Insider-Proof Encryption with Applications for Quantum Key Distribution

Abstract

We introduce insider-proof private channels which are private channels that additionally allow for security even when the key is correlated with the message. This prevents an insider, who has access to secret keys and the capability of choosing messages to be sent on the channel, from signalling to someone who can read the ciphertexts. We give a construction for approximately insider-proof private channels using 2-universal hash functions.

Quantum key distribution (QKD) offers the promise of information-theoretically secure communication, provided a number of assumptions are met. Ideally, the number of these assumptions required in a protocol should be reduced to a minimum. This is the motivation behind device independent QKD (DIQKD) protocols which use an adversarial model for the quantum devices. However, a previous report [3] pointed out that current protocols for DIQKD can leak key to an outside adversary when devices are used repeatedly. We show how to use the insider-proof private channel to allow DIQKD protocols to reuse devices any desired number of times without leaking information.

Appendices

A Security of DIQKD Using an Insider-Proof Channel

In order to complete a QKD protocol Alice and Bob will require a series of communication channels back and forth which they have authenticated. When the devices in Alice and Bob’s labs may have some sensitive information in their memories, then some of these channels must be private channels, in order to show security.

Again, let the quantum state just after step $t$ be $\rho ^{(t)}$. At first, let us analyze the protocol assuming we start with a perfect key so that $p^{(0)} = U_{K}^{(3n)} \otimes \sigma _{D} \otimes \tau _{E}$. After step 1, Alice and Bob share with Eve the state $\rho _{ABE}$. They pick measurements and get outcomes in registers $A'$ and $B'$, so that their shared state becomes $\rho ^{(1)}$, where

$$\begin{aligned} \rho ^{(1)}&= U_{K}^{(3n)} \otimes \sigma _D \ \otimes \sum _{o_{m_{A}},o'_{m_{B}}} p(o_{m_{A}},o'_{m_{B}}) \left| o_{m_{A}} \right\rangle _{A'}\left\langle o_{m_{A}} \right| \nonumber \\&\qquad \qquad \qquad \qquad \qquad \otimes \left| o'_{m_{B}} \right\rangle _{B'}\left\langle o'_{m_{B}} \right| \otimes \rho ^{(o_{m_{A}},o'_{m_{B}})}_{E} \ . \end{aligned}$$

(21)

Now in step 2, Alice uses a public channel to send Bob her measurement choices $m_A$ and Bob can also use a public channel to send Alice his choices $m_B$. Alice will prepare a private message for Bob that includes a subset $a$ of her outcomes $o_{m_{A}}$. She then implements (in step 3) an insider-proof quantum channel to Bob, according to Protocol 4.

We can alter $\varPhi _{ABC}$ to take the string in register $K$ as part of the input state rather than a parameter that defines $\varPhi _{ABC}$. In all other respects, the channel is unchanged. Let the new channel be $\varPhi '_{ABC}$. Then from Definition 2,

$$\begin{aligned} \left| \left| \mathrm{Tr }_K \varPhi _{AB}^{IPC} \otimes I_{D} \otimes \varPsi _{CE}(U_K\otimes \rho ) - \mathrm{Tr }_K \varPhi '_{ABC} \otimes I_{DE}(U_K\otimes \rho )\right| \right| _{1} \le \epsilon \ . \end{aligned}$$

(22)

Let the register $A$ contain the subset of outcomes (so $a$ is a function of $o_{m_{A}}$. Then after an ideal private channel the state will be $\rho ^{(3)}$ such that:

$$\begin{aligned} \left| \left| \rho ^{(3)} - \xi ^{(3)}\right| \right| _1 \le \epsilon \ . \end{aligned}$$

(23)

where

$$\begin{aligned} \xi ^{(3)}&:= U_K^{(2n)} \otimes \sigma _D \otimes \sum _{o_{m_{A}},o'_{m_{B}}} p(o_{m_{A}},o'_{m_{B}}) \left| a \right\rangle _A\left\langle a \right| \otimes \left| o_{m_{A}} \right\rangle _{A'}\left\langle o_{m_{A}} \right| \nonumber \\&\qquad \qquad \otimes \left| a \right\rangle _B\left\langle a \right| \otimes \left| o'_{m_{B}} \right\rangle _{B'}\left\langle o'_{m_{B}} \right| \otimes \rho ^{(o_{m_{A}},o'_{m_{B}})}_{E}\otimes I_{C,R} \ . \end{aligned}$$

