Formal Verification of Quantum Cryptography Dominique Unruh University of Tartu

Outline Quantum crypto: – What and why? – Challenges. Verification of quantum crypto – Motivation and challenges – Current work Dominique Unruh Verification of Quantum Crypto2

What is quantum cryptography? Dominique Unruh Verification of Quantum Crypto3 Cryptography involving quantum mechanics Security against quantum computers Using quantum mechanics in crypto protocols

What is quantum mechanics? Classical world Everything is in a well-defined state You can observe the state of a system Quantum world Things can be in “superposition” of several classical states Observation make the system jump into one possibility. Dominique Unruh Verification of Quantum Crypto4 ON OFF left right x=5 x=6 15% OFF + 85% ON x=5 but also a bit 6 What is x? Aha, 5. Where is my sock? Aha. Left foot. What is x? Aha, 5 Aha, 6

QM and computers Quantum mechanics used routinely in technology – Transistors are based on quantum effects But “hidden” from the user – A transistor implements a “classical” on/off switch – Programs can treat all variables as having definite values at any time Dominique Unruh Verification of Quantum Crypto5

Quantum computers Computer is in many states: “Quantum parallelism” Can be exploited – Under very specific conditions! We can: – Compute discrete logarithms (breaks ElGamal etc.) – Factor large integers (breaks RSA etc.) – Reduce the time for brute force attacks to the square root Dominique Unruh Verification of Quantum Crypto6

If quantum computers were here… Dominique Unruh Verification of Quantum Crypto7 ElGamal, RSA, elliptic curve crypto Lattice-based crypto, McEliece etc. Common symmetric crypto (AES etc.) All commonly used public key crypto: BROKEN Candidates for replacements: Exist, but not as well-studied Symmetric crypto: Double the key length! If quantum computers were available today… … we would be screwed.

The threat today Quantum computers do not exist Unclear when If we don’t start research now, major disaster when they come Research & awareness: now! Dominique Unruh Verification of Quantum Crypto8 “Post-quantum cryptography” (classical crypto, quantum-secure)

Quantum Protocols Use quantum communication to make impossible tasks feasible Best known example: Unconditionally secure key distribution Possible today! (No quantum computer needed.) (Not the main focus of this talk.) Dominique Unruh Verification of Quantum Crypto9

Post-quantum cryptography What must be done? 1.Identify assumptions that are not quantum- broken (e.g., lattice-based crypto, not RSA) 2.Build cryptosystems based on those 3.Prove security Dominique Unruh Verification of Quantum Crypto10 Needs quantum know-how/techniques Possible without “quantum literacy”?

The post-quantum fallacy Dominique Unruh Verification of Quantum Crypto11

Why is the fallacy wrong? Dominique Unruh Verification of Quantum Crypto12

Summary (so far) Post-quantum crypto: – Security of classical protocols against quantum attacks Finding quantum hard assumptions: Not enough Need quantum proof techniques  “Normal” cryptographers cannot verify their own schemes! Dominique Unruh Verification of Quantum Crypto13

Quantum Crypto & Verification Dominique Unruh Verification of Quantum Crypto14 Formal methods & security Symbolic models For classical protocols For quantum protocols Computational crypto Post-quantum crypto “Classical” proofs “Quantum” proofs Quantum protocols Nothing to do (?) ??? Existing tools? New languages and logics

Post-quantum crypto verification (computational / classical proto / quantum adv) Tools exist for computational verification CertiCrypt (relational Hoare) EasyCrypt (relational Hoare, higher level) CryptoVerif (rewriting, automated) Could those be quantum-sound? Dominique Unruh Verification of Quantum Crypto15

Quantum soundness of EasyCrypt Dominique Unruh Verification of Quantum Crypto16

Why EasyCrypt fails… Dominique Unruh Verification of Quantum Crypto17

“QuEasyCrypt” (work in progress…) Quantum language for crypto games – Follows EasyCrypt, no surprises Quantum Hoare Logic Quantum Relational Hoare Logic – Same intuition as probabilistic RHL – But semantics are quantum  rules must be refined Dominique Unruh Verification of Quantum Crypto18

Quantum Hoare Logic Dominique Unruh Verification of Quantum Crypto19

Classical Relational Hoare Logic Dominique Unruh Verification of Quantum Crypto20

Classical Relational Hoare Logic Dominique Unruh Verification of Quantum Crypto21 project to first project to second

Quantum Relational Hoare Logic? Dominique Unruh Verification of Quantum Crypto22

Quantum Relational Hoare Logic? Dominique Unruh Verification of Quantum Crypto23 project to first project to second project to first project to second

QuEasyCrypt – the future If you can use EasyCrypt, you can use QuEasyCrypt – Get post-quantum verification for free (when classical proof is quantum-sound) Verification of quantum protocols: – Should be possible – Time will show Dominique Unruh Verification of Quantum Crypto24

Summary Dominique Unruh Verification of Quantum Crypto25 Formal methods & security Symbolic models For classical protocols For quantum protocols Computational crypto Post-quantum crypto “Classical” proofs “Quantum” proofs Quantum protocols Nothing to do (?) ??? Existing tools? New languages and logics QuEasyCrypt?

Dominique Unruh Verification of Quantum Crypto26 Q? uestions? (Or catch me for offline discussion…)

I thank for your attention This research was supported by European Social Fund’s Doctoral Studies and Internationalisation Programme DoRa Logo soup