PaperlayerView exact revision on arXiv

Source-linked AI summary

An online attack against Wiesner's quantum money

Andrew Lutomirski

arXiv:1010.0256v1quant-ph

TL;DR

Wiesner’s quantum money is information-theoretically secure when its mint authenticates random quantum bills against secret descriptions. The paper shows that returning invalid bills enables a counterfeiter to learn the bill state one qubit at a time and copy it in n queries, under the stated verification behavior. The result underscores that quantum protocols remain vulnerable to implementation flaws.

  • Problem

    Wiesner’s protocol provides information-theoretically secure quantum bills authenticated by a mint holding each bill’s secret state description.

    Source: INTRODUCTION · p. 1

  • Method

    The paper models verification as a projector measurement and attacks the service by submitting modified bills to infer each qubit’s basis and value.

    Source: THE ATTACK · pp. 1–2

  • Results

    After exactly n queries, the counterfeiter learns the secret description and can make as many counterfeit copies as desired when invalid bills are returned.

    Source: THE ATTACK · pp. 1–2

  • Takeaways & Limitations

    The attack shows that quantum cryptography is not automatically safer when protocol implementations introduce security-bypassing flaws.

    Source: INTRODUCTION · p. 1, CONCLUSION · p. 2

    The attack assumes the mint returns the post-measurement state after both VALID and INVALID outcomes, rather than destroying invalid bills.

    Source: THE ATTACK · p. 1

Abstract

from arXiv · show

Wiesner's quantum money [5] is a simple, information-theoretically secure quantum cryptographic protocol. In his protocol, a mint issues quantum bills and anyone can query the mint to authenticate a bill. If the mint returns bogus bills when it is asked to authenticate them, then the protocol can be broken in linear time.

INTRODUCTION

Wiesner’s protocol uses random n-qubit bills authenticated by a mint and is information-theoretically secure against approximate copying. The paper shows that returning invalid bills enables an online attack despite this security.

Protocol

  • Wiesner’s protocol assigns each serial number a random n-qubit product state and authenticates bills by projecting them onto the mint’s secret state description.The mint returns VALID when the tested state matches and INVALID otherwise.Source: INTRODUCTION · p. 1

Security

  • The no-cloning theorem and exponential bounds make perfect copying impossible and approximate copies exponentially unlikely to pass authentication as n grows.Source: INTRODUCTION · p. 1

Motivation

  • Prior online attacks exploited oracles that distinguish valid from invalid classical messages, including attacks against CBC encryption and vulnerable websites,.Source: INTRODUCTION · p. 1

Contribution

  • If the mint returns a bill even after an invalid verification attempt, a small number of online queries can copy Wiesner’s quantum bill.Source: INTRODUCTION · p. 1

THE ATTACK

The attack exploits a verification service that returns invalid bills instead of destroying them. By probing one qubit at a time, the counterfeiter learns the secret state in n queries and can create unlimited copies.

THE ATTACK

  • Returning an invalid bill to Morris lets the protocol be broken in linear time, whereas destroying the counterfeit preserves the verification process.Source: THE ATTACK · p. 1
  • The bill is modeled as a serial number paired with a random product state whose qubits are independently eigenstates of X or Z.Source: THE ATTACK · p. 1
  • The mint measures the submitted state with P_s and returns the projected VALID or INVALID branch, leaving the corresponding post-measurement state available to the attacker.Source: THE ATTACK · p. 1
  • For each qubit, Carla applies X_i: an INVALID response identifies a Z-basis state, which she restores and measures in the Z basis.Source: THE ATTACK · pp. 1–2
  • A VALID response identifies an X-basis state and returns the undamaged bill, allowing Carla to measure whether the qubit is |+⟩ or |−⟩.Source: THE ATTACK · p. 2
  • After exactly n queries, Carla knows the secret description and can produce arbitrarily many counterfeit copies.Source: THE ATTACK · p. 2
  • Alternative methods require 2n expected queries for quantum state restoration or O(n) queries for single-copy tomography [2].Source: THE ATTACK · p. 2

CONCLUSION

The paper concludes that implementation flaws can bypass the security of classical or quantum cryptographic protocols. Quantum cryptography is therefore not automatically safer.

CONCLUSION

  • Implementation flaws can bypass the security a cryptographic protocol would provide if correctly implemented, and quantum cryptography is not automatically safer.Source: CONCLUSION · p. 2
Loading 1010.0256v1…