(24)

Bob will also have to reply in step 4, again using an insider-proof channel twice. First he sends a one-bit message about whether to abort and second he sends the error correction information. For an ideal private channel:

$$\begin{aligned} \left| \left| \rho ^{(4)} - \xi ^{(4)}\right| \right| _1 \le 3\epsilon \ . \end{aligned}$$

(25)

where

$$\begin{aligned} \xi ^{(4)}&:= \sigma _D \otimes \sum _{o_{m_{A}},o'_{m_{B}}} p(o_{m_{A}},o'_{m_{B}}) \left| b \right\rangle _A\left\langle b \right| \otimes \left| o_{m_{A}} \right\rangle _{A'}\left\langle o_{m_{A}} \right| \nonumber \\&\qquad \ \ \otimes \left| b \right\rangle _B\left\langle b \right| \otimes \left| o'_{m_{B}} \right\rangle _{B'}\left\langle o'_{m_{B}} \right| \otimes \rho ^{(o_{m_{A}},o'_{m_{B}})}_{E} \otimes (I_{C,R})^{\otimes 3} \, . \end{aligned}$$

(26)

At this point, they arrive at identical raw keys with probability $1-\epsilon _{EC}$, where Alice and Bob can choose $\epsilon _{EC}$ arbitrarily small. Then,

$$\begin{aligned} \left| \left| \rho ^{(5)} - \xi ^{(5)}\right| \right| _1 \le 3\epsilon + \epsilon _{\text {EC}} + \epsilon _{\text {PE}} \ , \end{aligned}$$

(27)

defining

$$\begin{aligned} \xi ^{(5)} := \sigma _D \otimes \sum _{o_{m_{A}},o'_{m_{B}}} p(o_{m_{A}},o'_{m_{B}}) \left| k_{\text {raw}} \right\rangle _{A'}\left\langle k_{\text {raw}} \right| \otimes \left| k_{\text {raw}} \right\rangle _{B'}\left\langle k_{\text {raw}} \right| \otimes \rho ^{(o_{m_{A}},o'_{m_{B}})}_{E} \ , \end{aligned}$$

(28)

where we dropped the $C$ and $R$ registers for convenience, and $k_{\text {raw}}$ still depends on $o_{m_{A}}$ and $o'_{m_{B}}$. They then implement a privacy amplification hash in step 6 and let us define $\epsilon _{\text {qkd}} = \epsilon _{\text {EC}} + \epsilon _{\text {PE}} + \epsilon _{\text {PA}}$. So now we are left with a state $\rho ^{(6)}_{A'B'CDER}$ such that:

$$\begin{aligned} \left| \left| \rho ^{(6)}_{A'B'CDER} - \mathcal {U}_{A'B'} \otimes \sigma _{D} \otimes \tau '_{CER} \right| \right| _{1} \le 3\epsilon +\epsilon _{\text {qkd}} \ . \end{aligned}$$

(29)

where $\mathcal {U}_{A'B'}$ is the normalized uniform distribution over all strings of a given length and we have followed the standard analysis (see eg. [15]) for the overheads of a single round of QKD. We can write this instead as

$$\begin{aligned} \left| \left| \varPhi _{\text {prot}}(U_{K}\otimes \sigma _{D} \otimes \tau _{E}) - \varPhi _{\text {ideal}}(U_{K}\otimes \sigma _{D} \otimes \tau _{E}) \right| \right| _{1} \le 3\epsilon +\epsilon _{\text {qkd}} \ . \end{aligned}$$

(30)

where $\varPhi _{\text {prot}}$ is the action of the entire modified QKD protocol and $\varPhi _{\text {ideal}}$ is an ideal protocol that shares key between Alice and Bob while leaking nothing to Eve.

