Extending the functionality and overcoming the performance limitation of QKD requires either quantum repeaters or new security models. Investigating the latter option, we introduce the Quantum Computational Timelock (QCT) security model, assuming that computationally secure encryption may only be broken after time much longer than the coherence time of available quantum memories. These two assumptions, namely short-term computational security and noisy quantum storage, have so far already been considered in quantum cryptography, yet only disjointly. A practical lower bound on time, for which encryption is computationally secure, can be inferred from assumed long-term security of the AES256 encryption scheme (30 years) and the value of coherence time in experimental demonstrations of storage and then retrieval of optically encoded quantum information, at single-photon level range from a few nanoseconds to microseconds. Given the large gap between the upper bound on coherence time and lower bound on computational security time of an encryption scheme, the validity of the QCT security model can be assumed with a very high confidence today and also leaves a considerable margin for its validity in the future. Using the QCT security model, we propose an explicit d-dimensional key agreement protocol that we call MUB-Quantum Computational Timelock (MUB-QCT), where a bit is encoded on a qudit state using a full set of mutually unbiased bases (MUBs) and a family of pair-wise independent permutations. Security is proved by showing that upper bound on Eve's information scales as O(1=d). We show MUB-QCT offers: high resilience to error (up to 50% for large d) with fixed hardware requirements; MDI security as security is independent of channel monitoring and does not require to trust measurement devices. We also prove the security of the MUB-QCT protocol, with multiple photons per channel use, against non-adaptive attacks, in particular, proactive MUB measurement where eve measures each copy in a different MUB followed by post-measurement decoding. We prove that the MUB-QCT protocol allows secure key distribution with input states containing up to O(d) photons which implies a significant performance boost, characterized by an O(d) multiplication of key rate and a significant increase in the reachable distance. These results illustrate the power of the QCT security model to boost the performance of quantum cryptography while keeping a clear security advantage over classical cryptography.
Extending the functionality and overcoming the performance limitation of QKD requires either quantum repeaters or new security models. Investigating the latter option, we introduce the Quantum Computational Timelock (QCT) security model, assuming that computationally secure encryption may only be broken after time much longer than the coherence time of available quantum memories. These two assumptions, namely short-term computational security and noisy quantum storage, have so far already been considered in quantum cryptography, yet only disjointly. A practical lower bound on time, for which encryption is computationally secure, can be inferred from assumed long-term security of the AES256 encryption scheme (30 years) and the value of coherence time in experimental demonstrations of storage and then retrieval of optically encoded quantum information, at single-photon level range from a few nanoseconds to microseconds. Given the large gap between the upper bound on coherence time and lower bound on computational security time of an encryption scheme, the validity of the QCT security model can be assumed with a very high confidence today and also leaves a considerable margin for its validity in the future. Using the QCT security model, we propose an explicit d-dimensional key agreement protocol that we call MUB-Quantum Computational Timelock (MUB-QCT), where a bit is encoded on a qudit state using a full set of mutually unbiased bases (MUBs) and a family of pair-wise independent permutations. Security is proved by showing that upper bound on Eve's information scales as O(1=d). We show MUB-QCT offers: high resilience to error (up to 50% for large d) with fixed hardware requirements; MDI security as security is independent of channel monitoring and does not require to trust measurement devices. We also prove the security of the MUB-QCT protocol, with multiple photons per channel use, against non-adaptive attacks, in particular, proactive MUB measurement where eve measures each copy in a different MUB followed by post-measurement decoding. We prove that the MUB-QCT protocol allows secure key distribution with input states containing up to O(d) photons which implies a significant performance boost, characterized by an O(d) multiplication of key rate and a significant increase in the reachable distance. These results illustrate the power of the QCT security model to boost the performance of quantum cryptography while keeping a clear security advantage over classical cryptography.
Extending the functionality and overcoming the performance limitation under which QKD can operate requires either quantum repeaters or new security models. Investigating the latter option, we introduce the \textit{Quantum Computational Hybrid} (QCH) security model, where we assume that computationally secure encryption may only be broken after time much longer than the coherence time of available quantum memories. We propose an explicit d-dimensional key distribution protocol, that we call MUB-\textit{Quantum Computational Timelock} (MUB-QCT) where one bit is encoded on a qudit state chosen among d+1 mutually unbiased bases (MUBs). Short-term-secure encryption is used to share the basis information with legitimate users while keeping it unknown from Eve until after her quantum memory decoheres. This allows reducing Eve's optimal attack to an immediate measurement followed by post-measurement decoding. \par We demonstrate that MUB-QCT enables everlasting secure key distribution with input states containing up to O(d) photons. This leads to a series of important improvements when compared to QKD: on the functional side, the ability to operate securely between one sender and many receivers, whose implementation can moreover be untrusted; significant performance increase, characterized by a O(d) multiplication of key rates and an extension by 25km×log(d) of the attainable distance over fiber. Implementable with a large number of modes with current or near-term multimode photonics technologies, the MUB-QCT construction has the potential to provide a radical shift to the performance and practicality of quantum key distribution.
