Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:quant-ph/0509091 · Quantum Information and Computation

On the security of $\alpha\eta$: response to 'some attacks on quantum-based cryptographic protocols'

Horace P. Yuen, Ranjith Nair, Eric Corndorf, Gregory S. Kanter, Prem Kumar

Published Nov 1, 2006• 17 citations
arXivHTMLPDF

Abstract

Lo and Ko have developed some attacks on the cryptosystem called $\alpha \eta$}, claiming that these attacks undermine the security of $\alpha\eta$ for both direct encryption and key generation. In this paper, we show that their arguments fail in many different ways. In particular, the first attack in [1] requires channel loss or length of known-plaintext that is exponential in the key length and is unrealistic even for moderate key lengths. The second attack is a Grover search attack based on `asymptotic orthogonality' and was not analyzed quantitatively in [1]. We explain why it is not logically possible to "pull back'' an argument valid only at $n=\infty$ into a limit statement, let alone one valid for a finite number of transmissions n. We illustrate this by a `proof' using a similar asymptotic orthogonality argument that coherent-state BB84 is insecure for any value of loss. Even if a limit statement is true, this attack is a priori irrelevant as it requires an indefinitely large amount of known-plaintext, resources and processing. We also explain why the attacks in [1] on $\alpha\eta$ as a key-generation system are based on misinterpretations of [2]. Some misunderstandings in [1] regarding certain issues in cryptography and optical communications are also pointed out. Short of providing a security proof for $\alpha\eta$, we provide a description of relevant results in standard cryptography and in the design of $\alpha\eta$ to put the above issues in the proper framework and to elucidate some security features of this new approach to quantum cryptography.

DOI
10.26421/qic6.7-1

Related papers

Some attacks on quantum-based cryptographic protocols

Hoi‐Kwong Lo, T-M Ko

Quantum-based cryptographic protocols are often said to enjoy security guaranteed by the fundamental laws of physics. However, even carefully designed quantum-based cryptographic schemes may be susceptible to subtle attacks that are outside the original design. As an example, we give attacks against a recently proposed ``secure communication using mesoscopic coherent states'', which employs mesoscopic states, rather than single-photon states. Our attacks can be used either as a known-plaintext attack or in the case where the plaintext has not been randomized. One of our attacks requires beamsplitters and the replacement of a lossy channel by a lossless one. It is successful provided that the original loss in the channel is so big that Eve can obtain $2^k$ copies of what Bob receives, where $k$ is the length of the seed key pre-shared by Alice and Bob. In addition, substantial improvements over such an exhaustive key search attack can be made, whenever a key is reused. Furthermore, we remark that, under the same assumption of a known or non-random plaintext, Grover's exhaustive key search attack can be applied directly to "secure communication using mesoscopic coherent states", whenever the channel loss is more than 50 percent. Therefore, as far as information-theoretic security is concerned, optically amplified signals necessarily degrade the security of the proposed scheme, when the plaintext is known or non-random. Our attacks apply even if the mesoscopic scheme is used only for key generation with a subsequent use of the key for one-time-pad encryption. Studying those attacks can help us to better define the risk models and parameter spaces in which quantum-based cryptographic schemes can operate securely. Finally, we remark that our attacks do not affect standard protocols such as Bennett-Brassard BB84 protocol or Bennett B92 protocol, which rely on single-photon signals.

arXiv:quant-ph/0309127•Quantum Information and Computation•Jan 1, 2005•52 citations

Quantum-noise randomized ciphers

Ranjith Nair, Horace P. Yuen, Eric Corndorf +2 more

We review the notion of a classical random cipher and its advantages. We sharpen the usual description of random ciphers to a particular mathematical characterization suggested by the salient feature responsible for their increased security. We describe a concrete system known as $\ensuremath{\alpha}\ensuremath{\eta}$ and show that it is equivalent to a random cipher in which the required randomization is affected by coherent-state quantum noise. We describe the currently known security features of $\ensuremath{\alpha}\ensuremath{\eta}$ and similar systems, including lower bounds on the unicity distances against ciphertext-only and known-plaintext attacks. We show how $\ensuremath{\alpha}\ensuremath{\eta}$ used in conjunction with any standard stream cipher such as the Advanced Encryption Standard provides an additional, qualitatively different layer of security from physical encryption against known-plaintext attacks on the key. We refute some claims in the literature that $\ensuremath{\alpha}\ensuremath{\eta}$ is equivalent to a nonrandom stream cipher.

arXiv:quant-ph/0603263•Physical Review A•Nov 7, 2006•61 citations

On the vulnerability of the swiss system of coherent quantum cryptography to an attack with repeated measurements