Now let us relax the assumption of a perfect key. Instead, assume that Alice and Bob have already successfully grown some key using a DIQKD protocol, secure against malicious devices with memory. Before step 1, we assume that Eve has bounded correlations with these keys:

$$\begin{aligned} \left| \left| \rho _{KDE} - U_{K} \otimes \sigma _{D} \otimes \tau _{E} \right| \right| _{1} \le \epsilon _0 \ . \end{aligned}$$

(31)

We can apply $\varPhi _{\text {prot}}$ to both states in the above bound. Then using the data processing inequality, we have

$$\begin{aligned} \left| \left| \varPhi _{\text {prot}}(\rho _{KDE}) - \varPhi _{\text {prot}}(U_{K} \otimes \sigma _{D} \otimes \tau _{E}) \right| \right| _{1} \le \epsilon _0 \ . \end{aligned}$$

(32)

We can use the triangle inequality on Eqs. (30) and (32), to finally obtain

$$\begin{aligned} \left| \left| \varPhi _{\text {prot}}(\rho _{KDE}) - \varPhi _{\text {ideal}}(U_{K} \otimes \sigma _{D} \otimes \tau _{E}) \right| \right| _{1} \le \epsilon _0 + 3\epsilon +\epsilon _{\text {qkd}} \ . \end{aligned}$$

(33)

Now, let us back up a minute and consider what happens if Alice and Bob need to abort in step 4. Implementing the insider-proof channel uses up their store of private key. Asymptotically, the largest amount of key will be used to send the error correction information. However, if they abort, there is no need to send this. By using separate applications of the channel, after sending the signal to abort, Bob is free to not use the insider-proof channel and instead send a random string. This is fine, since referring to Protocol 1 the contents of $R$ are uniformly random, and, looking at Eq. (12), the contents of $C$ cannot be distinguished from a uniform string by the adversary, except with probability $\epsilon$. Therefore, in the case of an abort, the largest share of the cost of establishing a insider-proof channel can be avoided by breaking up Bob’s messages in this way.

Notice also that extending each state in the norm in Eq. 33 to a larger Hilbert space by tensor product with a state corresponding to a uniformly random $n$-bit string $2^{-n}\sum _x \left| x \rangle \langle x \right|$ will not increase the trace distance. Therefore, all encoded messages sent from Alice can be assumed to have a fixed length and remain secure.

B Aborts

It may happen that on some rounds Alice and Bob must abort the protocol. However, since the devices that Alice and Bob use can cause an abort even on a “good” state $\rho _{A'B'E}$, they can use this as a pretext to signal to Eve, as was observed in [3]. Therefore, Alice and Bob must hide aborts when they occur. As explained in Sect. 3.2, they can do this since they have encrypted the parameter estimation bits and will also encrypt Bob’s signal as to whether or not to abort. If they abort, they pretend to continue the protocol, but instead of exchanging encrypted information to perform error correction, they send random strings. In this round they do not gain any additional key, but also Eve does not learn that they aborted.

Another concern is that it is possible for the boxes to conduct a denial-of-service attack until Alice and Bob run out of key. If this should occur before the number of rounds that Alice and Bob had agreed to use the devices for, this would also constitute a signal to Eve. They must hide this also, so should it occur, Alice and Bob should simulate the remaining rounds of key growth (sending each other random strings) and then destroy the adversarial boxes securely. This is not a foolproof solution however, since in the meantime Alice and Bob may need to communicate privately. Thus at some point they will be forced to re-key and there is no reason to assume Eve will not notice this. Therefore, it is conceivable that she may gain some information from the fact that this has happened and it seems there is no way to completely avoid that, though Alice and Bob could keep a piece of their initial authentication key from before the first round against this eventuality. (This is similar to the case in trusted-device QKD when Eve executes repeated denial-of-service attacks on Alice and Bob until they run out of key.)

It appears that in this model we cannot think about each run of the device independent protocol as a stand-alone element in a universal composability scheme, in which it is public information how much key they have at any given time. Alice and Bob certainly do not want to output on each round whether they succeeded or failed in obtaining key. This may lead to additional considerations. For example, the adversary may expect Alice and Bob to send a one-time-pad encoded message at a particular time during the multi-round life of the devices when they do not have key available to devote to the purpose. If this occurs they can still avoid leaking information to the adversary by sending a random string of the appropriate length instead. (However, this does not accomplish the communication task Alice and Bob presumably wished to accomplish.) Note that in this case, Alice and Bob have to consider their quantum key distribution in the wider setting in which it is employed to avoid leaking information. Nevertheless, when key is generated in the DIQKD scheme, the resulting key is secure under the trace distance definition given in [15].