Pith. sign in

REVIEW 2 major objections 4 minor 44 references

Composable and Finite Computational Security of Quantum Message Transmission

T0 review · 2 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Quantum message transmission can be given finite, composable, computational security by defining a scheme as a construction that turns an insecure channel plus a shared key into an ideal secure channel; the paper proves explicit bounds…

desk verdict Genuinely useful finite composable security definitions for quantum message transmission, with a real proof gap in the PMCC construction (Theorem 2) that must be fixed before publication. read the letter →

arxiv 1908.03436 v2 pith:VRFQA4YB submitted 2019-08-09 quant-ph cs.CR

Fabio Banfi , Ueli Maurer , Christopher Portmann , Jiamin Zhu This is my paper · ORCID
classification quant-phcs.CR MSC 81P94 PACS 03.67.Dd
keywords finitesecuritycomposablequantummessagetransmissionauthenticationencryptionpseudo-randomfunctionscombsgame-based
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to replace asymptotic, game-based security definitions for quantum message transmission with finite, composable ones: a scheme is secure if it converts an insecure channel plus a short shared key into an ideal secure channel, one that lets Eve only block messages and learn their size. Security is stated as an explicit bound for each fixed set of parameters rather than as a statement about a limit, so concrete implementations get meaningful guarantees. The paper proves that modified versions of existing protocols achieve this: an ordered secure channel from one-time quantum authentication run with a pseudo-random function, with error at most the PRF distinguishing advantage plus $\ell$ times the one-time authentication error, and a Pauli-malleable channel from a quantum one-time pad with a similar bound. It also shows that the game-based notions QAE and QCCA2 are strictly stronger than the corresponding constructive notions, excluding schemes that are arguably secure.

What carries the argument

The load-bearing object is the construction statement $R \xrightarrow{\pi,\epsilon} S$: converter protocols $\pi_A,\pi_B$ transform a real resource $R$ into an ideal resource $S$ such that for every distinguisher $D$, $d_D(\pi_{AB}R, \mathrm{sim}_E S) \le \epsilon(D)$, where $d_D$ is the distinguisher advantage under the pseudo-metric generated by $D$. Resources are instantiated as quantum combs, i.e., causal CPTP maps over sequential message inputs. The central identity used in the Pauli-malleable construction is the twirl identity $\sum_k P_k \rho P_k = 2^m I \otimes \rho_E$ (up to normalization), which makes the one-time pad with random Pauli keys produce a fully mixed state on Bob's side. The composition theorem (errors add) and hybrid arguments carry the multi-message proofs.

What would settle it

Choose any fixed parameters and a candidate PRF family, and run the real and ideal systems of the OSC construction; if a distinguisher achieves advantage strictly greater than $\epsilon_{\mathrm{PRF}}(DC) + \ell \, \epsilon_{\mathrm{q\text{-}auth}}$, then the paper's bound is false.

Watch

Extended reading notes

Core claim

The central discovery is that computational security for quantum message transmission can be stated without games or oracles, as a resource construction with a finite reduction. For any fixed distinguisher, the real protocol—the insecure channel, Alice's and Bob's converters, and their explicit quantum-computing resources—must be within a stated advantage of an ideal channel connected to a simulator. The strongest channel constructed is an ordered secure quantum channel (OSC), where Eve can only send 'send' or 'skip' for each message; the proof uses a hybrid argument over $\ell$ one-time authenticated transmissions and yields $d_D(\mathrm{real}, \mathrm{ideal}) \le \epsilon_{\mathrm{PRF}}(DC) + \ell \, \epsilon_{\mathrm{q\text{-}auth}}$. A second construction yields a Pauli-malleable confidential channel (PMCC) with error $\ell^2 / 2^{\nu}$ plus the PRF term. From these, the paper derives that the game-based security notions of quantum authenticated encryption and QCCA2 are strictly stronger than constructing a secure (or non-malleable) channel, reproducing the classical append-a-bit separation.

Load-bearing premise

The load-bearing premise is that a concrete pseudo-random function family exists for the chosen fixed seed, input, and output lengths with a small proven distinguishing advantage; without such a finite instantiation, the bounds for the PRF-based protocols are conditional.