S. N. Molotkov

It has been shown that the coherent quantum cryptography protocol (Coherent One Way) and, correspondingly, fiber optic systems involving this protocol for quantum key distribution, are vulnerable to an attack with repeated measurements and do not guarantee the security of distributed keys in a communication channel with losses. The coherent quantum cryptography system is used in Switzerland as one of the key distribution channels in the framework of the network project SECOQC (SEcure COmmunications based on Quantum Cryptography). A critical attack with repeated measurements was missed when the cryptographic strength of this protocol was analyzed. The critical length of the communication channel has been determined; this is a value above which secure key distribution is certainly impossible. Beginning with the critical length, an eavesdropper knows the entire distributed key, does not introduce errors at the receiver end, and remains undetected. For typical parameters in a real system (the average photon number μ = 0.5 and the quantum efficiency of avalanche detectors η = 0.1, see N. Gisin, G. Ribordy, H. Zbinden, et al., arXiv:quant-ph/0411022 and D. Stucki, C. Barreiro, S. Fasel, et al., arXiv:quant-ph/08095264), the security of keys cannot be guaranteed even for a communication channel whose length is as small as wished.

Journal of Experimental and Theoretical Physics Letters•Apr 1, 2011•0 citations

Key Generation: Foundations and a New Quantum Approach

Horace P. Yuen

The fundamental security and efficiency considerations for fresh key generation will be described. It is shown that the attacker's optimal probability of finding the generated key is an indispensable measure of security and that this probability limits the possibility of privacy amplification and the amount of fresh key that can be generated. A new approach to quantum cryptography to be called keyed communication in quantum noise (KCQ) is developed on the basis of quantum detection and communication theory for classical information transmission. KCQ key generation schemes with coherent states of considerable energy will be described. The possibility of fresh key generation is demonstrated for binary andN-ary detection systems under heterodyne attacks. The security issues of these schemes will be discussed and compared with BB84. The emphasis throughout is on concrete finite bit-length protocols.

arXiv:0906.5241•IEEE Journal of Selected Topics in Quantum Electronics•Jan 1, 2009•64 citations

Problems of Existing Unconditional Security Proofs in Quantum Key Distribution

Horace P. Yuen

It is repeatedly and persistently claimed in the literature that a specific trace criterion $d$ would guarantee universal composition security in quantum cryptography. Currently that is the sole basis of unconditional security claim in quantum key distribution. In this paper, it is shown that just security against known-plaintext attacks when the generated key is used in direct encryption is not provided by $d$. The problem is directly connected with several general problems in the existing unconditional security proofs in quantum key distribution. A number of issues will be clarified concerning the nature of true security, privacy amplification, key generation rate and the mathematical approach needed for their determination in concrete protocols.

arXiv:1109.1051•Sep 6, 2011•5 citations

Unconditional Security In Quantum Key Distribution

Horace P. Yuen

It has been widely claimed and believed that many protocols in quantum key distribution, especially the single-photon BB84 protocol, have been proved unconditionally secure at least in principle, for both asymptotic and finite protocols with realistic bit lengths. In this paper it is pointed out that the only known quantitative justification for such claims is based on incorrect assertions. The precise security requirements are described in terms of the attacker's sequence and bit error probabilities in estimating the key. The extent to which such requirements can be met from a proper trace distance criterion is established. The results show that the quantitative security levels obtainable in concrete protocols with ideal devices do not rule out drastic breach of security unless privacy amplification is more properly applied.

