Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World

Abstract

We initiate the study of quantum-secure digital signatures and quantum chosen ciphertext security. In the case of signatures, we enhance the standard chosen message query model by allowing the adversary to issue quantum chosen message queries: given a superposition of messages, the adversary receives a superposition of signatures on those messages. Similarly, for encryption, we allow the adversary to issue quantum chosen ciphertext queries: given a superposition of ciphertexts, the adversary receives a superposition of their decryptions. These adversaries model a natural ubiquitous quantum computing environment where end-users sign messages and decrypt ciphertexts on a personal quantum computer.We construct classical systems that remain secure when exposed to such quantum queries. For signatures, we construct two compilers that convert classically secure signatures into signatures secure in the quantum setting and apply these compilers to existing post-quantum signatures. We also show that standard constructions such as Lamport one-time signatures and Merkle signatures remain secure under quantum chosen message attacks, thus giving signatures whose quantum security is based on generic assumptions. For encryption, we define security under quantum chosen ciphertext attacks and present both public-key and symmetric-key constructions.

Practical Lattice-Based Digital Signature Schemes

“…Although making the DSSs less efficient, schemes by Gentry et al [2008] and Lyubashevsky [2012] are respectively shown by Boneh and Zhandry [2013] and Dagdelen et al [2013] to be secure to such an adversary, creating the quantum random oracle model. This could also motivate an important area for future research, such as proving security for more DSSs to a quantum adversary or possibly creating a generic technique that could turn a DSS secure in the random oracle model to one secure in the quantum random oracle model.…”

On Quantum Chosen-Ciphertext Attacks and Learning with Errors

“…This leads to natural security notions for symmetric-key encryption, which we call IND-QCCA1 and SEM-QCCA1, respectively. Following previous works, it is straightforward to define both IND-QCCA1 and SEM-QCCA1 formally, and prove that they are equivalent [BJ15; GHS16;BZ13b].…”

A Post-quantum Digital Signature Scheme Based on Supersingular Isogenies

“…Granting A classical access to the simulated prover S P is analogous to granting the adversary access to a classical signing oracle in a chosen message attack in the context of signatures. We could allow A to have quantum access to S P , corresponding to a quantum chosen message attack as defined in [6]. We do not know whether Unruh's construction remains secure under this relaxation.…”