Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Quantum Information Processing

Entropically secure encryption with faster key expansion

Mehmet Hüseyin Temel, Boris Škorić

Published Mar 23, 2024• 3 citations
Publisher

Abstract

Abstract Entropically secure encryption is a way to encrypt a large plaintext with a small key and still have information-theoretic security, thus in a certain sense circumventing Shannon’s result that perfect encryption requires the key to be at least as long as the entropy of the plaintext. Entropically secure encryption is possible when a lower bound is known on the entropy of the plaintext from the adversary’s point of view. The typical implementation is to expand the short key to the size of the plaintext, e.g. by multiplication with a public random string, and then use one-time pad encryption. This works in the classical as well as the quantum setting. In this paper, we introduce a new key expansion method that is faster than existing ones. We prove that it achieves the same security. The speed gain is most notable when the key length is a sizeable fraction of the message length. In particular, a factor of 2 is gained in the case of approximate randomization of quantum states. In the classical case, we obtain a reduction of the ciphertext size.

DOI
10.1007/s11128-024-04330-z

Related papers

Entropically secure encryption with faster key expansion

Mehmet Hüseyin Temel, Boris Škorić

Entropically secure encryption is a way to encrypt a large plaintext with a small key and still have information-theoretic security, thus in a certain sense circumventing Shannon's result that perfect encryption requires the key to be at least as long as the entropy of the plaintext. Entropically secure encryption is not perfect, and it works only if a lower bound is known on the entropy of the plaintext. The typical implementation is to expand the short key to the size of the plaintext, e.g. by multiplication with a public random string, and then use one-time pad encryption. This works in the classical as well as the quantum setting. In this paper, we introduce a new key expansion method that is faster than existing ones. We prove that it achieves the same security. The speed gain is most notable when the key length is a sizeable fraction of the message length. In particular, a factor of 2 is gained in the case of approximate randomization of quantum states.

arXiv:2201.00188•Jan 1, 2022•0 citations

Approximate quantum encryption with even shorter keys

Temel, Mehmet, Boris Škorić

Perfect encryption of a qubit state using the Quantum One-Time Pad (QOTP) requires 2 classical key bits. More generally, perfect QOTP encryption of a $2^n$-dimensional state requires $2n$ classical bits. However, almost-perfect encryption, with information-theoretic security, can be achieved with only little more than $1$ key bit per qubit. In this paper we slightly improve the key length. We show that key length $n+\frac23\log\frac1\varepsilon$ suffices to encrypt $n$ qubits in such a way that the cipherstate has trace distance $\leq\varepsilon$ from the fully mixed state. The previous best result was $n+2\log\frac1\varepsilon$. Similar to the previous literature, we expand the key to a $2n$-bit pseudorandom string which is then used as a QOTP key. In this expansion we make use of $2n$ bits of public randomness which are included as a classical part of the cipherstate. Our key expansion is slightly faster than in previous works.

•Jan 1, 2022•1 citation

Quantum Entropic Security and Approximate Quantum Encryption

Simon Pierre Desrosiers, Frédéric Dupuis

An encryption scheme is said to be entropically secure if an adversary whose min-entropy on the message is upper bounded cannot guess any function of the message. Similarly, an encryption scheme is entropically indistinguishable if the encrypted version of a message whose min-entropy is high enough is statistically indistinguishable from a fixed distribution. We present full generalizations of these two concepts to the encryption of quantum states in which the quantum conditional min-entropy, as introduced by Renner, is used to bound the adversary's prior information on the message. A proof of the equivalence between quantum entropic security and quantum entropic indistinguishability is presented. We also provide proofs of security for two different ciphers in this model and a proof for a lower bound on the key length required by any such cipher. These ciphers generalize existing schemes for approximate quantum encryption to the entropic security model.

arXiv:0707.0691•IEEE Transactions on Information Theory•Jun 23, 2010•21 citations

