PaperlayerView exact revision on arXiv

Source-linked AI summary

Secure Quantum Signatures Using Insecure Quantum Channels

Ryan Amiri, Petros Wallden, Adrian Kent, Erika Andersson

arXiv:1507.02975v2quant-ph

TL;DR

Classical signatures rely on computational assumptions, and earlier quantum signature analyses assumed authenticated quantum channels. This paper proposes a direct quantum signature protocol without trusted quantum channels; it proves security against coherent attacks and reports reduced state use and a less strict noise threshold than QKD.

  • Problem

    Common digital signatures depend on computational assumptions, while earlier quantum signature schemes assumed authenticated quantum channels that exclude eavesdropping.

    Source: §I · p. 1

  • Method

    The paper proposes a direct quantum signature protocol using untrusted quantum channels without first distilling shared secret keys through QKD.

    Source: §I · p. 1

  • Results

    The protocol is proven unconditionally secure against coherent attacks; signing one bit at 50 km requires approximately 6.3×10^8 quantum states, versus O(10^10) states for earlier schemes at 1 km, and its noise threshold is less strict than QKD’s.

    Source: §VI · p. 6

  • Takeaways & Limitations

    For some quantum channels, QKD-based signature protocols are not possible while this direct protocol remains possible, making direct quantum signatures sometimes preferable.

    Source: §VI · p. 6

Abstract

from arXiv · show

Digital signatures are widely used in modern communication to guarantee authenticity and transferability of messages, The security of currently used classical schemes relies on computational assumptions. We present a quantum signature scheme that does not require trusted quantum channels. We prove that it is unconditionally secure against the most general coherent attacks, and show that it requires the transmission of significantly fewer quantum states than previous schemes. We also show that the quantum channel noise threshold for our scheme is less strict than for distilling a secure key using quantum key distribution. This shows that direct quantum signature schemes can be preferable to signature schemes relying on secret shared keys generated using quantum key distribution.

I. INTRODUCTION

Common digital signatures depend on computational assumptions, while earlier quantum signature schemes assumed authenticated quantum channels that prevented eavesdropping. This paper introduces a direct quantum signature protocol without trusted quantum channels and reports a less strict channel-noise threshold than QKD-based key generation.

I. INTRODUCTION

  • Common digital signature schemes rely on computational assumptions, motivating schemes whose security is unconditional and based on physical laws.The passage cites RSA, DSA, and ECDSA as relying on factoring or discrete-logarithm difficulty, assumptions threatened by quantum computers.Source: §I · p. 1
  • Unconditionally secure classical signatures require shared secret keys and may also require a universally trusted third party.One route is to generate keys with QKD before running a signature protocol; direct quantum signatures avoid first distilling highly secure shared keys [5].Source: §I · p. 1
  • Earlier quantum signature analyses assumed authenticated quantum channels, although an adversarial recipient could eavesdrop on states sent to another recipient.That eavesdropping could give a potential forger extra information about the sender’s signature.Source: §I · p. 1
  • The proposed protocol removes quantum-channel trust assumptions and has a less strict channel-noise threshold than QKD key distillation.It also reverses the earlier public-key pattern: Bob and Charlie send different states to Alice, which increases efficiency.Source: §I · pp. 1–2

II. THE PROTOCOL

The protocol is described for Alice as sender and Bob and Charlie as receivers, using imperfect untrusted quantum channels and authenticated classical communication. It separates setup from message signing, with classical communication alone in the messaging stage.

II. THE PROTOCOL

  • The three-party protocol has Alice send messages to Bob and Charlie, and permits at most one dishonest party because two colluding parties can trivially cheat the third.Generalizing to more parties requires care with colluding adversaries; under majority-vote dispute resolution, a majority must be honest.Source: §II · p. 2
  • Alice–Bob and Alice–Charlie use authenticated classical channels and untrusted, imperfect quantum channels, while Bob and Charlie share a QKD link for secret classical messages.Paired key-generating protocols use the noisy quantum channels to produce correlated sender and receiver bit strings.Source: §II · p. 2
  • The protocol has a distribution stage involving classical and quantum communication and a messaging stage that uses only classical communication.The paper describes signing one bit and says longer messages can be signed by iterating the one-bit protocol.Source: §II · p. 2

A. Distribution stage

During distribution, Alice and each recipient generate correlated keys for both possible messages; Bob and Charlie symmetrize their keys by sharing selected bits. These arrangements support message checking while limiting Alice’s ability to repudiate and either recipient’s ability to forge.

