Quantum digital signatures with quantum key distribution components

I. INTRODUCTION

• The protocols target sender authenticity and transferable messages, with security against Bob forging and Alice repudiating in a three-party setting where at most one party is dishonest.Alice signs; Bob authenticates, and Charlie verifies a message forwarded by Bob.Source: §I · p. 1
• Both protocols avoid quantum memory and a multiport, requiring only the same components as QKD.Earlier proposals required long-term quantum memory or incurred multiport losses and alignment difficulties.Source: §I · p. 2
• P1 and P2 use BB84 states, a well-studied QKD choice that permits the first proof against coherent forging attacks.The paper focuses on BB84 despite other possible signature states and measurement types.Source: §I · p. 2
• P1 is inspired by earlier measured-state schemes, while P2 uses QKD to produce shared classical keys before applying a classical signature scheme.P2’s signature functionality follows from sharing secret keys alone, without the extra assumptions cited for other classical schemes.Source: §I · p. 2
• P1 assumes ideal authenticated quantum channels, while both protocols require pairwise authenticated classical channels.The authors expect QKD-style techniques to help ensure quantum states arrive approximately unchanged, but use the stronger ideal-channel assumption for P1.Source: §I · p. 2

II. PROTOCOL P1

• Bob and Charlie exchange signature elements instead of using a multiport, then measure retained and received BB84 states to record excluded states.The exchange need not be synchronized; the resulting eliminated signatures are used in later verification.Source: §II · pp. 2–3
• Recipients authenticate Alice’s declaration using mismatch thresholds: Bob accepts below saL, while Charlie accepts forwarded messages below svL, with sa < sv.The distribution stage aborts if either party receives outside L(1/2 − r) to L(1/2 + r) elements per possible message.Source: §II · p. 3
• In practical implementations, exchanging signature parts causes losses that increase with recipient distance, while this protocol’s security analysis assumes no transmission losses during distribution.The authors state that parameters should be adjustable to ensure security in imperfect realizations.Source: §II · p. 3
• With sv < 1/16(1 − 2r), the individual-attack forging bound decays exponentially with signature length.The minimum mismatch probability per element is 1/8, and K = L(1/2 − r) elements are kept by Charlie.Source: §II · p. 4
• The forging probability decays exponentially with signature length for BB84 P1, and the proof shows individual forging strategies are optimal even against coherent attacks.The proof is specific to BB84 versions and does not generalize to the previously considered B92 versions.Source: §II · p. 4

III. PROTOCOL P2

• P2 uses secret shared classical keys as signatures and can use QKD to generate them with information-theoretic security.If QKD is treated as key expansion, only short pre-shared keys are needed, effectively independent of future message size.Source: §III · p. 4
• For each possible message, Alice distributes two secret keys; Bob and Charlie split elements, and Alice later declares both keys to sign.Charlie accepts a forwarded declaration only if the part received from Bob has no mismatch and fewer than svL mismatches remain against Charlie’s own key.Source: §III · p. 4
• P2’s repudiation probability decays exponentially with signature length.Repudiation requires Alice’s declaration to match Bob’s key while having at least svL mismatches with Charlie’s key.Source: §III · p. 4
• If no abort occurs and sv < 1/4 − r/2, forging probability decays exponentially as L increases; Bob must guess at least K ≥ L(1/2 − r) Charlie-key elements he did not receive.Each correct guess succeeds with probability 1/2.Source: §III · p. 5

IV. DISCUSSION

• P1 and P2 avoid a multiport and are presented as suitable for current technology with the same requirements as QKD; P1 also permits a coherent-forging security proof.P2 uses QKD to establish pairwise classical secret keys, which the authors show can support signature functionality without a trusted third party or authenticated broadcast channels.Source: §IV · p. 5
• A possible way to relax quantum authenticated-channel assumptions is to sacrifice signature states for correlation tests and abort below a suitable threshold, but rigorous investigation remains future work.The proposed approach draws an analogy with QKD parameter estimation; information reconciliation may not be required because QDS participants need not have identical signatures.Source: §IV · p. 5
• The authors leave composable security, extensions beyond three parties or to longer messages, and entanglement-based routes to device-independent QDS as open questions.Generalization must address coalitions of malevolent participants.Source: §IV · p. 5

Appendix A: Supplementary Material

• The supplementary material first presents P1’, then analyzes P1 against repudiation and forging, and finally examines the security of another protocol.The passage does not identify that final protocol.Source: Appendix A · p. 5