Editorial extensions

If this is right

  • For any fixed choice of parameters, the construction error is an explicit number, so a concrete implementation can check whether the PRF advantage and authentication error meet its requirement.
  • The constructed channels compose: if one resource is used inside another protocol, the total error is at most the sum of the individual construction errors.
  • Existing protocols for quantum encryption and authentication, with minor modifications, satisfy composable finite security under the stated assumptions.
  • Adding a counter to each message upgrades a secure channel to an ordered secure channel at zero additional error.
  • QAE and QCCA2, as defined in prior work, reject schemes that still construct the intended secure or non-malleable channel, so game-based security is a sufficient but not necessary benchmark.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the finite statements are parameter-relative, instantiating the PRF with a specific candidate and proving a finite bound on its distinguishing advantage would turn the corollaries into unconditional, checkable bounds for that implementation.
  • The sequential-scheduling restriction excludes superpositions of causal orders; extending the same definitions to such settings would require a more general system model than quantum combs.
  • The same resource-construction template could be applied to other quantum primitives, such as key distribution or delegated computation, to obtain finite composable statements wherever a one-shot subroutine with an explicit error is available.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper proposes a finite, composable, computational-security framework for quantum message transmission in the Abstract & Constructive Cryptography paradigm, instantiated with quantum combs. It defines channel resources (OSC, SC, NMCC, PMCC) and proves that a tagged, PRF-based variant of a one-time quantum authentication protocol constructs an OSC within l·ε_q-auth plus a PRF error (Theorem 1 and Corollary 3), and that a Pauli-pad-style protocol constructs a PMCC within l^2·2^{−ν} plus a PRF error (Theorem 2 and Corollary 4). It then shows that QAE security implies, but is strictly stronger than, constructing a secure channel (Theorem 3), and introduces RRC-QCCA2 and RRO-QCCA2, proving that RRO-QCCA2 (and, for a restricted class of schemes, RRC-QCCA2) implies constructing a non-malleable confidential channel, again with strict separation (Section 4.3, Theorem 4 and Corollaries 7–8).

Significance. If the results hold, this is a valuable step toward placing computational security of quantum message transmission on a composable, finite footing: the definitions are operational, the reductions are explicit, and the game-based comparison clarifies the over-strength of QAE and QCCA2. The OSC construction (Theorem 1), the composition theorem, and the QAE/RRO-QCCA2 implications are supported by explicit hybrids and reductions. However, the proof of the PMCC construction (Theorem 2) contains a load-bearing gap concerning the overline resources and the reduction to the one-message lemma; until that is repaired, the second construction and its corollary are not established. The PRF-based bounds are also conditional on an assumed finite PRF advantage rather than an instantiated finite PRF.

major comments (2)
  1. [Section 3.4, Theorem 2 and Eq. (13)] The proof introduces overline resources R̄_l and S̄_l by requiring that 'IC and PMCC will reject any input from interface A if it contains the same tag x as previous input from interface E', but this condition is not well-defined for the ideal resource PMCC_{l,m}: interface A of PMCC_{l,m} receives untagged m-qubit messages, so there is no tag to compare with previous E inputs. Tags exist only in the real-world ciphertexts and in the simulator's outputs at interface E. Consequently S̄_l is not a legitimate quantum comb, and the asserted bound dD(R_l,S_l) ≤ dD(R̄_l,S̄_l) + l^2/2^ν is unsupported. The claimed reduction to Lemma 7 is also not explicit: Lemma 7 concerns one-message overline channels that reject an A input after any E input, without tags and with message length m, whereas Theorem 2's overline channels are tag-dependent and have message length m+ν. No converter or hybrid argument is supplied to bridge this gap. The PMCC construction is therefore not proven as stated.
  2. [Section 3.4, proof of Theorem 2 (paragraph after Eq. (13))] Even apart from the definitional issue above, the step 'Following from a standard hybrid argument, if a distinguisher D can distinguish R̄_l and S̄_l, it can be used to construct a distinguisher in the one-message scenario' is not backed by an explicit construction. One would need to show that the multi-message protocol with overline channels decomposes into l independent one-message instances under a converter that routes ciphertexts by their tags; because the tags are chosen freshly by Alice's computer and can be replayed by Eve, such a routing converter must be stateful and must keep track of the tag-to-instance mapping. This is exactly the point at which the missing tag in PMCC_{l,m} becomes relevant. Until this hybrid is supplied, the equality dD(R̄_l,S̄_l)=0 does not follow from Lemma 7.
minor comments (4)
  1. [Section 3.1 and Corollaries 3–4] The finite security statements are conditional on an assumed finite bound ε_PRF(D) for a concrete PRF family. The reference to [Zha12] provides an asymptotic construction, not an explicit finite bound for a specific PRF. Please state explicitly that the reductions are conditional on a finite PRF assumption and discuss how such a bound could be obtained, or provide an instantiation.
  2. [Section 2.4] The results are proved in the sequential-scheduling quantum-combs model, which excludes superpositions of causal orders. The authors note that the Causal Boxes model [PMM+17] covers such settings; the paper should state prominently that the composability claims are limited to sequential scheduling.
  3. [Section 4.3, proof of Theorem 4 and Corollaries 7–8] In the proof of Theorem 4 the ideal system is written as simqae_E [NMCC_l, QC_l_E], but it should be simqcca2_E; also the computing resource QCqcca2,l_E used in Corollaries 7 and 8 is not formally defined. Please fix the notation.
  4. [Section 4.2, QAE separation] The bit-appending separation argument should spell out that the appended bit is part of the ciphertext state checked by the ideal decryption oracle, so flipping it causes the ideal oracle to return ⊥; as written, a reader might think the bit is ignored before the ideal game's matching step.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the security theorems are finite reductions to independent q-auth and PRF/URF assumptions; self-citations frame the model but do not determine the conclusions.