A. Distribution stage

  • For each future message, Alice uses the key-generating protocol to produce four length-L keys, paired separately with Bob and Charlie.The superscript identifies the participant in the key-generating protocol and the subscript identifies the future message.Source: A. Distribution stage · p. 2
  • The key-generating protocol is designed so the sender’s key has fewer mismatches with the receiver’s key than any string an eavesdropper could produce.The paper identifies Alice’s signature for message m as the paired keys for that message and says only Alice knows a valid signature.Source: A. Distribution stage · p. 2
  • Bob and Charlie each forward selected key bits to the other and retain the remaining bits, forming symmetrized strings containing portions of both participants’ keys.Alice does not know which particular bits each recipient kept; the forwarded bits are not later used for checking.Source: A. Distribution stage · p. 2
  • Symmetrization protects against repudiation because Alice cannot determine which recipient’s string contains a particular key element.The recipients’ strings each contain half of the relevant key material, while Bob lacks the half of Charlie’s key that Charlie kept, limiting Bob’s forgery ability.Source: A. Distribution stage · p. 2

B. Messaging stage

Alice signs a one-bit message by sending the message and its signature to a recipient, who checks mismatches against the symmetrized key. Forwarded messages face a higher mismatch threshold than messages received directly, limiting repudiation.

B. Messaging stage

  • Alice sends the selected one-bit message and its signature to the recipient.Source: B. Messaging stage · p. 2
  • The direct recipient accepts only if mismatches fall below threshold sa(L/2) in both the directly received and forwarded halves of the key.The parameter sa is below one half and is set according to protocol parameters and the desired security level.Source: B. Messaging stage · p. 2
  • A recipient accepting a forwarded message uses the higher threshold sv(L/2), with 0 < sa < sv < 1/2.Different criteria for direct and forwarded messages are described as a general and necessary feature of unconditionally secure signature schemes [8].Source: B. Messaging stage · pp. 2–3

III. KEY GENERATION PROTOCOL

The key-generation protocol adapts quantum communication from QKD to produce correlated, partly nonsecret strings without error correction or privacy amplification. Its security analysis bounds a forger’s chance of guessing Bob’s key with too few errors, including against coherent attacks.

III. KEY GENERATION PROTOCOL

  • Alice and Bob perform the quantum part of QKD but omit error correction and privacy amplification, producing different, correlated strings that are not entirely secret.Bob forwards one key string to Charlie and keeps the other for himself.Source: §III · p. 3
  • The analysis uses Eve’s smooth min-entropy to bound the probability that she guesses Bob’s key with at most r errors, targeting mismatches rather than QKD’s retained information.The min-entropy bound accounts for public communication and the key portion Bob forwards to Charlie, who could be Eve.Source: §III · pp. 3–4
  • The protocol uses decoy-state BB84 with weak coherent pulses prepared by Bob, and asymmetric basis probabilities to increase efficiency.Bob chooses among three pulse intensities and encodes in the Z and X bases.Source: §III · p. 3
  • X-basis V strings estimate Alice–Bob correlations and are discarded, while Z strings quantify Eve’s information; the remaining X strings form Bob’s key.Bob’s key is split into XB,keep and XB,forward, with the forwarded portion sent to Charlie.Source: §III · p. 3
  • The security analysis allows Eve coherent attacks across channel states and later measurement of an ancilla held in quantum memory.Eve’s information also includes public classical communication and, if Eve is Charlie, the forwarded key portion.Source: §III · pp. 3–4
  • QDS is possible when p_E exceeds the upper bound e^U_X on Alice–Bob X-basis errors, with suitable parameters and a sufficiently large signature length.p_E is the minimum rate at which Eve can make errors except with negligible probability.Source: §III · p. 4

IV. SECURITY ANALYSIS

The security analysis bounds honest aborts, forgery, and repudiation. Its guarantees rely on parameter-estimation bounds and recipient symmetrisation, with failure probabilities that can be made small by increasing the signature length.

