PaperlayerView exact revision on arXiv

Source-linked AI summary

Cryptanalysis of the arbitrated quantum signature protocols

Fei Gao, Su-Juan Qin, Fen-Zhuo Guo, Qiao-Yan Wen

arXiv:1106.4398v1quant-ph

TL;DR

This paper examines whether prior arbitrated quantum signature protocols withstand forgery and signer disavowal. It analyzes attack strategies and finds receiver forgery under known-message attack, universal forgery for classical messages, and successful signature disavowal by the sender.

  • Problem

    The paper examines the security of arbitrated quantum signature protocols against receiver forgery and signer disavowal.

    Source: §I · p. 2

  • Method

    The authors analyze prior AQS protocols and describe attack strategies against their signature and dispute mechanisms.

    Source: §I · p. 2, §IV · pp. 5–6

  • Results

    Bob can forge signatures under known-message attack, including universal forgery for classical messages, and Alice can successfully disavow signatures.

    Source: §I · p. 2, §1 · p. 4, §2 · p. 4

  • Takeaways & Limitations

    The analyzed AQS protocols need improvement to address the demonstrated forgery and disavowal attacks.

    Source: §I · p. 2

Abstract

from arXiv · show

As a new model for signing quantum message, arbitrated quantum signature (AQS) has recently received a lot of attention. In this paper we study the cryptanalysis of previous AQS protocols from the aspects of forgery and disavowal. We show that in these protocols the receiver Bob can realize existential forgery of the sender's signature under known message attack. Bob can even achieve universal forgery when the protocols are used to sign a classical message. Furthermore, the sender Alice can successfully disavow any of her signatures by simple attack. The attack strategies are described in detail and some discussions about the potential improvements of the protocols are given. Finally we also present several interesting topics in future study on AQS protocols.

I. INTRODUCTION

The introduction frames quantum signatures as difficult because quantum-message authentication requires perfect encryption, which would prevent a receiver from learning the message content. It introduces AQS as a way around that tension and previews attacks on prior protocols.

I. INTRODUCTION

  • Digital signatures provide authentication and nonrepudiation, so they must address both receiver forgery and signer disavowal.The introduction distinguishes these concerns from message authentication alone.Source: §I · pp. 1–2
  • Quantum-message signing faces a conflict: secure authentication requires perfect encryption, but a signature receiver generally needs to learn the message content.Barnum et al. concluded that signing a quantum message was impossible under this constraint.Source: §I · p. 1
  • AQS was proposed to sign classical or quantum messages while allowing Bob to learn message content and verify with arbitrator Trent’s help.The pioneering protocol uses multiple message copies and probabilistic comparison of unknown quantum states; later protocols used Bell states or no entanglement.Source: §I · p. 1
  • The paper distinguishes key-only, known-message, and adaptive chosen-message attack models, and universal, selective, and existential forgery outcomes.Known-message attacks use valid signatures on messages known to the attacker but not chosen by the attacker.Source: §I · p. 2
  • Bob can forge signatures under known-message attack, including universal forgery for classical messages, while Alice can disavow signatures in the analyzed AQS protocols.The paper analyzes protocols in Refs. and argues that improvements are needed.Source: §I · p. 2

II. ANALYSIS OF THE AQS PROTOCOL WITH BELL STATES

This section introduces the quantum one-time pad (QOTP) before analyzing the Bell-state AQS protocol. It describes QOTP as a classical-key cipher for quantum states and states its key-length requirement for informational security.

II. ANALYSIS OF THE AQS PROTOCOL WITH BELL STATES

  • The section uses QOTP as groundwork for the attack analysis of the Bell-state AQS protocol.It first introduces QOTP, then briefly recalls the protocol and analyzes its security.Source: §II · p. 2

A. Quantum one-time pad

  • QOTP, also called the quantum Vernam cipher, uses classical key bits to encrypt quantum states and is used in AQS protocols.The paper represents an n-qubit message as individual qubits and a key K of 2n bits.Source: A. Quantum one-time pad · p. 2
  • 2n random classical bits are necessary and sufficient to encrypt an unknown n-qubit state with informational security.The paper cites Boykin and Roychowdhury for this result.Source: A. Quantum one-time pad · p. 2

B. AQS protocol with Bell states

The Bell-state AQS protocol has Alice prepare and sign message copies, with one copy teleported to Bob. Trent verifies the signature and sends Bob the verification outcome and message material.

B. AQS protocol with Bell states

  • Alice prepares three copies of the message, encrypts one as R_A, teleports another to Bob, and sends the signature with the third copy.The signature encrypts Alice’s Bell-measurement result and R_A using her key.Source: B. AQS protocol with Bell states · pp. 2–3
  • Bob forwards the encrypted signed message to Trent, who decrypts it and probabilistically compares R_A with the keyed encryption of the message to set r.Trent returns encrypted measurement, signature, message, and r to Bob.Source: B. AQS protocol with Bell states · p. 3
  • Bob accepts Alice’s signature only when Trent’s result is r = 1 and the teleported message copy matches the copy received from Trent.If r is not 1, Bob treats the signature as forged and stops.Source: B. AQS protocol with Bell states · p. 3

C. Analysis of the AQS protocol with Bell states

The protocol’s verification outcome establishes that a message came from Alice, but Trent does not know its content. In a dispute, Trent can compare the presented message and signature to decide whether Alice signed it.

