{"id":"f6e18d2b-e9fe-4039-958e-f7c141d42b09","arxiv_id":"1908.03436","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Secure quantum message transmission can be defined and proven in a finite, composable way, and common game-based definitions are stronger than necessary.","lead":"This paper introduces finite, composable security definitions for quantum message transmission, replacing asymptotic game-based notions with explicit resource constructions. It is worth reading because concrete security statements like these are what actually justify trusting implementations of quantum cryptography.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 2's PMCC proof relies on overline resources that are not well-defined for the ideal channel; the security bound is unproven as written.","rationale":"The reader's stated weakest assumption was the finite PRF instantiation; I find the Theorem 2 proof gap more load-bearing because it affects the validity of one of the two concrete constructions advertised in the abstract, independently of any asymptotic-versus-finite issue. The overline PMCC resource is not defined as a quantum comb, so the theorem's proof cannot be checked as written. This is a fixable exposition gap rather than a fundamental flaw: the underlying intuition (the distinguishing event is reusing a tag, occurring with probability at most l/2^ν, loosened to l^2/2^ν) is plausible, and the attack matching the 1/2^ν term exists, so the claimed order of magnitude is not contradicted. Theorem 1 for OSC uses a standard hybrid without overline ideal resources and does not suffer from the same problem. The framework itself, and the comparison results in Section 4, are independent of this gap. A conditional acceptance with a request to repair the proof of Theorem 2 is therefore appropriate, which matches the reader's CONDITIONAL verdict; hence I recommend no change to the verdict.","tokens_in":40095,"tokens_out":11695,"duration_ms":128911,"concrete_test":"Formally define the overline resources IC_l,m+ν_bar and PMCC_l,m_bar as quantum combs with explicit input/output Hilbert spaces and CPTP maps, and re-derive the claim dD(R_l_bar, S_l_bar) = 0 using Lemma 7 with an explicit reduction converter. If PMCC_l,m_bar cannot be expressed as a resource whose A interface has m qubits (because the rejection rule references tags), then the proof must be revised, e.g., by a direct multi-message hybrid that avoids comparing tags on the ideal A interface. A minimal check: for l=2, m=1, ν=1, write out the Choi states of R_2_bar and S_2_bar as defined in the proof; if they are not equal, the claimed bound needs a different argument.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 3.4, Theorem 2 claims that πAB constructs PMCC_l,m within l^2·2^-ν. The proof introduces overline resources R_l_bar and S_l_bar (around Eq. (13)) by requiring that 'IC and PMCC will reject any input from interface A if it contains the same tag x as previous input from interface E'. This is not a well-defined resource for the ideal PMCC_l,m: interface A of PMCC_l,m receives untagged m-qubit messages from Alice, so it contains no tag to compare with previous E inputs; tags exist only in real-world ciphertexts and in the simulator's outputs at interface E. Consequently S_l_bar is not a legitimate quantum comb, and the asserted equivalence dD(R_l_bar, S_l_bar) = 0 is unsupported. The claimed reduction to Lemma 7 (Appendix C) is also not explicit: Lemma 7 concerns one-message overline channels that reject A input after any E input, without tags and with message length m, whereas Theorem 2's overline channels are tag-dependent and have length m+ν. No converter or hybrid argument is supplied to bridge this gap. The PMCC construction is therefore not proven as stated. This is an internal proof gap, not a disagreement with external consensus.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a finite, composable, computational-security framework for quantum message transmission in the Abstract & Constructive Cryptography paradigm, instantiated with quantum combs. It defines channel resources (OSC, SC, NMCC, PMCC) and proves that a tagged, PRF-based variant of a one-time quantum authentication protocol constructs an OSC within l·ε_q-auth plus a PRF error (Theorem 1 and Corollary 3), and that a Pauli-pad-style protocol constructs a PMCC within l^2·2^{−ν} plus a PRF error (Theorem 2 and Corollary 4). It then shows that QAE security implies, but is strictly stronger than, constructing a secure channel (Theorem 3), and introduces RRC-QCCA2 and RRO-QCCA2, proving that RRO-QCCA2 (and, for a restricted class of schemes, RRC-QCCA2) implies constructing a non-malleable confidential channel, again with strict separation (Section 4.3, Theorem 4 and Corollaries 7–8).","tokens_in":40310,"tokens_out":13776,"duration_ms":157845,"significance":"If the results hold, this is a valuable step toward placing computational security of quantum message transmission on a composable, finite footing: the definitions are operational, the reductions are explicit, and the game-based comparison clarifies the over-strength of QAE and QCCA2. The OSC construction (Theorem 