Source-linked AI summary
The Laws of Physics and Cryptographic Security
Terry Rudolph
TL;DR
The paper examines what cryptographic security means when physical laws and implementations are considered, including how abstract protocols connect to real devices. It argues that oblivious transfer is inconsistent with quantum mechanics because its required states and operators do not exist in any complex Hilbert space.
Problem
The paper asks how cryptographic security changes when information theory and security are considered in the light of physics.
Source: Two basic cryptographic principles · p. 1Method
The paper examines cryptographic requirements as constraints on physical systems and tests whether states and operators satisfying oblivious transfer’s requirements can exist.
Source: The necessity of incorporating physics… · p. 4Results
States and operators satisfying oblivious transfer’s requirements do not exist in any complex Hilbert space.
Source: The necessity of incorporating physics… · p. 4Takeaways & Limitations
The paper concludes that ultimate limits to security lie in physics, while noting that the issues discussed are currently less urgent than weaker links in cryptographic systems.
Source: InConclusions · p. 11Formal security for an abstract protocol may omit physical elements and degrees of freedom present in its implementation.
Source: Two basic cryptographic principles · p. 2
Abstract
from arXiv · showhide
This paper consists of musings that originate mainly from conversations with other physicists, as together we've tried to learn some cryptography, but also from conversations with a couple of classical cryptographers. The main thrust of the paper is an attempt to explore the ramifications for cryptographic security of incorporating physics into our thinking at every level. I begin by discussing two fundamental cryptographic principles, namely that security must not rely on secrecy of the protocol and that our local environment must be secure, from a physical perspective. I go on to explain why by definition a particular cryptographic task, oblivious transfer, is inconsistent with a belief in the validity of quantum mechanics. More precisely, oblivious transfer defines states and operations that do not exist in any (complex) Hilbert space. I go on to argue the fallaciousness of a "black box" approach to quantum cryptography, in which classical cryptographers just trust physicists to provide them with secure quantum cryptographic sub-protocols, which they then attempt to incorporate into larger cryptographic systems. Lest quantum cryptographers begin to feel too smug, I discuss the fact that current implementations of quantum key distribution are only technologically secure, and not "unconditionally" secure as is sometimes claimed. I next examine the concept of a secure lab from a physical perspective, and end by making some observations about the cryptographic significance of the (often overlooked) necessity for parties who wish to communicate having established physical reference frames.
Two basic cryptographic principles
The paper asks cryptographers to consider security in light of physics, emphasizing two principles: protocols must not depend on secrecy, and parties need secure local environments. Applying these principles requires connecting abstract protocols to their physical implementations.
Two basic cryptographic principles
- Protocol security must not depend on secrecy of either the abstract protocol or the physical devices and operations used to implement it.Adversaries are assumed to know the devices and experimental operations involved.Source: Two basic cryptographic principles · pp. 1–2
- Parties should trust the integrity of their laboratories, not physical events in the external universe.The principle allows the outside world to be controlled by adversaries limited only by the laws of physics.Source: Two basic cryptographic principles · pp. 1–2
- Implementing an abstract protocol requires a bridge principle linking its mathematical instructions to experimental operations, and that choice becomes part of the chain of belief underlying security.Implementations can involve physical elements and degrees of freedom beyond those required by the abstract protocol, which formal security proofs may ignore.Source: Two basic cryptographic principles · p. 2
The necessity of incorporating physics in cryptography
The paper argues that cryptographic security must be considered in its physical implementation, not only in abstract protocol definitions. It shows that oblivious transfer is inconsistent with quantum mechanics and that building larger protocols from apparently secure components requires care.
The necessity of incorporating physics in cryptography
- The paper argues that treating quantum sub-protocols as secure black boxes is flawed because larger cryptographic systems require physical considerations at every step.Its example builds bit commitment on oblivious transfer and shows that a seemingly secure component does not guarantee arbitrarily secure composition.Source: The necessity of incorporating physics… · pp. 3, 5, 6
- No states and operators in any complex Hilbert space satisfy the stated oblivious-transfer requirements, so OT is inconsistent with quantum mechanics.The paper distinguishes this task-level inconsistency from the separate question of whether a protocol can implement a consistent task.Source: The necessity of incorporating physics… · p. 4
- Alice can use superposed even-parity strings to retain a purification of the systems sent to Bob, then choose how to unveil later.Measuring her ancillas to learn the transferred bits would destroy her ability to cheat.Source: The necessity of incorporating physics… · p. 6
- For the proposed bit-commitment construction, the cheating parameters obey f + d ≥ 1, so varying M and N cannot make both approach zero.Under optimal cheating strategies, the resulting bit commitment remains partially secure; the paper says the argument concerns this particular construction, while the exact attainable security remains open.Source: The necessity of incorporating physics… · p. 6
- Security claims depend on whether actual experimental operations are isomorphic to the abstract protocol, adding an implementation-specific link to the chain of belief.The paper notes that adversaries may be technologically unable to use some cheating strategies, but that makes security depend on beliefs about their capabilities.Source: The necessity of incorporating physics… · pp. 6–7
The desirability of incorporating physics in cryptography
Quantum cryptography offers an avenue to break knowledge symmetry, while non-orthogonal states and quantum cheating introduce security tradeoffs.
