arXiv:quant-ph/0407126

Breaking Classical Public Key Cryptosystems by Using a Novel Ensemble Search Algorithm

Chien-Yuan Chen

Published Jul 16, 2004• 0 citations

Abstract

In this paper, we improve Bruschweiler's algorithm such that only one query is needed for searching the single object z from N=2^n unsorted elements. Our algorithm construct the new oracle query function g(.) satisfying g(x)=0 for all input x, except for one, say x=z, where g(z)=z. To store z, our algorithm extends from one ancillary qubit to n ancillary qubits. We then measure these ancillary qubits to discover z. We further use our ensemble search algorithm to attack classical public key cryptosystems. Given the ciphertext C=Ek(m, r) which is generated by the encryption function Ek(), a public key k, a message m, and a random number r, we can construct an oracle query function h(.) satisfying h(m', r')=0 if Ek(m', r')!=C and h(m', r')= (m', r') if Ek(m', r')=C. There is only one object, say (m, r), can be discovered in decryption of C. By preparing the input with all possible states of (m', r'), we can thus use our ensemble search algorithm to find the wanted object (m, r). Obviously, we break the classical public key cryptosystems under the ciphertext attack by performing the oracle query function only one time.

DOI: 10.48550/arxiv.quant-ph/0407126

Related papers

Constant‐time solution to database searching by NMR ensemble computing

Chih-Cheng Hsueh, C.‐Y. Chen

Abstract Brüschweiler's Ensemble algorithm requires n = log N queries to discover the wanted object from the database of the size N. In this paper, we use a new oracle query function g(.) to improve Brüschweiler's algorithm such that only one query is needed for searching the single object. Our algorithm extends from one ancillary qubit to n ancillary qubits. We then construct the oracle query function g(.) satisfying g(x) = 0 for all input x, except for one, say x = z, where g(z) = z. We first prepare 2n qubits, including n qubits for representing the elements and n ancillary qubits for storing the result of the oracle query function. After one query, we obtain z by measuring these ancillary qubits. Our algorithm can efficiently discover the wanted object if N ≤ 230 according to current NMR spectrometer technology.

Fortschritte der PhysikApr 18, 20061 citation

On Quantum Chosen-Ciphertext Attacks and Learning with Errors

Gorjan Alagic, Stacey Jeffery, Māris Ozols +1 more

Large-scale quantum computing poses a major threat to classical public-key cryptography. Recently, strong “quantum access” security models have shown that numerous symmetric-key cryptosystems are also vulnerable. In this paper, we consider classical encryption in a model that grants the adversary quantum oracle access to encryption and decryption, but where we restrict the latter to non-adaptive (i.e., pre-challenge) queries only. We formalize this model using appropriate notions of ciphertext indistinguishability and semantic security (which are equivalent by standard arguments) and call it QCCA 1 in analogy to the classical CCA 1 security model. We show that the standard pseudorandom function ( PRF )-based encryption schemes are QCCA 1 -secure when instantiated with quantum-secure primitives. Our security proofs use a strong bound on quantum random-access codes with shared randomness. Revisiting plain IND − CPA -secure Learning with Errors ( LWE ) encryption, we show that leaking only a single quantum decryption query (and no other leakage or queries of any kind) allows the adversary to recover the full secret key with constant success probability. Information-theoretically, full recovery of the key in the classical setting requires at least a linear number of decryption queries. Our results thus challenge the notion that LWE is unconditionally “just as secure” quantumly as it is classically. The algorithm at the core of our attack is a new variant of the well-known Bernstein–Vazirani algorithm. Finally, we emphasize that our results should not be interpreted as a weakness of these cryptosystems in their stated security setting (i.e., post-quantum chosen-plaintext secrecy). Rather, our results mean that, if these cryptosystems are exposed to chosen-ciphertext attacks (e.g., as a result of deployment in an inappropriate real-world setting) then quantum attacks are even more devastating than classical ones.

arXiv:1808.09655CryptographyMar 21, 20209 citations

Ensemble Algorithm for the Selection Problem by NMR Ensemble Quantum Computers

Chien-Yuan Chen, Chih-Cheng Hsueh

In this paper, we present an ensemble algorithm for selection problem to find the k-th smallest element in the unsorted database. We will search the k-th smallest element by using "divide-and-conquer" strategy. We first divide D, the domain of the database, into two parts, determine which of the two parts the object element sought belongs to, and then concentrate on that part. We repeat divide that part until object element is found. The determination of which part depends on the output of ensemble counting scheme, which outputs the number of assignments satisfying the value of the oracle query function is set to one. Our algorithm modifies the ensemble counting scheme by constructing a new oracle query function g_y(j). We set g_y(j) to one if the j-th element is less than or equal to y. At first, we set y to the middle value of D and perform the ensemble counting scheme with the oracle query function g_y(.) to compute the number C, the number of j satisfying g_y(j)=1. If C>k, the object element lies in the first half of D. If C<=k, then it must be in the second half of D. We recursively apply this method by adapting y until the object element is found. Our algorithm thus requires O(ln|D|) oracle queries for adequate measure accuracy to find the k-th smallest element, where |D| denotes the size of D.

