1. Semantic Security and Indistinguishability in the Quantum World
Tommaso Gagliardoni1, Andreas Hülsing2, Christian Schaffner3
1 IBM Research, Swiss; TU Darmstadt, Germany 2 TU Eindhoven, The Netherlands 3University of Amsterdam, CWI, QuSoft, The Netherlands
Crypto Working Group, Utrecht, NL 24/03/2017

2. Introduction

3. Symmetric encryption E = (Kg, Enc, Dec)
Plaintext 𝒎
Enc
Ciphertext 𝒓
Randomness
Secret key 𝐤
Plaintext 𝒎
Dec
Ciphertext

4. Adversaries I: Classical Security
Adversary = probabilistic polynomial time (PPT) algorithm

5. Adversaries II: Post-Quantum Security
Adversary = bounded-error quantum polynomial time (BQP) algorithm

6. Adversaries III: Quantum Security
Still classical ! E
Adversary = bounded-error quantum polynomial time (BQP) algorithm

7. Why should we care? Use in protocols Quantum cloud Quantum obfuscation
Side-channel attacks that trigger some measurable quantum behaviour
Oh, and because we can!

8. Semantic security (SEM)
Simulation-based security notion
Captures intuition: It should not be possible to learn anything about the plaintext given the ciphertext which you could not also have learned without the ciphertext.

9. Semantic security (SEM): Challenge phase
( 𝑺 𝒏 ,𝒉,𝒇)
𝒎⟵ 𝑺 𝒏 , 𝒄=𝑬𝒏 𝒄 𝒌 𝒎 ,
(𝒄,𝒉(𝒎))
(𝒇(𝒎)) A C
A cannot do significantly better in the above game than a simulator S that does not receive 𝑐.

10. Indistinguishability (IND) (of ciphertexts)
Pure game-based notion (no simulator)
Easier to work with than SEM
Intuition: You cannot distinguish the encryptions of two messages of your choice
Shown to be equivalent to SEM!

11. Indistinguishability (IND): Challenge phase
( 𝒎 𝟏 , 𝒎 𝟐 )
𝒃 ⟵ 𝑹 {𝟎,𝟏}, 𝒄=𝑬𝒏 𝒄 𝒌 𝒎 𝒃 , 𝒄 𝒃 A C
A cannot output correct b with significantly bigger probability than guessing.

12. Chosen plaintext attacks (CPA)
Adversary might learn encryptions of known messages
To model worst case: Let adversary chose messages
Can be combined with both security notions – IND & SEM
Normally: Learning phases before & after challenge phase

13. CPA Learning phase A C 𝒎 𝒄=𝑬𝒏 𝒄 𝒌 𝒎 𝒄
𝒄=𝑬𝒏 𝒄 𝒌 𝒎 𝒄 A C
A can ask 𝑞∈𝑝𝑜𝑙𝑦(𝑛) queries in all learning phases.

14. IND-CPA A C 𝒎 𝒄=𝑬𝒏 𝒄 𝒌 𝒎 , 𝒄 ( 𝒎 𝟏 , 𝒎 𝟐 ) 𝒃 ⟵ 𝑹 {𝟎,𝟏}, 𝒄=𝑬𝒏 𝒄 𝒌 𝒎 𝒃 ,
Learning I
𝒄=𝑬𝒏 𝒄 𝒌 𝒎 , 𝒄
( 𝒎 𝟏 , 𝒎 𝟐 )
𝒃 ⟵ 𝑹 {𝟎,𝟏}, 𝒄=𝑬𝒏 𝒄 𝒌 𝒎 𝒃 , 𝒄
Challenge A 𝒎
𝒄=𝑬𝒏 𝒄 𝒌 𝒎 ,
Learning II 𝒄 C 𝒃
Finish
A cannot output correct b with significantly bigger probability than guessing.

15. Quantum security notions

16. Previous work
[BZ13] Boneh, Zhandry: "Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World", CRYPTO'13 Model encryption as unitary operator defined by: 𝑥,𝑦 𝑥, 𝑦 → 𝑥,𝑦 𝑥, 𝑦 ⨁𝐸𝑛 𝑐 𝑘 (𝑥) (where 𝐸𝑛 𝑐 𝑘 (∙) is a classical encryption function)

17. Indistinguishability under quantum chosen message attacks (IND-qCPA)
Give adversary quantum access in learning phase
Classical challenge phase

18. IND-qCPA A C 𝑥, 𝑦 𝑥, 𝑦 → 𝑥, 𝑦 ⨁𝐸𝑛 𝑐 𝑘 (𝑥) ( 𝒎 𝟏 , 𝒎 𝟐 )
𝑥, 𝑦 → 𝑥, 𝑦 ⨁𝐸𝑛 𝑐 𝑘 (𝑥)
( 𝒎 𝟏 , 𝒎 𝟐 )
𝒃 ⟵ 𝑹 {𝟎,𝟏}, 𝒄=𝑬𝒏 𝒄 𝒌 𝒎 𝒃 , 𝒄
𝑥, 𝑦 A C
𝑥, 𝑦 → 𝑥, 𝑦 ⨁𝐸𝑛 𝑐 𝑘 (𝑥) 𝒃
A cannot output correct b with significantly bigger probability than guessing.

19. Indistinguishability under quantum chosen message attacks (IND-qCPA)
Give adversary quantum access in learning phase
Classical challenge phase
Can be proven strictly stronger than IND-CPA
Why would you do this?
If we assume adversary has quantum access, why not also when it tries to learn something new?

20. Fully-quantum indistinguishability under quantum chosen message attacks (fqIND-qCPA)
Give adversary quantum access in learning phase
Quantum challenge phase

21. fqIND-qCPA A C 𝑥, 𝑦 𝑥, 𝑦 → 𝑥, 𝑦 ⨁𝐸𝑛 𝑐 𝑘 (𝑥)
𝑥, 𝑦 → 𝑥, 𝑦 ⨁𝐸𝑛 𝑐 𝑘 (𝑥)
𝑏 ⟵ 𝑅 {0,1}, 𝑥 1 , 𝑥 2 , 𝑦 → 𝑥 1 , 𝑥 2 , 𝑦 ⨁𝐸𝑛 𝑐 𝑘 ( 𝑥 𝑏 )
𝑥 1 , 𝑥 2 , 𝑦
𝑥, 𝑦 A C
𝑥, 𝑦 → 𝑥, 𝑦 ⨁𝐸𝑛 𝑐 𝑘 (𝑥) 𝒃
A cannot output correct b with significantly bigger probability than guessing.

22. fqIND is unachievable [BZ13]

23. fqIND is unachievable [BZ13]

24. fqIND is unachievable [BZ13]

25. [BZ13] & our contribution

26. [BZ13] & our contribution

27. How to define qIND-qCPA?

28. How to define qIND-qCPA?

29. How to define qIND-qCPA?

30. How to define qIND-qCPA?

31. Model: (O) vs (C)
(O)
(C)

32. Model: (Q) vs (c)
(Q)
(c)

33. Model: Type (1) vs type (2)

34. Quantum indistinguishability (qIND)

35. Quantum indistinguishability (qIND)

36. Separation example

37. Separation example

38. Separation example

39. Impossibility result

40. Impossibility result

41. The attack

42. The attack

43. The attack

44. The attack

45. The attack

46. The attack

47. The attack

48. The solution

49. The solution

50. The solution

51. The solution

52. The solution

53. Secure Construction

54. Conclusion

55. https://eprint.iacr.org/2015/355
Thank you!
Questions?