cryptography using ɛ -ASU 2 hash functions. The internal structure of ɛ -ASU 2 hash functions is not used in the proof, so these hash functions can be implemented by a different composition of other hash functions, for example, including the composition ɛ -AXU 2 functions with a reused key and subsequent encryption of the tag with a one-time pad key, which is taken from the previous session of quantum key distribution. It is also shown that information-theoretic authentication preserves composable security of the keys. This authentication method can also be used for key agrrement in in networks with trusted nodes (Molotkov 2022 Laser Phys. Lett. 19 045201–9; Arbekov and Molotkov 2020 Laser Phys. Lett. 17 055202–8) and with quantum key distribution.
Abstract In addition to the quantum channel, an auxiliary classical authentic communication channel is required for quantum key distribution. To provide unconditional security in quantum cryptography, which based on the fundamental laws of quantum mechanics, information-theoretic authentication is required, and not authentication based on computational complexity. The paper provides a security proof of information-theoretic authentication in quantum cryptography using ɛ -ASU 2 hash functions. The internal structure of ɛ -ASU 2 hash functions is not used in the proof, so these hash functions can be implemented by a different composition of other hash functions, for example, including the composition ɛ -AXU 2 functions with a reused key and subsequent encryption of the tag with a one-time pad key, which is taken from the previous session of quantum key distribution. It is also shown that information-theoretic authentication preserves composable security of the keys. This authentication method can also be used for key agrrement in in networks with trusted nodes (Molotkov 2022 Laser Phys. Lett. 19 045201–9; Arbekov and Molotkov 2020 Laser Phys. Lett. 17 055202–8) and with quantum key distribution.
Quantum Key Distribution (QKD) is a secret key agreement technique that consists of two parts: quantum transmission and measurement on a quantum channel, and classical post-processing on a public communication channel. It enjoys provable unconditional security provided that the public communication channel is immutable. Otherwise, QKD is vulnerable to a man-in-the-middle attack. Immutable public communication channels, however, do not exist in practice. So we need to use authentication that implements the properties of an immutable channel as well as possible. One scheme that serves this purpose well is the Wegman-Carter authentication (WCA), which is built upon Almost Strongly Universal2 (ASU2) hashing. This scheme uses a new key in each authentication attempt to select a hash function from an ASU2 family, which is then used to generate the authentication tag for a message. The main focus of this dissertation is on authentication in the context of QKD. We study ASU2 hash functions, security of QKD that employs a computationally secure authentication, and also security of authentication with a partially known key. Specifically, we study the following. First, Universal hash functions and their constructions are reviewed, and as well as a new construction of ASU2 hash functions is presented. Second, security of QKD that employs a specific computationally secure authentication is studied. We present detailed attacks on various practical implementations of QKD that employs this authentication. We also provide countermeasures and prove necessary and sufficient conditions for upgrading the security of the authentication to the level of unconditional security. Third, Universal hash function based multiple authentication is studied. This uses a fixed ASU2 hash function followed by one-time pad encryption, to keep the hash function secret. We show that the one-time pad is necessary in every round for the authentication to be unconditionally secure. Lastly, we study security of the WCA scheme, in the case of a partially known authentication key. Here we prove tight information-theoretic security bounds and also analyse security using witness indistinguishability as used in the Universal Composability framework.
Authentication is an indispensable part of Quantum Cryptography, which is an unconditionally secure key distribution technique based on the laws of nature. Without proper authentication, Quantum Cryptography is vulnerable to “man-in-the-middle” attacks. Therefore, to guarantee unconditional security of any Quantum Cryptographic protocols, the authentication used must also be unconditionally secure. The standard in Quantum Cryptography is to use theWegman-Carter authentication, which is unconditionally secure and is based on the idea of universal hashing. In this thesis, we first investigate properties of a Strongly Universal hash function family to facilitate understanding the properties of (classical) authentication used in Quantum Cryptography. Then, we study vulnerabilities of a recently proposed authentication protocol intended to rule out a "man-in-the-middle" attack on Quantum Cryptography. Here, we point out that the proposed authentication primitive is not secure when used in a generic Quantum Cryptographic protocol. Lastly, we estimate the lifetime of authentication using encrypted tags when the encryption key is partially known. Under simplifying assumptions, we derive that the lifetime is linearly dependent on the length of the authentication key. Experimental results that support the theoretical results are also presented.