1. Modified protocol P1’

• P1’ replaces the authenticated quantum channel between Bob and Charlie with a secure classical channel, potentially built using QKD and an authenticated classical channel.The authors state that P1’ has a security analysis essentially identical to P1’s.Source: §1 · p. 6
• Recipients immediately apply an unambiguous state elimination measurement to each received qubit, using the same measurement as in P1 to exclude one possible state.The paper names this an unambiguous state elimination (USE) measurement.Source: §1 · p. 6
• For each signature element, each recipient randomly keeps the outcome in classical memory or sends it over the secure channel, then does not use that record if honest.The latter choice makes the protocol fully symmetric from Alice’s perspective.Source: §1 · p. 6
• P1’ preserves P1’s repudiation and forging security analyses: honest recipients obtain the same outcomes, while Charlie’s retained outcomes for elements sent to him secure against dishonest Bob.For dishonest Bob, the argument relies on the half of signature elements Alice sent to Charlie.Source: §1 · p. 6

2. Security of protocol P1

• Both repudiation and forging probabilities must decrease exponentially with signature length L; then security level ǫ requires only L = O(log(1/ǫ)).The protocol parameters sa and sv can be chosen to minimize the maximum overall probability of malevolent behavior.Source: §2 · p. 6
• The analysis assumes quantum authenticated channels during signature distribution; under this assumption, any security level can be achieved efficiently irrespective of losses.Removing the assumption would impose limits on allowable losses, above which QDS is no longer secure.Source: §2 · p. 6

a. Security against repudiation

• For each fixed outcome sequence, Alice’s repudiation probability depends on which signature elements Bob and Charlie retain, a distribution she does not control.The overall probability for a sent state is obtained by averaging sequence-specific repudiation probabilities over the outcome distribution it generates.Source: a. Security against repudiation · pp. 6–7
• The repudiation probability is bounded by the largest sequence-specific probability, and the analysis uses Hoeffding’s inequality to show this maximum decreases exponentially with L.The signature contains L qubits for each recipient, and the exchanged qubits are protected by an authenticated quantum channel.Source: a. Security against repudiation · pp. 6–7
• Randomly exchanging subsystems makes Bob’s and Charlie’s expected mismatch proportions per signature element equal.The analysis separates the qubits initially sent to each recipient before deriving this equality.Source: a. Security against repudiation · p. 7
• When sa < sv, Alice’s optimal choice p = (sa + sv)/2 gives a repudiation probability that decays exponentially with signature length L.The analysis bounds the overall probability by the maximum repudiation probability over outcome sequences.Source: a. Security against repudiation · p. 7

b. Security against forging

• A single-element mismatch probability is at least Cmin = 1/8, and the individual-attack forging probability decays exponentially when Cmin > svL/K ≈ 2sv.The bound applies to K = L(1/2 − r) elements Charlie kept.Source: b. Security against forging · pp. 7–8
• The coherent-security proof is specific to BB84: its teleportation-correction step requires the corrections to preserve the state set, and the authors note failures for B92 and phase-encoded coherent states.They describe maximum-confidence measurements as an alternative for some state sets, but report a trivial pforge = 1 bound for linearly independent states.Source: b. Security against forging · pp. 9, 11
• The proof shows that no coherent strategy improves on the optimal individual attack, by bounding coherent attacks through adaptive local measurements and then individual measurements.The modified verification procedure lets Bob condition local measurements on previous match or mismatch outcomes; this adaptive strategy is no better than the optimal non-adaptive individual strategy.Source: b. Security against forging · pp. 9–11
• p(forge) ≤ exp(−2(Cmin − svL/K)^2K), so forging probability decays exponentially with signature length L for all possible attacks.Here K = L(1/2 − r).Source: b. Security against forging · p. 11

• The analysis first considers whether P2's repudiation probability decreases exponentially with signature length.Source: §3 · p. 11
• It next applies the same length-dependent security analysis to P2's forging probability.Source: §3 · p. 11
• Repudiation and forging are the two security probabilities named for analysis in P2.Source: §3 · p. 11

a. Security against repudiation

• Alice must make Bob accept and Charlie reject, so Charlie must detect at least svL mistakes while Bob receives no mismatches.Source: a. Security against repudiation · pp. 11–12
• Because Bob receives each bit of Charlie's private key with probability 1/2, Alice's best strategy is to send exactly R = svL mismatches.Source: a. Security against repudiation · p. 12
• P2's repudiation probability decreases exponentially as signature length L increases.Source: a. Security against repudiation · p. 12

b. Security against forging

• Bob must guess K = L(1/2 − r) private-key bits and make fewer than svL mistakes to forge.Source: b. Security against forging · p. 12
• The forging probability decreases exponentially with L provided that sv < 1/4 − r/2.Source: b. Security against forging · p. 12
• P2 requires Alice to send different signatures to Bob and Charlie; sending the same signature would make forging possible if they knew it was shared.Source: b. Security against forging · p. 12