full rationale

The paper's central derivation works as a genuine resource-construction reduction: the real systems (protocol converters plus insecure channel and key/URF resources) are shown to approximate independently defined ideal channels (OSC, PMCC, SC, NMCC), with explicit distinguisher-dependent error bounds. Theorem 1 relies on Lemma 1, which is taken from Portmann's external, information-theoretically proven purity-testing authentication bound, and the multi-message argument is a standard hybrid over one-message subsystems. Corollary 3 then applies the PRF assumption of Eq. (12) as an explicit finite reduction, not as a disguised restatement of the target result. Theorem 2 and Appendix C reduce the multi-message Pauli-malleable construction to the quantum one-time-pad statement of Lemma 7, and Lemma 7 is proved in this paper by direct Choi-state calculation, not merely assumed or imported from a self-citation. The QAE and QCCA2 comparisons in Section 4 are formal implication proofs with explicitly constructed reductions and simulators; the game-based notions are not used to define the constructive notions, so those results are also not circular. The authors do cite their own prior framework (Maurer-Renner constructive cryptography and quantum combs), but the needed definitions are restated in Section 2 and the composition theorem is proved in Appendix B, so the self-citations supply vocabulary rather than the load-bearing conclusion. Two genuine concerns remain, but they are not circularity: in Section 3.4 the barred resources used around Eq. (13) are under-specified for the ideal PMCC (interface A receives untagged messages, so the 'reject if same tag' condition is not a well-defined comb), making the step dD(R_bar, S_bar) = 0 via Lemma 7 not fully explicit; and the finite security bounds are conditional because only asymptotic PRF constructions are cited from [Zha12]. These are proof gaps and missing finite instantiations, not cases where a prediction reduces to its inputs.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No parameters are fitted to data in this theoretical paper. The parameters r, nu, mu, m, n, and l are adjustable input sizes, and the error bounds are derived analytically rather than chosen to fit an observation. The only external inputs are the security properties of the PRF and the q-auth subroutine, which are listed as axioms. The paper introduces new ideal resources (OSC, SC, PMCC, NMCC) and key and channel resources, but these are mathematical definitions in a resource theory, not new physical entities; they do not require independent falsifiable evidence.

