[Paper Review] Composing Quantum Protocols in a Classical Environment

Serge Fehr, Christian Schaffner|ArXiv.org|Apr 7, 2008

Quantum Information and Cryptography14 references4 citations

TL;DR

This paper proposes a simple, information-theoretic security definition for quantum protocols implementing classical two-party tasks, ensuring they securely compose as subroutines within classical protocols. The key contribution is a composition theorem showing that if quantum protocols satisfy the definition, replacing ideal functionalities with these quantum implementations preserves security in any classical outer protocol.

ABSTRACT

We propose a general security definition for cryptographic quantum protocols that implement classical non-reactive two-party tasks. The definition is expressed in terms of simple quantum-information-theoretic conditions which must be satisfied by the protocol to be secure. The conditions are uniquely determined by the ideal functionality F defining the cryptographic task to be implemented. We then show the following composition result. If quantum protocols pi_1,...,pi_k securely implement ideal functionalities F_1,...,F_k according to our security definition, then any purely classical two-party protocol, which makes sequential calls to F_1,...,F_k, is equally secure as the protocol obtained by replacing the calls to F_1,...,F_k with the respective quantum protocols pi_1,...,pi_k. Hence, our approach yields the minimal security requirements which are strong enough for the typical use of quantum protocols as subroutines within larger classical schemes. Finally, we show that recently proposed quantum protocols for oblivious transfer and secure identification in the bounded-quantum-storage model satisfy our security definition, and thus compose in the above sense.

Motivation & Objective

• To address the lack of standardized, practical security definitions for quantum protocols in cryptographic applications.
• To define minimal security conditions that ensure quantum protocols can be securely composed as subroutines within classical protocols.
• To provide a framework that balances strong composability guarantees with implementable, efficient security requirements.
• To demonstrate that existing quantum protocols in the bounded-quantum-storage model satisfy the proposed definition.
• To establish a foundation for using quantum subroutines in information-theoretic classical constructions, such as those based on oblivious transfer.

Proposed method

• Define security via simple quantum-information-theoretic conditions on the protocol’s output states, without requiring simulators or environments.
• Express the security condition as approximate independence between the adversary’s view and the honest party’s inputs, quantified via trace distance.
• Formalize security as the indistinguishability of the real protocol’s output distribution from the ideal functionality’s output, under a trace distance bound.
• Use trace distance and quantum state approximation to quantify security, with error parameters (e.g., ε) bounding deviations from ideal behavior.
• Apply the definition to specific protocols like 1-out-of-2 oblivious transfer and secure identification in the bounded-quantum-storage model.
• Prove a composition theorem: replacing ideal functionalities with quantum protocols satisfying the definition preserves security in any classical outer protocol.

Experimental results

Research questions

• RQ1 What minimal security conditions are sufficient to ensure that a quantum protocol can be securely used as a subroutine in a larger classical protocol?
• RQ2 How can a security definition for quantum protocols be formulated without relying on complex models like universal composability or simulator-based frameworks?
• RQ3 Can existing quantum protocols for oblivious transfer and identification in the bounded-quantum-storage model be shown secure under this new definition?
• RQ4 Does the proposed definition guarantee composability when quantum subroutines are embedded in classical protocols?
• RQ5 What is the trade-off between security strength and implementability in quantum protocol design, and can it be formalized?

Key findings

• The proposed security definition is based solely on trace distance conditions between real and ideal protocol outputs, making it simple and information-theoretic.
• The definition ensures that any classical protocol making sequential calls to ideal functionalities is equally secure when those functionalities are replaced by quantum protocols satisfying the definition.
• The 1-out-of-2 oblivious transfer protocol in the bounded-quantum-storage model satisfies the security definition with a 4ε security loss, proving its composability.
• Security for both parties (Alice and Bob) is established by showing that the adversary’s view is approximately independent of the honest party’s input, within a trace distance bound.
• The composition theorem holds under the restriction that the outer protocol is classical, which reflects current technological limitations and enables milder, more practical security conditions.
• The proof technique avoids dependency on input distributions of dishonest players by using state approximation and trace distance inequalities, ensuring robustness across different scenarios.