1), the composition theorem, and the QAE/RRO-QCCA2 implications are supported by explicit hybrids and reductions. However, the proof of the PMCC construction (Theorem 2) contains a load-bearing gap concerning the overline resources and the reduction to the one-message lemma; until that is repaired, the second construction and its corollary are not established. The PRF-based bounds are also conditional on an assumed finite PRF advantage rather than an instantiated finite PRF.","major_comments":[{"comment":"The proof introduces overline resources R̄_l and S̄_l by requiring that 'IC and PMCC will reject any input from interface A if it contains the same tag x as previous input from interface E', but this condition is not well-defined for the ideal resource PMCC_{l,m}: interface A of PMCC_{l,m} receives untagged m-qubit messages, so there is no tag to compare with previous E inputs. Tags exist only in the real-world ciphertexts and in the simulator's outputs at interface E. Consequently S̄_l is not a legitimate quantum comb, and the asserted bound dD(R_l,S_l) ≤ dD(R̄_l,S̄_l) + l^2/2^ν is unsupported. The claimed reduction to Lemma 7 is also not explicit: Lemma 7 concerns one-message overline channels that reject an A input after any E input, without tags and with message length m, whereas Theorem 2's overline channels are tag-dependent and have message length m+ν. No converter or hybrid argument is supplied to bridge this gap. The PMCC construction is therefore not proven as stated.","section":"Section 3.4, Theorem 2 and Eq. (13)"},{"comment":"Even apart from the definitional issue above, the step 'Following from a standard hybrid argument, if a distinguisher D can distinguish R̄_l and S̄_l, it can be used to construct a distinguisher in the one-message scenario' is not backed by an explicit construction. One would need to show that the multi-message protocol with overline channels decomposes into l independent one-message instances under a converter that routes ciphertexts by their tags; because the tags are chosen freshly by Alice's computer and can be replayed by Eve, such a routing converter must be stateful and must keep track of the tag-to-instance mapping. This is exactly the point at which the missing tag in PMCC_{l,m} becomes relevant. Until this hybrid is supplied, the equality dD(R̄_l,S̄_l)=0 does not follow from Lemma 7.","section":"Section 3.4, proof of Theorem 2 (paragraph after Eq. (13))"}],"minor_comments":[{"comment":"The finite security statements are conditional on an assumed finite bound ε_PRF(D) for a concrete PRF family. The reference to [Zha12] provides an asymptotic construction, not an explicit finite bound for a specific PRF. Please state explicitly that the reductions are conditional on a finite PRF assumption and discuss how such a bound could be obtained, or provide an instantiation.","section":"Section 3.1 and Corollaries 3–4"},{"comment":"The results are proved in the sequential-scheduling quantum-combs model, which excludes superpositions of causal orders. The authors note that the Causal Boxes model [PMM+17] covers such settings; the paper should state prominently that the composability claims are limited to sequential scheduling.","section":"Section 2.4"},{"comment":"In the proof of Theorem 4 the ideal system is written as simqae_E [NMCC_l, QC_l_E], but it should be simqcca2_E; also the computing resource QCqcca2,l_E used in Corollaries 7 and 8 is not formally defined. Please fix the notation.","section":"Section 4.3, proof of Theorem 4 and Corollaries 7–8"},{"comment":"The bit-appending separation argument should spell out that the appended bit is part of the ciphertext state checked by the ideal decryption oracle, so flipping it causes the ideal oracle to return ⊥; as written, a reader might think the bit is ignored before the ideal game's matching step.","section":"Section 4.2, QAE separation"}],"recommendation":"major_revision","confidential_remarks":"To the editor: the central framework and the OSC and game-relation results are sound and likely publishable after revision, but the Theorem 2 proof gap is real and must be fixed. I do not see grounds for rejection, since the gap appears fixable by redefining the overline resources at the ciphertext/simulator level and providing an explicit hybrid to Lemma 7. The paper relies heavily on the authors' own AC framework, but the external benchmarks (Portmann's q-auth bound, Zhandry's PRFs, AGM18 games) are used appropriately."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper does something genuinely new: it gives finite, composable security definitions for computationally secure quantum message transmission, and proves that slightly modified versions of known protocols satisfy them with explicit reduction bounds. That is worth engaging with seriously. The constructive-cryptography framing is clear, the channel definitions are operational, and the OSC construction (Theorem 1) and the game-to-construction relations (Theorems 3 and 4) are argued carefully. The separations showing that QAE and QCCA2 are unnecessarily strong are also convincing and follow the classical template cleanly.