The stability of quantum key distribution systems is based not only on the detection of attacks on quantum states, which is guaranteed by the fundamental quantum theory laws, but also on ensuring the integrity of classical messages transmitted through an auxiliary classical communication channel. To detect attacks on the classic communication channel, the authentication procedure is used. Information-theoretic authentication guarantees the detection of attacks on the classical communication channel regardless of the computational and technical capabilities of an eavesdropper, including the quantum computer. The fundamental quantum cryptographic relationship between the abstract criterion of the robustness of quantum key distribution systems with theoretical-information authentication and the quantum key search complexity has been determined for the first time using simple means.
Quantum Key Distribution (QKD - also referred to as Quantum Cryptography) is a technique for secret key agreement. It has been shown that QKD rigged with Information-Theoretic Secure (ITS) authentication (using secret key) of the classical messages transmitted during the key distribution protocol is also ITS. Note, QKD without any authentication can trivially be broken by man-in-the-middle attacks. Here, we study an authentication method that was originally proposed because of its low key consumption; a two-step authentication that uses a publicly known hash function, followed by a secret strongly universal2 hash function, which is exchanged each round. This two-step authentication is not information-theoretically secure but it was argued that nevertheless it does not compromise the security of QKD. In the current contribution we study intrinsic weaknesses of this approach under the common assumption that the QKD adversary has access to unlimited resources including quantum memories. We consider one implementation of Quantum Cryptographic protocols that use such authentication and demonstrate an attack that fully extract the secret key. Even including the final key from the protocol in the authentication does not rule out the possibility of these attacks. To rectify the situation, we propose a countermeasure that, while not information-theoretically secure, restores the need for very large computing power for the attack to work. Finally, we specify conditions that must be satisfied by the two-step authentication in order to restore information-theoretic security.
The paper addresses entity authentication in quantum key distribution (QKD) systems as a decisive condition of their practical security. It is shown that the information-theoretic security of quantum key agreement does not eliminate the need to authenticate the communicating parties: an unauthenticated classical channel leaves the system exposed to the man-in-the-middle attack, since the eavesdropper can run independent QKD instances with each party and reconcile two keys under full control. Existing authentication methods are analysed and classified by the underlying cryptographic primitive: symmetric schemes based on Wegman–Carter universal hashing, pre-shared and fixed keys, public-key infrastructure, two-way authentication, quantum entity/identity authentication, and zero-knowledge proofs. For each class the operating principle, advantages and limitations are determined, with emphasis on key management, scalability and trust distribution. It is established that symmetric and quantum-layer methods rely on pre-shared secrets with a quadratic growth of key material, public-key infrastructure introduces a single trust bottleneck and quantum-vulnerable primitives, while existing zero-knowledge authentication schemes are quantum and bound to the physical layer or solve network properties other than identity. A comparative analysis reveals an unresolved scientific gap: the absence of a scalable entity-authentication method that simultaneously provides non-disclosure of the secret, quantum resistance, sub-quadratic scalability and minimisation of trust assumptions. On this basis, a prospective research direction is substantiated – the construction of entity-authentication methods based on post-quantum zero-knowledge proofs operating over the classical control plane of scalable QKD networks. The requirements for such a method are formulated, and its compatibility with formal QKD security proofs is discussed.
Quantum cryptography Ð quantum key distribution (QKD) Ð was one of the first fields of study of quantum information theory.It reached a mature scientific level and has been implemented in commercial systems for secure quantum communications.The key distribution problem is the central issue of symmetric cryptography.Quantum cryptography solves this problem on the basis of the fundamental laws of nature: the principles of quantum mechanics.Quantum key distribution is essentially matching two independent random sequences on the transmitting and receiving sides by exchanging quantum states.Required in addition to the quantum channel is an authentic classical communication channel.Both communication channels are open and vulnerable to a perpetrator's attack.To ensure the authenticity of the classical channel at initial system startup, a seed key is required, which is used to provide information-theoretic authentication.In essence, quantum cryptography systems are mechanisms for expanding this seed key.Subsequent sessions generate a quantum key, part of which is used for authentication, while another part is employed for other cryptographic purposes, such as encryption.An issue fundamental for quantum cryptography is the number of quantum key distribution sessions that can be conducted from the initial system launch until a new system reboot, when the cryptographic properties of the quantum keys reach a critical level, after which they can no longer be used for cryptographic purposes, and a new system reboot is needed.Although a number of reviews on quantum cryptography are currently available, this issue has not been discussed in detail.It is shown that for realistic parameters of quantum cryptography systems that are currently achievable, a QKD system can operate for I.