Cryptographie quantique dans un modèle de sécurité hybride L'extension des fonctionnalités et le dépassement des limitations de performances de QKD nécessitent soit des répéteurs quantiques, soit de nouveaux modèles de sécurité. En étudiant cette dernière option, nous introduisons le modèle de sécurité Quantum Computational Timelock (QCT), en supposant que le cryptage sécurisé informatiquement ne peut être rompu qu'après un temps beaucoup plus long que le temps de cohérence des mémoires quantiques disponibles. Ces deux hypothèses, à savoir la sécurité informatique à court terme et le stockage quantique bruité, ont jusqu'à présent déjà été prises en compte en cryptographie quantique, mais seulement de manière disjointe. Une limite inférieure pratique du temps, pour laquelle le cryptage est sécurisé du point de vue informatique, peut être déduite de la sécurité à long terme supposée du schéma de cryptage AES256 (30 ans) et de la valeur du temps de cohérence dans les démonstrations expérimentales de stockage puis de récupération de quantum optiquement codé. l'information, au niveau d'un seul photon, va de quelques nanosecondes à quelques microsecondes. Compte tenu du grand écart entre la borne supérieure du temps de cohérence et la borne inférieure du temps de sécurité de calcul d'un schéma de chiffrement, la validité du modèle de sécurité QCT peut être supposée avec une très grande confiance aujourd'hui et laisse également une marge considérable pour sa validité dans le futur. En utilisant le modèle de sécurité QCT, nous proposons un protocole d'accord de clé explicite à dimension d que nous appelons MUB-Quantum Computational Timelock (MUB-QCT), où un bit est codé sur un état qudit en utilisant un ensemble complet de bases mutuellement impartiales (MUB ) et une famille de permutations indépendantes par paires. La sécurité est prouvée en montrant que la borne supérieure sur les échelles d'information d'Eve est O(1=d). Nous montrons que MUB-QCT offre : une haute résilience aux erreurs (jusqu'à 50 % pour les grands d) avec des exigences matérielles fixes ; La sécurité MDI car la sécurité est indépendante de la surveillance des canaux et ne nécessite pas de faire confiance aux appareils de mesure. Nous prouvons également la sécurité du protocole MUB-QCT, avec plusieurs photons par utilisation de canal, contre les attaques non adaptatives, en particulier la mesure MUB proactive où eve mesure chaque copie dans un MUB différent suivi d'un décodage post-mesure. Nous prouvons que le protocole MUB-QCT permet une distribution sécurisée des clés avec des états d'entrée contenant jusqu'à O(d) photons, ce qui implique une amélioration significative des performances, caractérisée par une multiplication O(d) du taux de clé et une augmentation significative de la distance accessible. Ces résultats illustrent la puissance du modèle de sécurité QCT pour augmenter les performances de la cryptographie quantique tout en gardant un net avantage de sécurité par rapport à la cryptographie classique.
We introduce an explicit construction for a key distribution protocol in the Quantum Computational Timelock (QCT) security model, where one assumes that computationally secure encryption may only be broken after a time much longer than the coherence time of available quantum memories.Taking advantage of the QCT assumptions, we build a key distribution protocol called HM-QCT from the Hidden Matching problem for which there exists an exponential gap in one-way communication complexity between classical and quantum strategies.We establish that the security of HM-QCT against arbitrary i.i.d. attacks can be reduced to the difficulty of solving the underlying Hidden Matching problem with classical information. Legitimate users, on the other hand, can use quantum communication, which gives them the possibility of sending multiple copies of the same quantum state while retaining an information advantage. This leads to an everlasting secure key distribution scheme over n bosonic modes. Such a level of security is unattainable with purely classical techniques. Remarkably, the scheme remains secure with up to O ( n log ( n ) ) input photons for each channel use, extending the functionalities and potentially outperforming QKD rates by several orders of magnitudes.
The HM-QCT protocol, presented by Mazzoncini et al. in 2025, uses a unique feature of quantum information to achieve quantum key distribution (QKD) with secret-key rates beyond standard constructions. The protocol has been designed in the hybrid quantum-computational time-lock (QCT) security model which imposes two independent (but related) restrictions on the attacker: (1) a computationally secure encryption scheme which a successful attacker must break within a narrow timeframe and (2) an assumption that the attacker can only store quantum information with low fidelity. We first review the protocol and its two-assumption model by presenting, in explicit form, the two natural "harvest now, decrypt later" strategies against it, one using quantum memory and one using classical memory. We show how each is excluded by exactly one of the two assumptions, so that harvesting resistance rests on their conjunction and on the presumed existence of a technological gap: the adversary's quantum memory must decohere much faster than the time it takes to break the short-term encryption. Finally, we introduce HM-PRF , a variant that replaces the short-term encryption with a pseudorandom function (PRF) , evaluated locally. By eliminating the transmission of enciphered classical information, the adversary does not need to race an impending expiry event. We compare the security of our construction against the original and argue that our PRF-based assumption yields a more realistic adversary. It simply requires the existence of one-way functions rather than a predicted lasting limitation of quantum computation and memory technology.