arXiv:quant-ph/0407109Jul 15, 20040 citations

On Quantum Chosen-Ciphertext Attacks and Learning with Errors

Gorjan Alagic, Stacey Jeffery, Māris Ozols +1 more

Quantum computing is a significant threat to classical public-key cryptography. In strong "quantum access" security models, numerous symmetric-key cryptosystems are also vulnerable. We consider classical encryption in a model which grants the adversary quantum oracle access to encryption and decryption, but where the latter is restricted to non-adaptive (i.e., pre-challenge) queries only. We define this model formally using appropriate notions of ciphertext indistinguishability and semantic security (which are equivalent by standard arguments) and call it QCCA1 in analogy to the classical CCA1 security model. Using a bound on quantum random-access codes, we show that the standard PRF-based encryption schemes are QCCA1-secure when instantiated with quantum-secure primitives. We then revisit standard IND-CPA-secure Learning with Errors (LWE) encryption and show that leaking just one quantum decryption query (and no other queries or leakage of any kind) allows the adversary to recover the full secret key with constant success probability. In the classical setting, by contrast, recovering the key requires a linear number of decryption queries. The algorithm at the core of our attack is a (large-modulus version of) the well-known Bernstein-Vazirani algorithm. We emphasize that our results should not be interpreted as a weakness of these cryptosystems in their stated security setting (i.e., post-quantum chosen-plaintext secrecy). Rather, our results mean that, if these cryptosystems are exposed to chosen-ciphertext attacks (e.g., as a result of deployment in an inappropriate real-world setting) then quantum attacks are even more devastating than classical ones.

Leibniz international proceedings in informaticsJan 1, 20190 citations

Practical Quantum Public Key Encryption from One-way Functions

Kyohei Sudo, Keisuke Fujii, Keisuke Hara +3 more

We construct a quantum public key encryption scheme from oneway functions in the random oracle model. While our construction only has indistinguishability against restricted adversaries, who perform individual attacks and can only make classical queries to the random oracle, it possesses two practical advantages that were not achieved in previous works. First, legitimate participants can discard noisy quantum public keys. Second, the scheme only requires products of single-qubit states, and it does not require quantum computing or quantum memory for legitimate participants. Although the security does not hold against adversaries capable of large-scale quantum computation, we believe that our protocol is well-suited for the near-term stage of the quantum era.

ACM ASIA Public-Key Cryptography Workshop (APKC)Jun 6, 20250 citations

Unclonable Secret Keys

Μάριος Γεωργίου

We propose a novel concept of securing cryptographic keys which we call “Unclonable Secret Keys,” where any cryptographic object is modified so that its secret key is an unclonable quantum bit-string whereas all other parameters such as messages, public keys, ciphertexts, signatures, etc., remain classical. We study this model in the authentication and encryption setting giving a plethora of definitions and positive results as well as several applications that are impossible in a purely classical setting. In the authentication setting, we define the notion of one-shot signatures, a fundamental element in building unclonable keys, where the signing key not only is unclonable, but also is restricted to signing only one message even in the paradoxical scenario where it is generated dishonestly. We propose a construction relative to a classical oracle and prove its unconditional security. Moreover, we provide numerous applications including a signature scheme where an adversary can sign as many messages as it wants and yet it cannot generate two signing keys for the same public key. We show that one-shot signatures are sufficient to build a proof-of-work-based decentralized cryptocurrency with several ideal properties: it does not make use of a blockchain, it allows sending money over insecure classical channels and it admits several smart contracts. Moreover, we demonstrate that a weaker version of one-shot signatures, namely privately verifiable tokens for signatures, are sufficient to reduce any classically queried stateful oracle to a stateless one. This effectively eliminates, in a provable manner, resetting attacks to hardware devices (modeled as oracles). In the encryption setting, we study different forms of unclonable decryption keys. We give constructions that vary on their security guarantees and their flexibility. We start with the simplest setting of secret key encryption with honestly generated keys and show that it exists in the quantum random oracle model. We provide a range of extensions, such as public key encryption with dishonestly generated keys, predicate encryption, broadcast encryption and more.

Jan 1, 20200 citations