A Quantum-Classical Scheme towards Quantum Functional Encryption

Aditya Ahuja

Quantum encryption is a well studied problem for both classical and quantum information. However, little is known about quantum encryption schemes which enable the user, under different keys, to learn different functions of the plaintext, given the ciphertext. In this paper, we give a novel one-bit secret-key quantum encryption scheme, a classical extension of which allows different key holders to learn different length subsequences of the plaintext from the ciphertext. We prove our quantum-classical scheme secure under the notions of quantum semantic security, quantum entropic indistinguishability, and recent security definitions from the field of functional encryption.

arXiv:1703.00207•Mar 1, 2017•0 citations

Potentially Information-theoretic Secure Y00 Quantum Stream Cipher with Limited Key Lengths beyond One-Time Pad

Takehisa Iwakoshi

The previous work showed that the Y00 protocol could stay secure with the eavesdropper's guessing probability on the secret keys being strictly less than one under an unlimitedly long known-plaintext attack with quantum memory. However, an assumption that at least a fast correlation attack is completely disabled by irregular mapping. The present study shows that the Y00 protocol can be information-theoretic secure under any quantum-computational crypto-analyses if the Y00 system is well designed. The Y00 protocol directly encrypts messages with short secret keys expanded into pseudo-random running keys unlike One-Time Pad. However, it may offer information-theoretic security beyond the Shannon limit of cryptography.

arXiv:1902.05192•Feb 14, 2019•0 citations

Unconditional Unclonable Encryption

Prabhanjan Ananth, Seyoon Ragavan, Amit Sahai

We give an unconditional construction of information-theoretically secure one-time private-key unclonable encryption for one-bit messages, with efficient encryption and decryption and exponentially small unclonable-indistinguishability advantage. Previous work by Bhattacharyya and Culf (Nature Physics, 2026) and Bhattacharyya, Broadbent, and Culf (arXiv:2603.08916) either only showed inverse-polynomial security loss or required inefficient encryption/decryption operations; we avoid both of these caveats. Our scheme's key is a uniformly random non-identity phase-free Pauli on $n$ qubits, and bit $a$ is encrypted as a random $(-1)^a$ eigenstate of that Pauli. We prove that the probability that both receivers recover the bit is at most $1/2 + O\left(2^{-n/2}\right).$ By a lower bound due to Broadbent, Culf, and Rochette (arXiv:2510.00903), this is the best probability bound achievable with $n$-qubit ciphertexts while ensuring perfect correctness (up to the constant hidden in the $O(\cdot)$).