Cryptography is essential for secure communication in the digital era. Today, public-key cryptography is widely employed, and has provided an efficient method for encrypting content and ensuring both confidentiality and authenticity of electronic communications. However, the security of these systems is based on assumptions of computational hardness within the constraints of current computing capability. Thus, as quantum computing becomes a reality, public-key algorithms will be genuinely vulnerable to attack. By contrast, quantum cryptography, which is based on quantum physics instead of mathematical assumptions, is able to achieve information-theoretic security. \n \nAdvances in practical quantum cryptographic systems have not kept pace with theory, where an eavesdropper can relatively easily exploit loopholes in practical implementations to compromise theory-proved security. Bridging the gap between perfect theory and imperfect practice has become a priority for the growing field of quantum key distribution (QKD), which has strived to strengthen the practical security of QKD systems. Among all the countermeasures against quantum hacking, the measurement-device-independent (MDI) QKD protocol is promising because it is immune to all side-channel attacks on measurement devices. However, the MDI QKD protocol has some limitations that critically restrict its practical usefulness. Technically, the MDI scheme is not compatible with existing QKD systems, and produces a low key rate. In addition, the theory underlying MDI QKD security is based on the use of trusted source stations. Thus, this protocol is not a universal solution. This thesis further investigates the practical security of quantum cryptography in and beyond MDI quantum cryptography. \n \nTo overcome the technical limitations of MDI QKD, we first evaluate two other countermeasures against imperfect detections. The first is an industrial patch based on random detection efficiency, recently implemented by ID Quantique in the commercial Clavis2 QKD system. While powerful, experimental testing shows that this countermeasure is not sufficient to defeat the detector blinding attack. The second countermeasure aims to achieve a higher key rate than MDI QKD while maintaining the same security properties. However, our research shows that detector-device-independent (DDI) QKD security is not equivalent to that of MDI QKD and, further, that DDI QKD is insecure against detector side-channel attacks. \n \nWhile this initial work points to the superior performance of MDI QKD systems, core challenges remain. The fundamental security assumption adopted for MDI QKD systems, regarding the exclusive use of trustable source stations, cannot always be satisfied in practice. Our study revealed several side channels of source devices. The first is disclosed from the implementation of a decoy-state protocol, which is widely used in QKD systems with weak coherent sources. The pump-current-modulated intensities result in a timing mismatch between the signal and decoy states, violating the key assumption in the decoy-state QKD protocol. Moreover, an active Eve can break the basic assumption about photon numbers in the QKD system. In this work, we experimentally demonstrate a laser seeding attack on the laser source, which shows that Eve can increase the emission power of the laser diode. Furthermore, by shining a high-power laser into an optical attenuator, Eve can decrease the attenuation values. The increase in laser emission power and the decrease in attenuation leads to an increase in mean photon numbers. \n \nIn summary, MDI QKD is a milestone in quantum cryptography. However, this thesis indicates the importance of continued investigations into the practical security of MDI QKD. The analysis of practical security should be extended to other countermeasures against side-channel attacks and the source stations in MDI QKD systems. Practical quantum hacking and security analysis promote the development of quantum cryptographic systems, which will eventually achieve the unconditional security claimed in theory.
The security of quantum cryptography relies on the foundations of quantum mechanics, in contrast to traditional public key cryptography which relies on the computational difficulty of certain mathematical functions, and cannot provide any indication of eavesdropping or guarantee of key security. The proposal present in this work develops a quantum key distribution model to safeguard security in large networks, in the directions of classical cryptography and quantum cryptography. Two three-party Quantum key distribution are used in this model, one with implicit user authentication and the other with explicit mutual authentication, are proposed to demonstrate the merits of the new combination. The performance of Quantum Key Distribution (QKD) systems have notably progressed since the early experimental demonstrations. The current evolutions in QKD research indicate that the pace of this progression is very likely to be maintained, if not increased, in the future years. In parallel to these improvements of QKD techniques, commercial products are also being developed, making QKD deployment a feasible alternative for securing real data networks. Deployment of a real QKD network is however far from being straightforward. It requires development of a network architecture connecting multiple users that may possibly be very far away from each other. Considering the fact that the existing QKD links are only point-to-point, and intrinsically limited in distance, deployment of a practical QKD network structure is a nontrivial problem. The proposed work describes the proposed architecture for a QKD network specify the requirements relevant to the network design, protocols, and services. The objective of this specification is to define the major components and their main features The proposal provides security against such attacks as man-in-the-middle, eavesdropping and replay. It also improves the efficiency of the quantum key distribution which contains the fewest number of communication rounds among existing Quantum key distributions. In this model two parties can share and use a long-term secret (repeatedly). To prove the security of the proposed schemes, this proposed model provides a primitive called the Unbiased-Chosen Basis (UCB) assumption with the quantum key in angular positions.