\n\nThe main soft spot is real. Theorem 2, the PMCC construction, has a proof gap. The overline resources introduced there are supposed to reject inputs from interface A containing the same tag x as a previous input from interface E. But the ideal PMCC resource receives untagged m-qubit messages at interface A; there is no tag to compare. So the overline PMCC is not a well-defined resource, the claimed equivalence between the overline real and ideal systems is unsupported, and the reduction to Lemma 7 does not connect as written. This is an internal proof issue, not a disagreement with the framework, and it may well be repairable, but the construction is not proven as stated.\n\nA second, softer issue: the finite security statements are conditional on a finite PRF assumption, and the paper cites Zhandry for quantum-secure PRFs without giving a concrete finite instantiation with an explicit bound. That is fine for a framework paper, but it means the advertised implementer-facing guarantees are conditional until such an instantiation is supplied. The sequential-scheduling restriction is also a real limitation, but the paper says so itself, and it does not undermine the core contribution.\n\nWho is this for? Cryptographers working on quantum encryption, especially anyone building protocols from composable security definitions or comparing game-based versus constructive notions. The paper deserves a serious referee; my own verdict is conditional because of Theorem 2, not because the overall direction is wrong. I would send it to peer review and insist that the PMCC proof be rewritten with a well-defined ideal resource and an explicit hybrid.","headline":"Genuinely useful finite composable security definitions for quantum message transmission, with a real proof gap in the PMCC construction (Theorem 2) that must be fixed before publication.","tokens_in":40839,"tokens_out":1215,"would_cite":true,"duration_ms":16771,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["81P94"],"pacs":["03.67.Dd"],"model":"deepseek-v4-flash","headline":"Quantum message transmission can be given finite, composable, computational security by defining a scheme as a construction that turns an insecure channel plus a shared key into an ideal secure channel; the paper proves explicit bounds…","keywords":["finite security","composable security","quantum message transmission","quantum authentication","quantum encryption","pseudo-random functions","quantum combs","game-based security"],"falsifier":"Choose any fixed parameters and a candidate PRF family, and run the real and ideal systems of the OSC construction; if a distinguisher achieves advantage strictly greater than $\\epsilon_{\\mathrm{PRF}}(DC) + \\ell \\, \\epsilon_{\\mathrm{q\\text{-}auth}}$, then the paper's bound is false.","tokens_in":39886,"feed_emoji":"🔐","tokens_out":6295,"duration_ms":63944,"temperature":0.7,"pith_summary":"The paper aims to replace asymptotic, game-based security definitions for quantum message transmission with finite, composable ones: a scheme is secure if it converts an insecure channel plus a short shared key into an ideal secure channel, one that lets Eve only block messages and learn their size. Security is stated as an explicit bound for each fixed set of parameters rather than as a statement about a limit, so concrete implementations get meaningful guarantees. The paper proves that modified versions of existing protocols achieve this: an ordered secure channel from one-time quantum authentication run with a pseudo-random function, with error at most the PRF distinguishing advantage plus $\\ell$ times the one-time authentication error, and a Pauli-malleable channel from a quantum one-time pad with a similar bound. It also shows that the game-based notions QAE and QCCA2 are strictly stronger than the corresponding constructive notions, excluding schemes that are arguably secure.","feed_headline":"Finite security bounds replace asymptotic quantum encryption proofs","feed_subtitle":"A scheme is secure if it turns an insecure channel and a key into an ideal channel; QAE and QCCA2 are shown too strict.","key_machinery":"The load-bearing object is the construction statement $R \\xrightarrow{\\pi,\\epsilon} S$: converter protocols $\\pi_A,\\pi_B$ transform a real resource $R$ into an ideal resource $S$ such that for every distinguisher $D$, $d_D(\\pi_{AB}R, \\mathrm{sim}_E S) \\le \\epsilon(D)$, where $d_D$ is the distinguisher advantage under the pseudo-metric generated by $D$. Resources are instantiated as quantum combs, i.e., causal CPTP maps over sequential message inputs. The central identity used in the Pauli-malleable construction is the twirl identity $\\sum_k P_k \\rho P_k = 2^m I \\otimes \\rho_E$ (up to normalization), which makes the one-time pad with random Pauli keys produce a fully mixed state on Bob's side. The composition theorem (errors add) and hybrid arguments carry the multi-message proofs.","core_discovery":"The central discovery is that computational security for quantum message transmission can be stated without games or oracles, as a resource construction with a finite reduction. For any fixed distinguisher, the real protocol—the insecure channel, Alice's