quant-pharXiv:2607.21551•Jul 24, 2026•0 citations
Abstract Entropically secure encryption is a way to encrypt a large plaintext with a small key and still have information-theoretic security, thus in a certain sense circumventing Shannon’s result that perfect encryption requires the key to be at least as long as the entropy of the plaintext. Entropically secure encryption is possible when a lower bound is known on the entropy of the plaintext from the adversary’s point of view. The typical implementation is to expand the short key to the size of the plaintext, e.g. by multiplication with a public random string, and then use one-time pad encryption. This works in the classical as well as the quantum setting. In this paper, we introduce a new key expansion method that is faster than existing ones. We prove that it achieves the same security. The speed gain is most notable when the key length is a sizeable fraction of the message length. In particular, a factor of 2 is gained in the case of approximate randomization of quantum states. In the classical case, we obtain a reduction of the ciphertext size.
Entropically secure encryption is a way to encrypt a large plaintext with a small key and still have information-theoretic security, thus in a certain sense circumventing Shannon's result that perfect encryption requires the key to be at least as long as the entropy of the plaintext. Entropically secure encryption is not perfect, and it works only if a lower bound is known on the entropy of the plaintext. The typical implementation is to expand the short key to the size of the plaintext, e.g. by multiplication with a public random string, and then use one-time pad encryption. This works in the classical as well as the quantum setting. In this paper, we introduce a new key expansion method that is faster than existing ones. We prove that it achieves the same security. The speed gain is most notable when the key length is a sizeable fraction of the message length. In particular, a factor of 2 is gained in the case of approximate randomization of quantum states.
Perfect encryption of a qubit state using the Quantum One-Time Pad (QOTP) requires 2 classical key bits. More generally, perfect QOTP encryption of a 2n2^n2n-dimensional state requires 2n2n2n classical bits. However, almost-perfect encryption, with information-theoretic security, can be achieved with only little more than 111 key bit per qubit. In this paper we slightly improve the key length. We show that key length n+23log⁡1εn+\frac23\log\frac1\varepsilonn+32​logε1​ suffices to encrypt nnn qubits in such a way that the cipherstate has trace distance ≤ε\leq\varepsilon≤ε from the fully mixed state. The previous best result was n+2log⁡1εn+2\log\frac1\varepsilonn+2logε1​. Similar to the previous literature, we expand the key to a 2n2n2n-bit pseudorandom string which is then used as a QOTP key. In this expansion we make use of 2n2n2n bits of public randomness which are included as a classical part of the cipherstate. Our key expansion is slightly faster than in previous works.
An encryption scheme is said to be entropically secure if an adversary whose min-entropy on the message is upper bounded cannot guess any function of the message. Similarly, an encryption scheme is entropically indistinguishable if the encrypted version of a message whose min-entropy is high enough is statistically indistinguishable from a fixed distribution. We present full generalizations of these two concepts to the encryption of quantum states in which the quantum conditional min-entropy, as introduced by Renner, is used to bound the adversary's prior information on the message. A proof of the equivalence between quantum entropic security and quantum entropic indistinguishability is presented. We also provide proofs of security for two different ciphers in this model and a proof for a lower bound on the key length required by any such cipher. These ciphers generalize existing schemes for approximate quantum encryption to the entropic security model.
Quantum encryption is a well studied problem for both classical and quantum information. However, little is known about quantum encryption schemes which enable the user, under different keys, to learn different functions of the plaintext, given the ciphertext. In this paper, we give a novel one-bit secret-key quantum encryption scheme, a classical extension of which allows different key holders to learn different length subsequences of the plaintext from the ciphertext. We prove our quantum-classical scheme secure under the notions of quantum semantic security, quantum entropic indistinguishability, and recent security definitions from the field of functional encryption.
The previous work showed that the Y00 protocol could stay secure with the eavesdropper's guessing probability on the secret keys being strictly less than one under an unlimitedly long known-plaintext attack with quantum memory. However, an assumption that at least a fast correlation attack is completely disabled by irregular mapping. The present study shows that the Y00 protocol can be information-theoretic secure under any quantum-computational crypto-analyses if the Y00 system is well designed. The Y00 protocol directly encrypts messages with short secret keys expanded into pseudo-random running keys unlike One-Time Pad. However, it may offer information-theoretic security beyond the Shannon limit of cryptography.
We give an unconditional construction of information-theoretically secure one-time private-key unclonable encryption for one-bit messages, with efficient encryption and decryption and exponentially small unclonable-indistinguishability advantage. Previous work by Bhattacharyya and Culf (Nature Physics, 2026) and Bhattacharyya, Broadbent, and Culf (arXiv:2603.08916) either only showed inverse-polynomial security loss or required inefficient encryption/decryption operations; we avoid both of these caveats. Our scheme's key is a uniformly random non-identity phase-free Pauli on nnn qubits, and bit aaa is encrypted as a random (−1)a(-1)^a(−1)a eigenstate of that Pauli. We prove that the probability that both receivers recover the bit is at most 1/2+O(2−n/2).1/2 + O\left(2^{-n/2}\right).1/2+O(2−n/2). By a lower bound due to Broadbent, Culf, and Rochette (arXiv:2510.00903), this is the best probability bound achievable with nnn-qubit ciphertexts while ensuring perfect correctness (up to the constant hidden in the O(⋅)O(\cdot)O(⋅)).