The desirability of incorporating physics in cryptography
- The paper argues that two-party quantum cryptography should interest cryptographers because it connects to one-way functions, knowledge symmetry, and cheat sensitivity.The analysis of two-player games shares a lot in common with that of two-party cryptography.Source: The desirability of incorporating… · p. 7
- Non-orthogonal states prevent Bob from determining exactly what Alice sent, while also preventing Alice from verifying with absolute certainty what she sent.The paper suggests that the tradeoff between these certainties may determine absolute limits on two-party protocols.Source: The desirability of incorporating… · p. 7
- Quantum cryptography breaks knowledge symmetry through bounded-security oblivious transfer, but no arbitrarily secure two-party quantum protocols are known.Trusted shared entanglement leaves bit-commitment security bounds unaffected, while making coin-flipping trivial.Source: The desirability of incorporating… · p. 7
- Quantum communication can make cheating detectable because a cheater’s actions generically disturb transmitted quantum states.Cheating can also lower a party’s ability to detect whether the other party is cheating, creating unexplored tradeoffs when parties assign costs to being caught.Source: The desirability of incorporating… · p. 7
Different conceptions of security
The paper distinguishes technological, information-theoretic, and physical security by the assumptions each places at the foundation of security.
Different conceptions of security
- Technological security rests on presumed limits to adversaries’ capabilities; RSA relies on factoring difficulty, and one-way functions are easy to compute but hard to invert.Factoring is not impossible in principle, and a future quantum computer might compromise RSA; current QKD implementations are also argued to be mostly technologically secure.Source: Different conceptions of security · pp. 7–8
- Information-theoretic security avoids complexity-theoretic assumptions such as factoring difficulty, but the paper questions whether quantum information theory is universally applicable.The paper notes that quantum-information-theoretic security may be viewed as true security, while standard information-theoretic security may be only classical-information-theoretic security.Source: Different conceptions of security · p. 8
- Physical security rests on the truth of the physical laws currently understood, so it remains a degree of belief and should specify the theory relied upon.The paper favors protocols relying on general principles expected to survive future theories, while noting that even an extensively tested theory offers no final certificate of completeness.Source: Different conceptions of security · p. 8
Why quantum cryptographers should not be too smug
The paper argues that current QKD implementations are technologically secure rather than unconditionally secure, without claiming that idealized QKD protocols are insecure. A timing-based attack illustrates how implementation details can undermine the security interpretation of Bell-inequality tests.
Why quantum cryptographers should not be too smug
- Most, if not all, current QKD experiments are only technologically secure, not unconditionally secure; the paper presents one presumably nonoptimal attack rather than asserting idealized-protocol insecurity.The attack is intended to question where users place their faith in QKD's chain of belief.Source: Why quantum cryptographers should not… · p. 8
- In the idealized protocol, a sufficient Bell-inequality violation indicates Eve has not gained enough information, but the attack can preserve that violation while Eve knows Bob's accepted outcomes.The idealized security argument assumes an adversary constrained by quantum mechanics.Source: Why quantum cryptographers should not… · p. 9
- Eve can exploit coincidence filtering by replacing the lossy channel and sending photons that arrive only when Bob's setting matches hers, revealing Bob's accepted outcomes.The paper says the attack also works against current BB84 and B92 implementations.Source: Why quantum cryptographers should not… · pp. 8–9
- The attack's relevance depends on whether such photons are physically possible; the paper notes that subtle optical differences between Bob's settings might make simple versions feasible.Security proofs may assume incoming states occupy a specified subspace, but ensuring the channel satisfies that assumption is not trivial.Source: Why quantum cryptographers should not… · p. 9
Is the Physicist’s Version of Principle 2 actually reasonable?
The paper questions whether physics can guarantee a perfectly secure laboratory against both external penetration and information leakage. It also argues that communication with small quantum systems requires physical reference frames, whose establishment and maintenance create cryptographic concerns.
Is the Physicist’s Version of Principle 2 actually reasonable?
- A physically secure lab would need both impenetrability to active attacks and freedom from informative emanations; detecting penetration would make security technological again.Penetration could gather information or alter conditions and devices inside the lab.Source: Is the Physicist’s Version of… · p. 10
- Whether a lab can ensure that all emanations leak at most exponentially small useful information remains an unanswered physical question.A completely emanation-free lab may be impractical for information processing, while thermal equilibrium would also limit processing.Source: Is the Physicist’s Version of… · p. 10
- Spin states and photon polarizations require agreed spatial reference frames for classical communication, and polarization additionally depends on the labs' relative orientation.The paper describes establishing a frame through exchanged particles or external reference points, with the process itself raising security concerns.Source: Is the Physicist’s Version of… · pp. 10–11
- Quantum communication in coherent superpositions also requires a shared time standard for relative phase, and reference frames cannot remain fixed indefinitely.Recalibration through external points or exchanged systems may require trust beyond the lab or in adversary-determined systems.Source: Is the Physicist’s Version of… · p. 11
InConclusions
The paper explores a small subset of issues raised by incorporating physics into cryptographic thinking. Although these issues are presently less relevant than weaker links in cryptographic systems, the author locates ultimate security limits in physics and characterizes security as a subjective belief.
InConclusions
- The issues discussed are presently less relevant than weaker links in cryptographic systems, but the author argues that ultimate security limits lie in physics.Security is described as a subjective feeling based on an individual's beliefs, rather than something that can be proven.Source: InConclusions · p. 11