assumptions (4)
  • domain assumption Quantum combs and their composition and pseudo-metric properties (from Gutoski-Watrous, Chiribella et al.) are a valid model for sequential quantum communication and allow the composition theorems in Appendix B.
    The paper instantiates AC with quantum combs in Section 2.4 and relies on their closure properties and distinguisher-based distance; these are taken from the cited literature, not proved in this paper.
  • domain assumption There exists a one-time quantum authentication scheme with error bound max{2^(m-n), epsilon} for any purity-testing code (Lemma 1, from Portmann [Por17]).
    Theorem 1 and the OSC construction use this as a subroutine; the bound is cited, not re-derived.
  • domain assumption There exists a pseudo-random function family that is indistinguishable from a uniform random function for fixed parameters, with a finite bound epsilon_PRF, against quantum distinguishers (Definition 3 and Eq. (12), citing Zhandry [Zha12]).
    Corollaries 3 and 4 reduce security to this finite PRF assumption; the paper does not provide explicit finite bounds for any concrete PRF.
  • domain assumption Sequential scheduling, where the party to whom a message is sent is given by classical information, captures the relevant attack models for the constructed channels.
    Section 2.4 states this restriction; if an adversary could use quantum superpositions of causal structures (Causal Boxes), the security statements are not proven. The paper acknowledges Causal Boxes [PMM+17] as a more general model.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Composable and Finite Computational Security of Quantum Message Transmission." pith.science (2026). https://pith.science/paper/VRFQA4YB

@misc{pith2026190803436,
  author       = {Pith},
  title        = {Pith review of: Composable and Finite Computational Security of Quantum Message Transmission},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VRFQA4YB}},
  note         = {Machine review of arXiv:1908.03436}
}
read the original abstract

Recent research in quantum cryptography has led to the development of schemes that encrypt and authenticate quantum messages with computational security. The security definitions used so far in the literature are asymptotic, game-based, and not known to be composable. We show how to define finite, composable, computational security for secure quantum message transmission. The new definitions do not involve any games or oracles, they are directly operational: a scheme is secure if it transforms an insecure channel and a shared key into an ideal secure channel from Alice to Bob, i.e., one which only allows Eve to block messages and learn their size, but not change them or read them. By modifying the ideal channel to provide Eve with more or less capabilities, one gets an array of different security notions. By design these transformations are composable, resulting in composable security. Crucially, the new definitions are finite. Security does not rely on the asymptotic hardness of a computational problem. Instead, one proves a finite reduction: if an adversary can distinguish the constructed (real) channel from the ideal one (for some fixed security parameters), then she can solve a finite instance of some computational problem. Such a finite statement is needed to make security claims about concrete implementations. We then prove that (slightly modified versions of) protocols proposed in the literature satisfy these composable definitions. And finally, we study the relations between some game-based definitions and our composable ones. In particular, we look at notions of quantum authenticated encryption and QCCA2, and show that they suffer from the same issues as their classical counterparts: they exclude certain protocols which are arguably secure.

Figures

Figures reproduced from arXiv: 1908.03436 by the authors.