Robustness

  • Alice’s and Bob’s observed X-basis errors bound their kept-key error rate using Serfling, with parameter-estimation failure probability decaying exponentially in sample size k.Choosing the acceptance threshold above the error-rate upper bound limits honest aborts; either Alice-to-recipient transmission can cause an abort.Source: §IV · p. 5

Security against forging

  • A forger must beat the mismatch threshold on the unknown half of the recipient’s string; security separates Alice’s upper-bounded error rate from the forger’s minimum error rate.The analysis considers an internal forger and treats failures of parameter estimation or the probability bound as successful forgery.Source: §IV · p. 5
  • The forgery probability can be made arbitrarily small by increasing L, and Bob’s dishonesty during the Alice–Bob key-generation procedure does not help him forge.The argument applies symmetrically to Charlie as a forger.Source: §IV · p. 5

Security against repudiation

  • After symmetrisation, Bob’s and Charlie’s strings have the same expected number of errors, so repudiation requires a substantial imbalance between them.The repudiation bound uses results in; security derives from symmetrisation, which Alice does not control, and holds for any valid threshold choice.Source: §IV · p. 5

V. COMPARISON TO QKD

The comparison finds channels where direct quantum signatures remain possible even though practical QKD yields zero key-generation rate. The distinction is that signature generation omits QKD’s error-correction step.

V. COMPARISON TO QKD

  • The finite-size BB84 decoy-state key-length expression includes constants for error-correction and privacy-amplification failure, as well as information leaked during error correction.The error-correction leakage must be at least n h(e_X^U).Source: §V · p. 6
  • Practical QKD’s error-correction leakage depends on the implementation and is commonly estimated with f_EC in the range 1.11–1.2.The leakage is written as λ_EC = n f_EC h(e_X^U); increasing block size can reduce f_EC but decreases error-correction efficiency.Source: §V · p. 6
  • Some Alice–Bob and Alice–Charlie channels allow quantum signatures while practical QKD has zero key-generation rate.The paper attributes the gap to the signature scheme omitting the inefficient error-correction process.Source: §V · p. 6

VI. DISCUSSION

The protocol is proven unconditionally secure against coherent attacks without trusted quantum channels and reduces the required signature length. It uses fewer transmitted states than earlier schemes and has a less strict channel-noise threshold than QKD.

VI. DISCUSSION

  • The protocol is proven unconditionally secure against coherent attacks and removes trust assumptions on participant quantum channels.These are stated as improvements over previous quantum signature protocols.Source: §VI · p. 6
  • 6.3×10^8 quantum states per bit are estimated for a 50 km signature, versus O(10^10) states for previous protocols over 1 km at the same stated security level.The estimate uses signature length L = 7.71×10^5 for each one-bit message value and requires probabilities in (11), (14), and (15) below 10^-4.Source: §VI · p. 6
  • Bob and Charlie send different states to Alice, avoiding the legitimate copies available to potential forgers in earlier protocols and reducing required signature length.The paper says this also avoids the problem of colluding forgers having multiple legitimate copies when generalising to N participants with up to t dishonest parties.Source: §VI · p. 6
  • The Alice–Bob and Alice–Charlie channel-noise threshold is less strict for signatures than for QKD, so direct signatures can remain possible where QKD-based signature protocols cannot.The paper identifies P2 of as an example of a QKD-based protocol and concludes direct quantum protocols are sometimes preferable.Source: §VI · p. 6

Appendix A: Finite-size estimates

The appendix describes finite-size estimates for decoy-state counts and error quantities. It bounds unobserved X-basis phase errors using Z-basis bit errors and finite-sample statistics.