and Bob's converters, and their explicit quantum-computing resources—must be within a stated advantage of an ideal channel connected to a simulator. The strongest channel constructed is an ordered secure quantum channel (OSC), where Eve can only send 'send' or 'skip' for each message; the proof uses a hybrid argument over $\\ell$ one-time authenticated transmissions and yields $d_D(\\mathrm{real}, \\mathrm{ideal}) \\le \\epsilon_{\\mathrm{PRF}}(DC) + \\ell \\, \\epsilon_{\\mathrm{q\\text{-}auth}}$. A second construction yields a Pauli-malleable confidential channel (PMCC) with error $\\ell^2 / 2^{\\nu}$ plus the PRF term. From these, the paper derives that the game-based security notions of quantum authenticated encryption and QCCA2 are strictly stronger than constructing a secure (or non-malleable) channel, reproducing the classical append-a-bit separation.","pith_inferences":["Because the finite statements are parameter-relative, instantiating the PRF with a specific candidate and proving a finite bound on its distinguishing advantage would turn the corollaries into unconditional, checkable bounds for that implementation.","The sequential-scheduling restriction excludes superpositions of causal orders; extending the same definitions to such settings would require a more general system model than quantum combs.","The same resource-construction template could be applied to other quantum primitives, such as key distribution or delegated computation, to obtain finite composable statements wherever a one-shot subroutine with an explicit error is available."],"forward_implications":["For any fixed choice of parameters, the construction error is an explicit number, so a concrete implementation can check whether the PRF advantage and authentication error meet its requirement.","The constructed channels compose: if one resource is used inside another protocol, the total error is at most the sum of the individual construction errors.","Existing protocols for quantum encryption and authentication, with minor modifications, satisfy composable finite security under the stated assumptions.","Adding a counter to each message upgrades a secure channel to an ordered secure channel at zero additional error.","QAE and QCCA2, as defined in prior work, reject schemes that still construct the intended secure or non-malleable channel, so game-based security is a sufficient but not necessary benchmark."],"supporting_citations":[{"why":"Introduces the resource-construction security definition underlying the paper's formalism.","marker":"[MR11]"},{"why":"Supplies the quantum-comb model used to instantiate resources and distinguishers.","marker":"[CDP09]"},{"why":"Provides the one-time quantum authentication with key recycling that is the subroutine in the OSC construction and Lemma 1 bound.","marker":"[Por17]"},{"why":"Gives quantum authentication and purity testing codes on which the one-time authentication construction relies.","marker":"[BCG+02]"},{"why":"Defines the QAE and QCCA2 game-based notions and the protocols that the paper modifies and compares.","marker":"[AGM18]"},{"why":"Provides the computational quantum encryption schemes whose protocol is modified for the PMCC construction.","marker":"[ABF+16]"},{"why":"Gives PRFs secure against quantum adversaries, needed to instantiate the finite PRF resource.","marker":"[Zha12]"},{"why":"Provides the classical append-a-bit separation that the paper adapts to show QAE and QCCA2 are too strong.","marker":"[CKN03]"}],"fun_headline_variants":["Finite composable security for quantum message transmission","Quantum security without games or oracles—finite and composable","Finite reductions replace asymptotic quantum encryption proofs","Composable quantum channels: security with finite bounds"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a concrete pseudo-random function family exists for the chosen fixed seed, input, and output lengths with a small proven distinguishing advantage; without such a finite instantiation, the bounds for the PRF-based protocols are conditional.","fun_headline_variants_meta":{"raw":{"variants":["Finite composable security for quantum message transmission","Quantum security without games or oracles—finite and composable","Finite reductions replace asymptotic quantum encryption proofs","Composable quantum channels: security with finite bounds"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000206,"raw_usage":{"total_tokens":1462,"prompt_tokens":1074,"completion_tokens":388,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":690,"completion_tokens_details":{"reasoning_tokens":327}},"tokens_in":690,"tokens_out":388,"duration_ms":4256,"temperature":1.0,"reasoning_tokens":327,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T14:15:31.885138+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Choose any fixed parameters and a candidate PRF family, and run the real and ideal systems of the OSC construction; if a distinguisher achieves advantage strictly greater than $\\epsilon_{\\mathrm{PRF}}(DC) + \\ell \\, \\epsilon_{\\mathrm{q\\text{-}auth}}$, then the paper's bound is false.","supporting_citations":[],"review_version":1}