Quantum public-key encryption protocols
with information-theoretic security
Li Yang
∗
, Biyao Yang and Jiangyou Pan
State Key Laboratory of Information Security, Institute of Information Engineering, CAS,
Beijing 100195, China
Graduate University of Chinese Academy of Sciences, Beijing 100049, China
ABSTRACT
All of the widely used public-key encryption schemes will not remain their security in the environment of quan-
tum computing. We present here two quantum public-key encryption protocols of classical message, and show
that they can achieve information-theoretical security owing to a new type structure of public-key encryption
algorithm.
Keywords: quantum cryptography, quantum public-key encryption, information-theoretic security, chosen
plaintext attack, ciphertext-indistinguishability
1. INTRODUCTION
We need to find new public-key encryption schemes to resist the attacks of quantum adversaries.
1–3
One solution
is to construct quantum public-key encryption (QPKE). Okamoto et al.
4
introduced a scheme based on knap-
sack, and there is a quantum algorithm during his key generation phase. Gottesman
5
is the first to put forward
a protocol “quantum public key cryptography with information-theoretic security”, without proving its security.
Yang et al.
6, 7
investigated public-key encryption of quantum messages based on induced trap-door one-way
transformation. Kawachi et al. gave a QPKE schemes of “computational indistinguishability” of two quan-
tum states
8, 9
based on automorphism group of graphs problem. Nikolopoulos presented a quantum public-key
cryptography scheme
10
based on single-qubit rotations, and further studied its security.
11
The term “bounded information-theoretically secure” means that the number of bits which can be encrypted
with information-theoretic security has an upper bound. In Ref. 9, this bound of their protocol is proven to be
the number of bits of private keys,
12
thus it is much less than that of a practical one.
We have proposed a QPKE scheme of classical message with information-theoretic security.
13
In this talk, we
first introduce the definition of the information-theoretic security of a QPKE protocol. Then we give a general
description of our QPKE protocols. It is the new structure of the algorithms which ensures the information-
theoretic security. We then give two examples of this kind of schemes. The first one is designed using conjugate
coding of single-photon states, thus may be realized in near future. The second one makes use of entanglement
states. Both schemes are proved to be information-theoretic secure.
2. DEFINITION OF INFORMATION-THEORETIC SECURITY
The ciphertext-indistinguishability under chosen plaintext attack (IND-CPA)
14
can be understand as that while
the adversary chooses two plaintexts and is then given one of the corresponding ciphertexts, the adversary cannot
yet determine which plaintext corresponds to the previously unseen ciphertext he received.
Strictly speaking, the concept IND-CPA is defined as:
15
for every polynomial-size circuit family {C
n
},every
positive polynomial poly(·), all sufficiently large n, and every x, y in plaintext space,
|Pr[C
n
(G(1
n
),E
G(1
n
)
(x)) = 1] − Pr[C
n
(G(1
n
),E
G(1
n
)
(y)) = 1]| <
1
poly(n)
.
∗
Corresponding author. E-mail: yangli@iie.ac.cn
Quantum Optics II, edited by Thomas Durt, Victor N. Zadkov, Proc. of SPIE Vol. 8440,
84400E · © 2012 SPIE · CCC code: 0277-786X/12/$18 · doi: 10.1117/12.922444
Proc. of SPIE Vol. 8440 84400E-1