C. Analysis of the AQS protocol with Bell states

  • During ordinary verification, Trent’s positive result confirms that Alice sent a message to Bob, but he cannot know its quantum content.After verification, the three message copies are with Bob and Trent retains none.Source: C. Analysis of the AQS protocol with… · p. 3
  • A dispute requires Bob to provide the message and signature so Trent can decrypt the signature and compare R_A with the keyed encryption of the message.A positive comparison means Alice signed the message; a negative one leads Trent to judge the signature forged by Bob.Source: C. Analysis of the AQS protocol with… · p. 3

1. Bob’s forgery

Bob can forge Alice’s signature without knowing their shared key by transforming a valid message and its signature in parallel. For classical messages, the attack extends to forging a signature on any message Bob chooses.

1. Bob’s forgery

  • Bob’s forgery exploits known-message access: he has a valid message-signature pair but does not know the key shared by Alice and Trent.The counterfeit pair is described as passing Trent’s verification.Source: §1 · pp. 3–4
  • The attack works without Bob knowing key KA because applying the same Pauli operation to each message qubit and its corresponding signature qubit yields another valid signed message.The validity follows because the combined encryptions remain Pauli operations and the global minus signs are omitted for pure single-particle states.Source: §1 · pp. 3–4
  • 4^n − 1 distinct forgeries are available by applying a Pauli operation to each message qubit and the corresponding signature qubit.Bob can choose the resulting message he prefers and present it as one Alice signed.Source: §1 · p. 4
  • If the signed message is classical, Bob can use the attack to forge Alice’s signature on any classical message he wants.The message qubits are |0⟩ or |1⟩, and the construction uses Pauli operations selected with the bitwise addition modulo 2.Source: §1 · p. 4

2. Alice’s disavowal

Alice can disavow a signature by altering its signature states while Trent’s ciphertext is returned to Bob. Bob accepts the signature, but Trent rejects it during a later dispute and sides with Alice.

2. Alice’s disavowal

  • Alice can use this attack to disavow any message she has signed.The paper frames disavowal as Alice cheating in the AQS protocol.Source: §2 · p. 4
  • Alice can modify the signature states in the ciphertext Trent returns, making the signature invalid without changing the other states.The qubit positions are determinate, and QOTP encryption is qubit-by-qubit.Source: §2 · p. 4
  • Bob accepts the signature because he cannot detect Alice’s modification, but Trent rejects it when Bob later submits it for judgment.Trent concludes that Bob forged the signature and agrees with Alice.Source: §2 · p. 4

III. ANALYSIS OF THE AQS PROTOCOL WITHOUT ENTANGLED STATES

The authors examine an AQS protocol without entangled states and report that it remains susceptible to their attacks. They describe the protocol and attack strategies briefly because they resemble those analyzed earlier.

III. ANALYSIS OF THE AQS PROTOCOL WITHOUT ENTANGLED STATES

  • The paper uses the AQS protocol without entangled states as an example for testing its attacks.The protocol was proposed to prevent Bob’s disavowal.Source: §III · p. 4
  • The authors report that this protocol is also susceptible to their attacks.Source: §III · p. 5
  • They describe the protocol and attack strategies briefly because they are similar to those in Section II.Source: §III · p. 5

A. AQS protocol without using entangled states

This AQS protocol without entangled states uses shared keys and a random number to encrypt message copies, then has Bob and Trent verify encrypted message and signature states. Upon successful verification, Alice publishes the random number and Bob recovers and stores the signed message.

A. AQS protocol without using entangled states

B. Analysis of the AQS protocol without using entangled states

The parameter r delays Bob’s choice of forgery until after verification, when r is published, but does not prevent his forgery. Alice’s disavowal attack also remains effective.

B. Analysis of the AQS protocol without using entangled states

  • After verification, Bob can choose Pauli operations on the message and signature states to forge Alice’s signature under a known-message attack.The message remains encrypted by the unknown r until it is published.Source: B. Analysis of the AQS protocol… · p. 5
  • When the signed message is classical, Bob’s forgery becomes universal.Source: B. Analysis of the AQS protocol… · p. 5
  • The parameter r does not affect Alice’s disavowal attack: she can alter the returned signature ciphertext without Bob detecting it because he lacks KAT.This lets her disavow any message she has signed.Source: B. Analysis of the AQS protocol… · p. 5

IV. DISCUSSIONS

The discussion identifies weaknesses that enable forgery and disavowal, then considers protocol changes and their trade-offs.

IV. DISCUSSIONS

  • Trent does not know the quantum message and judges disputes from Bob’s supplied message-signature pair, leaving Alice or Bob room to alter states undetected.The protocol checks whether Eq. (5) holds.Source: §IV · p. 5
  • QOTP encrypts qubits individually, and Pauli operations can preserve verification, enabling Bob to produce many existential forgeries from one valid signature.The discussion identifies these as reasons the Bell-state AQS protocol is vulnerable.Source: §IV · p. 5
  • Because Trent returns an unreadable signature ciphertext whose integrity cannot be verified, Alice can intercept and modify it, then disavow her signature.The discussion identifies the modified signature as a means for Alice to disavow the signature later.Source: §IV · pp. 5–6
  • Having Trent retain each verified signature prevents post-verification modification, but not Bob’s earlier forgery, and increases Trent’s storage burden.During a dispute, Trent would ask Bob for the message and check it against the retained signature.Source: §IV · p. 6
  • Quantum message authentication could let Trent check signature integrity and prevent attacks by both Alice and Bob, though a suitable scheme remains to be studied.The proposed example uses Alice’s and Trent’s keys to authenticate the signature during transmission.Source: §IV · p. 6
  • A hash function on quantum messages could prevent Bob’s existential forgery, but would not prevent Alice’s disavowal, and its feasibility needs further study.Source: §IV · p. 6

V. CONCLUSIONS

The conclusion states that the paper analyzes AQS protocols and presents attack strategies for both signer and receiver.

V. CONCLUSIONS

  • The paper analyzes AQS protocols and presents attack strategies for both Alice and Bob.Source: §V · p. 6
Loading 1106.4398v1…