arXiv:1205.5065•May 22, 2012•10 citations
On the security of αη\alpha\etaαη: response to 'some attacks on quantum-based cryptographic protocols'
Lo and Ko have developed some attacks on the cryptosystem called αη\alpha \etaαη}, claiming that these attacks undermine the security of αη\alpha\etaαη for both direct encryption and key generation. In this paper, we show that their arguments fail in many different ways. In particular, the first attack in [1] requires channel loss or length of known-plaintext that is exponential in the key length and is unrealistic even for moderate key lengths. The second attack is a Grover search attack based on asymptotic orthogonality' and was not analyzed quantitatively in [1]. We explain why it is not logically possible to "pull back'' an argument valid only at $n=\infty$ into a limit statement, let alone one valid for a finite number of transmissions n. We illustrate this by a proof' using a similar asymptotic orthogonality argument that coherent-state BB84 is insecure for any value of loss. Even if a limit statement is true, this attack is a priori irrelevant as it requires an indefinitely large amount of known-plaintext, resources and processing. We also explain why the attacks in [1] on αη\alpha\etaαη as a key-generation system are based on misinterpretations of [2]. Some misunderstandings in [1] regarding certain issues in cryptography and optical communications are also pointed out. Short of providing a security proof for αη\alpha\etaαη, we provide a description of relevant results in standard cryptography and in the design of αη\alpha\etaαη to put the above issues in the proper framework and to elucidate some security features of this new approach to quantum cryptography.
Quantum-based cryptographic protocols are often said to enjoy security guaranteed by the fundamental laws of physics. However, even carefully designed quantum-based cryptographic schemes may be susceptible to subtle attacks that are outside the original design. As an example, we give attacks against a recently proposed ``secure communication using mesoscopic coherent states'', which employs mesoscopic states, rather than single-photon states. Our attacks can be used either as a known-plaintext attack or in the case where the plaintext has not been randomized. One of our attacks requires beamsplitters and the replacement of a lossy channel by a lossless one. It is successful provided that the original loss in the channel is so big that Eve can obtain 2k2^k2k copies of what Bob receives, where kkk is the length of the seed key pre-shared by Alice and Bob. In addition, substantial improvements over such an exhaustive key search attack can be made, whenever a key is reused. Furthermore, we remark that, under the same assumption of a known or non-random plaintext, Grover's exhaustive key search attack can be applied directly to "secure communication using mesoscopic coherent states", whenever the channel loss is more than 50 percent. Therefore, as far as information-theoretic security is concerned, optically amplified signals necessarily degrade the security of the proposed scheme, when the plaintext is known or non-random. Our attacks apply even if the mesoscopic scheme is used only for key generation with a subsequent use of the key for one-time-pad encryption. Studying those attacks can help us to better define the risk models and parameter spaces in which quantum-based cryptographic schemes can operate securely. Finally, we remark that our attacks do not affect standard protocols such as Bennett-Brassard BB84 protocol or Bennett B92 protocol, which rely on single-photon signals.
We review the notion of a classical random cipher and its advantages. We sharpen the usual description of random ciphers to a particular mathematical characterization suggested by the salient feature responsible for their increased security. We describe a concrete system known as $\ensuremath{\alpha}\ensuremath{\eta}$ and show that it is equivalent to a random cipher in which the required randomization is affected by coherent-state quantum noise. We describe the currently known security features of $\ensuremath{\alpha}\ensuremath{\eta}$ and similar systems, including lower bounds on the unicity distances against ciphertext-only and known-plaintext attacks. We show how $\ensuremath{\alpha}\ensuremath{\eta}$ used in conjunction with any standard stream cipher such as the Advanced Encryption Standard provides an additional, qualitatively different layer of security from physical encryption against known-plaintext attacks on the key. We refute some claims in the literature that $\ensuremath{\alpha}\ensuremath{\eta}$ is equivalent to a nonrandom stream cipher.
It has been shown that the coherent quantum cryptography protocol (Coherent One Way) and, correspondingly, fiber optic systems involving this protocol for quantum key distribution, are vulnerable to an attack with repeated measurements and do not guarantee the security of distributed keys in a communication channel with losses. The coherent quantum cryptography system is used in Switzerland as one of the key distribution channels in the framework of the network project SECOQC (SEcure COmmunications based on Quantum Cryptography). A critical attack with repeated measurements was missed when the cryptographic strength of this protocol was analyzed. The critical length of the communication channel has been determined; this is a value above which secure key distribution is certainly impossible. Beginning with the critical length, an eavesdropper knows the entire distributed key, does not introduce errors at the receiver end, and remains undetected. For typical parameters in a real system (the average photon number μ = 0.5 and the quantum efficiency of avalanche detectors η = 0.1, see N. Gisin, G. Ribordy, H. Zbinden, et al., arXiv:quant-ph/0411022 and D. Stucki, C. Barreiro, S. Fasel, et al., arXiv:quant-ph/08095264), the security of keys cannot be guaranteed even for a communication channel whose length is as small as wished.
The fundamental security and efficiency considerations for fresh key generation will be described. It is shown that the attacker's optimal probability of finding the generated key is an indispensable measure of security and that this probability limits the possibility of privacy amplification and the amount of fresh key that can be generated. A new approach to quantum cryptography to be called keyed communication in quantum noise (KCQ) is developed on the basis of quantum detection and communication theory for classical information transmission. KCQ key generation schemes with coherent states of considerable energy will be described. The possibility of fresh key generation is demonstrated for binary andN-ary detection systems under heterodyne attacks. The security issues of these schemes will be discussed and compared with BB84. The emphasis throughout is on concrete finite bit-length protocols.
It is repeatedly and persistently claimed in the literature that a specific trace criterion ddd would guarantee universal composition security in quantum cryptography. Currently that is the sole basis of unconditional security claim in quantum key distribution. In this paper, it is shown that just security against known-plaintext attacks when the generated key is used in direct encryption is not provided by ddd. The problem is directly connected with several general problems in the existing unconditional security proofs in quantum key distribution. A number of issues will be clarified concerning the nature of true security, privacy amplification, key generation rate and the mathematical approach needed for their determination in concrete protocols.
It has been widely claimed and believed that many protocols in quantum key distribution, especially the single-photon BB84 protocol, have been proved unconditionally secure at least in principle, for both asymptotic and finite protocols with realistic bit lengths. In this paper it is pointed out that the only known quantitative justification for such claims is based on incorrect assertions. The precise security requirements are described in terms of the attacker's sequence and bit error probabilities in estimating the key. The extent to which such requirements can be met from a proper trace distance criterion is established. The results show that the quantitative security levels obtainable in concrete protocols with ideal devices do not rule out drastic breach of security unless privacy amplification is more properly applied.