Appendix A: Finite-size estimates

  • The estimates cover zero- and one-photon X-basis counts and the X-basis phase-error rate.The X-basis phase errors are not directly observed; the analysis relates them to the Z-basis bit-error rate.Source: Appendix A · p. 7
  • Hoeffding inequalities bound finite-sample X-basis counts around observed statistics with probability at least 1 − ϵ_PE.Replacing expected counts with worst-case finite-size estimates gives a lower bound on s_X,0 holding with probability at least 1 − 2ϵ_PE.Source: Appendix A · p. 7
  • The upper bound on single-photon Z-basis bit errors is derived from observed intensity-specific error counts plus finite-size variations.The passage describes these intensity-specific bounds as upper and lower bounds on the true error counts.Source: Appendix A · p. 7

Appendix B: Proof of Proposition 1

Appendix B bounds Eve’s probability of guessing the key with fewer than a specified number of errors. It reduces the analysis to classical distributions, then relates an approximate distribution to the actual one.

Appendix B: Proof of Proposition 1

  • Eve’s optimal measurement produces a classical guess F, making the joint state of X and F representable as a probability distribution.The proof uses data processing to move from the quantum system to this classical description.Source: Appendix B · p. 7
  • The smooth min-entropy maximisation for a classical state can be achieved with classical τXF and σF.The proof dephases in the XF and F bases and uses that trace distance cannot increase under a CPTP map.Source: Appendix B · p. 7
  • The proof bounds Eve’s average probability of making at most r mistakes using a smooth-min-entropy bound.The bound is first stated under P′XF, which may be unnormalised, and then related to the actual distribution.Source: Appendix B · p. 8
  • The proof transfers the probability bound from P′XF to PXF, which is ε-close in L1 (or trace) distance.The marginal distribution of F and the classical min-entropy definition are used in the intermediate bound.Source: Appendix B · p. 8

Appendix C: Security against repudiation

Repudiation security follows from Bob and Charlie’s secret-channel symmetrisation: Alice’s success probability decreases exponentially with signature size. The parameter constraints place the honest error bound below the acceptance and verification thresholds, and the proposed parameter choice is not claimed to be optimal.

Appendix C: Security against repudiation

  • Bob and Charlie randomly receive half of each other’s strings, while Alice is assumed able to control both mismatch rates.The proof aims to show that every choice of eB and eC gives exponentially decreasing repudiation probability.Source: Appendix C · pp. 8–9
  • When eC > sa, Bob’s sample from Charlie’s string is hypergeometric, with expected mismatches eCL/2.Bob must select fewer than saL/2 mismatches to accept; when eC ≤ sa, the proof separately considers eB > sa and the case where both rates are at most sa.Source: Appendix C · p. 9
  • Alice’s repudiation probability decreases exponentially with signature size, with her best strategy at eB = eC = 1/2(sv + sa).The analysis bounds repudiation by Bob’s acceptance probability when eC > sa, and uses a union bound when both error rates are at most sa.Source: Appendix C · p. 9

1. Parameters and constraints

  • The parameters must satisfy eU_X < sa < sv < pE, with the choice aimed at minimising quantum transmissions per signed bit.That transmission count can exceed signature length L because of channel losses and parameter estimation.Source: §1 · p. 9
  • The proposed parameter choice is not necessarily optimal; more sophisticated optimisation may improve results.The authors choose to partition the gap between eU_X and pE equally as a natural choice.Source: §1 · p. 9

2. The number of quantum transmissions required per signed bit

The section estimates the quantum transmissions needed for a secure one-bit signature using experimental data for a 50 km channel. It specifies the operating assumptions and reports the expected X-basis error rate without a value in these passages.

2. The number of quantum transmissions required per signed bit

  • The estimate uses experimental data for a 50 km quantum channel and sets εPE = 10^-5.The stated security target is a rough estimate of states per possible message bit value.Source: §2 · p. 9
  • The experimental operating values include optical bit error rates QX = 1.38% and QZ = 0.76%.The source pulse rate is 1 GHz, with intensities (u1, u2, u3) = (0.425, 0.0435, 0.0022) and channel attenuation 0.2 dB/km.Source: §2 · pp. 9–10
  • Over 50 km, channel and detector transmission is η = 0.0107, and the retained and forwarded X-basis strings each have length L/2 = 3.86×10^5.Another k = 3.86×10^4 outcomes are used to estimate Alice–Bob X-basis correlations.Source: §2 · p. 10
Loading 1507.02975v2…