New security notions and feasibility results for authentication of quantum data

Authenticating messages is one of the fundamental operations in classical cryptography. A sender Alice wishes to send a message m over an insecure channel to Bob, while ensuring that the message was not tampered with in transit. She does this by affixing a “signature” σ to m using a key k shared with Bob. Bob can then verify the signature he receives to ensure the message came from Alice. Such a (symmetric key) authentication protocol is usually referred to as a Message Authentication Code (MAC). As long as k is only used to authenticate a single message, information-theoretic security can be achieved [10]. Just as authentication is fundamental to classical cryptography, it will continue to be an important tool in the coming age of quantum computers. In this work, we investigate authentication in the quantum setting. Quantum Attacks on Classical Protocols. A recent series of works [3, 6, 4, 5, 11, 9] have studied quantum superposition attacks on classical cryptosystems. In the case of message authentication codes, an adversary in such an attack is able to trick the sender into signing a superposition of messages. Clearly, the adversary can tamper with the signed state: he can, for example, measure the entire state in the standard basis. Because the scheme is classical, the measured state will still pass verification, but will be different from the signed state the adversary received. Boneh and Zhandry [4] argue that, at a minimum, the adversary given a single signed superposition should only be able to produce a single signed message; he should not be able to produce both valid signed messages m, σm and m′, σm′ for m 6= m′. In the classical setting, this requirement is equivalent to the traditional MAC security definition. However, the Boneh-Zhandry definition in the quantum setting has some unsatisfying properties. For example, consider the case where the sender only signs messages that start with the email address of some intended recipient, say, bob@gmail.com. Suppose the adversary tricks the sender into a signing a superposition of messages that all begin with bob@gmail.com, but then manipulates the signed superposition into a different superposition that includes valid signed messages that do not start with bob@gmail.com. Clearly, this is an undesirable outcome. Unfortunately, the Boneh-Zhandry definition does not rule out such attacks — it only rules out the possibility of an adversary producing q + 1 valid signed messages when given q signed superpositions. The situation illustrated here, however, is that the adversary is given one signed superposition, and now wants to produce one valid signed message that was not part of the original superposition. Quantum Authentication of Quantum Data. Barnum et al. [2] investigate the possibility of authenticating quantum data using a quantum protocol. They present a definition of quantum authentication where, conditioned on the protocol succeeding, the sender has effectively teleported a quantum state to the receiver. They then give a scheme which attains this definition. Interestingly, they show that quantum state authentication also implies quantum state encryption. Follow up works [8] showed that the protocol actually has universal composable security, which implies that it remains secure in the presence of side information. However, no general definition for authentication with quantum side information was given. Furthermore, [8] show that the secret key used in the Barnum, et al. protocol can be partially re-used in further applications without compromising their security. When authenticating classical information, the key can even be re-used in its entirety [7]. However, existing definitions have some shortcomings. For example, the key re-usability property does not follow from the general security definition alone, but follows from an analysis of the particular [2] protocol. Moreover, it has been an open question of whether there is a quantum authentication scheme to allow for full re-usability of the key upon successful verification.