Figure 1
Figure 1. The real system for quantum authentication consists of Alice’s and Bob’s parts of the protocol, π q-auth A and π q-auth B , and the following four resources: a shared secret key KEYµ , a (one-time use) insecure quantum channel IC1,n, and Alice’s and Bob’s local (one-time use) quantum computers QC1,m,n A and QC1,m,n B . Upon receiving a message ρ M at its outer interface, π q-auth A stores it in QC1,m,n A , then requ… view at source ↗
Figure 2
Figure 2. The ideal quantum authentication system consists of a (one-time use) secure chan￾nel SC1,m, Eve’s quantum computer QC2,m,n E (that may perform one encryption and one decryption), and the simulator σ q-auth E . Typically, upon receiving a notification from SC1,m that Alice sent a message, simq-auth E will ask QC2,m,n E to generate a ciphertext σ C , which it then outputs at Eve’s interface. Upon receiving a ciphertex… view at source ↗
Figure 3
Figure 3. The real system for quantum authentication with a PRG. It is identical to [PITH_FULL_IMAGE:figures/full_fig_p016_3.png] view at source ↗
Figures from the paper (15 more)
Figure 4
Figure 4. Figure 4: Converters and computing resources to construct OSC`,m from IC`,n+log ` . QC`,m,n+log ` A and QC`,m,n+log ` B will be queried ` times. The plaintext has length m and the ciphertext has length n + log `. URFlog `,µ has input length log ` and output length µ. allows them…
Figure 5
Figure 5. Figure 5: The real system consisting of the shared resources IC`,n+log ` and URFlog `,µ, Alice and Bob’s computing resources QC`,m,n+log ` A QC`,m,n+log ` B , and the protocol converters πA and πB. simE OSC QCE QCq-auth i . . . ρ Ai ρ Ai /⊥ ψ C ψ˜C newMsg skip/send ψ˜C ψ C newMs…
Figure 6
Figure 6. Figure 6: The ideal system consisting of OSC`,m, QC2`,m,n+log ` E and simE. QC2`,m,n+log ` E makes use of ` instances of QCq-auth internally, while simE only receives and forwards mes￾sages and does no computation. tage of the one time secure quantum channel construction. Then, …
Figure 7
Figure 7. Figure 7: Converters and computer resources to construct PMCC`,m from IC`,m+ν . QC`,m,m+ν A and QC`,m,m+ν B will be queried ` times. The plaintext has length m and ciphertext has length m + ν. URFν,2m has input length ν and output length 2m. Theorem 2. Let πAB = (πA, πB), QC`,m,…
Figure 8
Figure 8. Figure 8: The real system consisting of shared resources IC`,m+ν and URFν,2m, Alice and Bob’s computing resources QC`,m,m+ν A and QC`,m,m+ν B , and the protocol converters πA and πB. simE PMCC QCE QCq-otp i P . . . ρ Ai (j, k)/⊥ 1 2m I2m Pkρ AjPk/ ψ C ψ˜C newMsg ψ˜C ψ C newMsg (…
Figure 9
Figure 9. Figure 9: The ideal system consisting of PMCC`,m, QC2`,m,m+ν E and simE. QC2`,m,m+ν E makes use of ` instances of QCq-otp internally while simE only receives and forwards messages and does no computation. The simulator simE works exactly the same as the one message case analyzed…
Figure 10
Figure 10. Figure 10: QAE security games G qae-real (left) and G qae-ideal (right). π q-enc A QC` A 1. QC` A request the key k from KEY and stores it in its memory. 2. For the i-th input % M at the out￾side interface, QC` A samples randomness r ←− R pk , computes the ciphertext σ C ← Vk(% …
Figure 11
Figure 11. Figure 11: Encryption and decryption protocols. – Interface A: On input message %, output Enc(%) at interface E. – Interface E: On input state σ, output Dec(σ) at interface B. Note that we trivially have that CGqae-real,` ≡ R and CGqae-ideal,` ≡ S, hence Advqae,` S,DC = Prh DC[G…
Figure 12
Figure 12. Figure 12: QAE (until the dashed line) and QCCA2 (until the end) simulators. Corollary 5. With ε(D) := supD0∈B(D) Advqae,` S,D0 , we have h KEY, IC` , QC` A, QC` B i π q-enc AB ,ε −−−−−→ h SC` , QC` E i , where the class B(D) is defined in Eq. (6), Section 2.1. QAE is Stronger t…
Figure 13
Figure 13. Figure 13: RRC-QCCA2 games G rrc-qcca2-real (left) and G rrc-qcca2-ideal (right). Definition 12 (RRO-QCCA2 Security). For SQES S := (Gen, Enc, Dec) (im￾plicit in all defined systems) we define the RRO-QCCA2-advantage of S for dis￾tinguisher D as Advrro-qcca2 S,D := Prh D[G rro-q…
Figure 14
Figure 14. Figure 14: RRO-QCCA2 games G rro-qcca2-real (left) and G rro-qcca2-ideal (right). IND-CCA3 from [Shr04], we now show that our RRC-QCCA2 security notion, when casted to a classical definition, dubbed RRC-CCA2, is equivalent (in par￾ticular, with no loss factors, as opposed to AGM…
Figure 15
Figure 15. Figure 15: Converters and computer resources to construct PMCC1,m from IC1,m. The quan￾tum computer QC1,m,m A and QC1,m,m B will be requested 1 time. The plaintext and ciphertext both have length m. KEY2m gives a shared key of length 2m. simq-otp QCq-otp 1. simq-otp: On input ne…
Figure 16
Figure 16. Figure 16: The simulator simq-otp and computer resource QCq-otp connecting to the ideal resource PMCC1,m . QCq-otp is capable of doing 1 encryption and 1 decryption. and therefore we have Φreal = Φideal. Now we consider the more complicated case that distinguisher first input at…
Figure 17
Figure 17. Figure 17: Converters and computing resources to construct OSC`,m from SC`,m+log ` . QC`,m,m+log ` A and QC`,m,m+log ` B will be requested ` times. The message has length m and encoding has length m + log `. . Therefore we can further simplify Φreal Φreal = 1 2 2m X k,i,p,q (P A…
Figure 18
Figure 18. Figure 18: AGM-QCCA2 games G agm-qcca2-test (left) and G agm-qcca2-fake (right). References ABF+16. Gorjan Alagic, Anne Broadbent, Bill Fefferman, Tommaso Gagliardoni, Christian Schaffner, and Michael St Jules. Computational security of quantum encryption. In International Confe…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 31 canonical work pages

