[论文解读] Quantum Security of Cryptographic Primitives

Tommaso Gagliardoni|arXiv (Cornell University)|Jan 1, 2017

Cryptography and Data Security参考文献 82被引用 13

一句话总结

本文将量子安全场景系统性地划分为四个独立领域——QS0（经典）、QS1（后量子）、QS2（基于量子叠加的）和QS3（完全量子）——为每个领域提供了形式化安全模型、构造方案以及不可能性结果。其主要贡献是一个统一的量子安全密钥加密框架，以及首次通过一种新颖的非干扰性量子测量技术，对量子ORAM（QORAM）进行了形式化建模与构造。

ABSTRACT

We call quantum security the area of IT security dealing with scenarios where one or more parties have access to quantum hardware. This encompasses both the fields of post-quantum cryptography (that is, traditional cryptography engineered to be resistant against quantum adversaries), and quantum cryptography (that is, security protocols designed to be natively run on a quantum infrastructure, such as quantum key distribution). Moreover, there exist also hybrid models, where traditional cryptographic schemes are somehow `mixed' with quantum operations in certain scenarios. Even if a fully-fledged, scalable quantum computer has yet to be built, recent results and the pace of research in its realization call for attention, lest we suddenly find ourselves one day with an obsolete security infrastructure. For this reason, in the last two decades research in quantum security has experienced an exponential growth in interest and investments. In this work, we propose the first systematic classification of quantum security scenarios, and for each of them we recall the main tools and results, as well as presenting new ones. We achieve this goal by identifying four distinct quantum security classes, or domains, each of them encompassing the security notions and constructions related to a particular scenario. We start with the class QS0, which is `classical cryptography' (meaning that no quantum scenario is considered), where we present some classical constructions and results as a preliminary step. Regarding post-quantum cryptography, we introduce the class QS1, where we discuss in detail the problems arising when designing a classical cryptographic object meant to be resistant against adversaries with local quantum computing power, and we provide a classification of the possible quantum security reductions in this scenario when considering provable security. Moreover, we present results about the quantum security and insecurity of the Fiat-Shamir transformation (a useful tool used to turn interactive identification schemes into digital signatures), and ORAMs (protocols used to outsource a database in a private way). In respect to hybrid classical-quantum models, in the security class QS2 we discuss in detail the possible scenarios where these scenarios arise, and what a correct formalization should be in terms of quantum oracle access. We also provide a novel framework for the quantum security (both in terms of indistinguishability and semantic security) of secret-key encryption schemes, and we give explicit secure constructions, as well as impossibility results. Finally, in the class QS3 we consider all those cryptographic constructions designed to run natively on quantum hardware. We give constructions for quantum encryption schemes (both in the secret- and public-key scenario), and we introduce transformations for obtaining such schemes by conceptually simpler schemes from the class QS2. Moreover, we introduce a quantum version of ORAM, called quantum ORAM (QORAM), aimed at outsourcing in a private way a database composed of quantum data. In proposing a suitable security model and an explicit construction for QORAMs, we also introduce a technique of independent interest which models a quantum adversary able to extract information from a quantum system without disturbing it `too much'. We believe that the framework we introduce in this work will be a valuable tool for the scientific community in addressing the challenges arising when formalizing sound constructions and notions of security in the quantum world.

研究动机与目标

• 为应对量子计算时代对形式化安全模型日益增长的需求。
• 基于量子硬件的作用，将量子安全划分为四个截然不同的领域。
• 为抗量子及完全量子密码原原子提供严谨的安全模型与构造方案。
• 解决量子安全领域中的开放问题，例如量子Fiat-Shamir变换与量子ORAM。

提出的方法

• 提出四层分类：QS0（经典）、QS1（后量子）、QS2（量子预言机访问）和QS3（原生量子密码学）。
• 引入一种新颖的量子安全密钥加密框架，定义了不可区分性与语义安全。
• 为量子ORAM（QORAM）建立正式模型，以安全地外包量子数据。
• 设计一种技术，使量子攻击者能以最小干扰从量子系统中提取信息。
• 应用量子随机预言机模型（QROM）分析Fiat-Shamir等原原子在量子环境下的安全性。
• 为所有四个领域中的量子安全原原子提供显式构造与不可能性结果。

实验结果

研究问题

• RQ1 如何将量子安全系统性地划分为不同且连贯的领域？
• RQ2 在量子攻击者具备叠加访问能力的情况下，密钥加密的正确形式化安全模型是什么？
• RQ3 Fiat-Shamir变换是否可在量子随机预言机模型中安全实例化？
• RQ4 如何实现对量子数据的私有外包存储？此类方案的正确安全模型是什么？
• RQ5 在设计完全量子密码原原子时，其基本限制与可能性是什么？

主要发现

• 本文建立了全面的四领域分类（QS0–QS3），将量子安全组织为不同的威胁模型与构造范式。
• 证明了在量子随机预言机模型下，Fiat-Shamir变换是不安全的，凸显了在后量子环境中进行新分析的必要性。
• 构造了一种新型量子安全密钥加密方案，在量子预言机访问下同时满足不可区分性与语义安全。
• 首次提出量子ORAM（QORAM）的形式化安全模型与构造方案，实现对量子数据库的私有访问。
• 提出一种新技术，建模了能够从量子系统中提取经典信息而不会造成显著干扰的攻击者，从而支持新的安全分析。
• 为某些量子安全构造建立了不可能性结果，明确了在量子环境下可实现性的边界。