  1. [1]

    Computational security of quantum encryption

    Gorjan Alagic, Anne Broadbent, Bill Fefferman, Tommaso Gagliardoni, Christian Schaffner, and Michael St Jules. Computational security of quantum encryption. In International Conference on Information Theoretic Security , pages 47--71. Springer, 2016

    work page 2016

  2. [2]

    Unforgeable Quantum Encryption

    Gorjan Alagic, Tommaso Gagliardoni, and Christian Majenz. Unforgeable quantum encryption. In Jesper Buus Nielsen and Vincent Rijmen, editors, Advances in Cryptology -- EUROCRYPT 2018, Proceedings, Part III , volume 10822 of Lecture Notes in Computer Science , pages 489--519. Springer, 2018. [ 10.1007/978-3-319-78372-7_16 , arxiv 1709.06539 ]

    work page Pith review arXiv 2018

  3. [3]

    Authentication of quantum messages

    Howard Barnum, Claude Cr \'e peau, Daniel Gottesman, Adam Smith, and Alain Tapp. Authentication of quantum messages. In Proceedings of the 43rd Symposium on Foundations of Computer Science, FOCS '02 , pages 449--458. IEEE, 2002. [ 10.1109/SFCS.2002.1181969 , arxiv quant-ph/0205128 ]

    arXiv 2002

  4. [4]

    A concrete security treatment of symmetric encryption

    Mihir Bellare, Anand Desai, Eron Jokipii, and Phillip Rogaway. A concrete security treatment of symmetric encryption. In Proceedings of the 38th Annual Symposium on Foundations of Computer Science , FOCS '97, pages 394--403. IEEE Computer Society, 1997. [ 10.1109/SFCS.1997.646128 ]

    work page arXiv 1997

  5. [5]

    Relations among notions of security for public-key encryption schemes

    Mihir Bellare, Anand Desai, David Pointcheval, and Phillip Rogaway. Relations among notions of security for public-key encryption schemes. In Advances in Cryptology -- CRYPTO '98 , pages 26--45. Springer, 1998. [ 10.1007/BFb0055718 ]

    work page doi:10.1007/bfb0055718 1998

  6. [6]

    The universal composable security of quantum key distribution

    Michael Ben-Or , Micha Horodecki, Debbie Leung, Dominic Mayers, and Jonathan Oppenheim. The universal composable security of quantum key distribution. In Theory of Cryptography, Proceedings of TCC 2005 , volume 3378 of Lecture Notes in Computer Science , pages 386--406. Springer, 2005. [ 10.1007/978-3-540-30576-7_21 , arxiv quant-ph/0409078 ]

    arXiv 2005

  7. [7]

    Quantum homomorphic encryption for circuits of low t-gate complexity

    Anne Broadbent and Stacey Jeffery. Quantum homomorphic encryption for circuits of low t-gate complexity. In Rosario Gennaro and Matthew Robshaw, editors, Advances in Cryptology -- CRYPTO 2015 , pages 609--629. Springer, 2015. [ 10.1007/978-3-662-48000-7_30 ]

    work page doi:10.1007/978-3-662-48000-7_30 2015

  8. [8]

    Authenticated encryption: Relations among notions and analysis of the generic composition paradigm

    Mihir Bellare and Chanathip Namprempre. Authenticated encryption: Relations among notions and analysis of the generic composition paradigm. In Advances in Cryptology -- ASIACRYPT 2000 , volume 1976 of Lecture Notes in Computer Science , pages 531--545. Springer, 2000. [ 10.1007/3-540-44448-3_41 ]

    work page doi:10.1007/3-540-44448-3_41

Show all 44 references
  1. [9]

    A general composition theorem for secure reactive systems

    Michael Backes, Birgit Pfitzmann, and Michael Waidner. A general composition theorem for secure reactive systems. In Theory of Cryptography, Proceedings of TCC 2004 , volume 2951 of Lecture Notes in Computer Science , pages 336--354. Springer, 2004. [ 10.1007/978-3-540-24638-1_19 ]

    2004 doi

  2. [10]

    The reactive simulatability ( RSIM ) framework for asynchronous systems

    Michael Backes, Birgit Pfitzmann, and Michael Waidner. The reactive simulatability ( RSIM ) framework for asynchronous systems. Information and Computation , 205(12):1685--1720, 2007. Extended version of PW01 . [ 10.1016/j.ic.2007.05.002 , cryptoeprint 2004/082 ]

    2007 doi

  3. [11]

    Universally composable security: A new paradigm for cryptographic protocols

    Ran Canetti. Universally composable security: A new paradigm for cryptographic protocols. In Proceedings of the 42nd Symposium on Foundations of Computer Science, FOCS '01 , pages 136--145. IEEE, 2001. [ 10.1109/SFCS.2001.959888 ]

    2001

  4. [12]

    Universally composable security: A new paradigm for cryptographic protocols

    Ran Canetti. Universally composable security: A new paradigm for cryptographic protocols. Cryptology ePrint Archive, Report 2000/067, 2013. Updated version of Can01 . [ cryptoeprint 2000/067 ]

    2000

  5. [13]

    Theoretical framework for quantum networks

    Giulio Chiribella, Giacomo Mauro D'Ariano, and Paolo Perinotti. Theoretical framework for quantum networks. Physical Review A , 80:022339, August 2009. [ 10.1103/PhysRevA.80.022339 , arxiv 0904.4483 ]

    2009 arXiv

  6. [14]

    Universally composable security with global setup

    Ran Canetti, Yevgeniy Dodis, Rafael Pass, and Shabsi Walfish. Universally composable security with global setup. In Theory of Cryptography, Proceedings of TCC 2007 , volume 4392 of Lecture Notes in Computer Science , pages 61--85. Springer, 2007. [ 10.1007/978-3-540-70936-7_4 ...

    2007 doi

  7. [15]

    Ran Canetti, Hugo Krawczyk, and Jesper B. Nielsen. Relaxing chosen-ciphertext security. In Dan Boneh, editor, Advances in Cryptology -- CRYPTO 2003 , pages 565--582. Springer, 2003. [ 10.1007/978-3-540-45146-4_33 ]

    2003 doi

  8. [16]

    Constructing confidential channels from authenticated channels---public-key encryption revisited

    Sandro Coretti, Ueli Maurer, and Bj \"o rn Tackmann. Constructing confidential channels from authenticated channels---public-key encryption revisited. In Kazue Sako and Palash Sarkar, editors, Advances in Cryptology -- ASIACRYPT 2013 , pages 134--153. Springer, 2013. [ 10.1007...

    2013 doi

  9. [17]

    Fitzsimons, Christopher Portmann, and Renato Renner

    Vedran Dunjko, Joseph F. Fitzsimons, Christopher Portmann, and Renato Renner. Composable security of delegated quantum computation. In Advances in Cryptology -- ASIACRYPT 2014, Proceedings, Part II , volume 8874 of Lecture Notes in Computer Science , pages 406--425. Springer, ...

    2014 arXiv

  10. [18]

    On a measure of distance for quantum strategies

    Gus Gutoski. On a measure of distance for quantum strategies. Journal of Mathematical Physics , 53(3):032202, 2012. [ 10.1063/1.3693621 , arxiv 1008.4636 ]

    2012 arXiv

  11. [19]

    Toward a general theory of quantum games

    Gus Gutoski and John Watrous. Toward a general theory of quantum games. In Proceedings of the 39th Symposium on Theory of Computing, STOC '07 , pages 565--574. ACM, 2007. [ 10.1145/1250790.1250873 , arxiv quant-ph/0611234 ]

    2007

  12. [20]

    Reformulating and reconstructing quantum theory

    Lucien Hardy. Reformulating and reconstructing quantum theory. Eprint, 2011. [ arxiv 1104.2066 ]

    2011 arXiv

  13. [21]

    The operator tensor formulation of quantum theory

    Lucien Hardy. The operator tensor formulation of quantum theory. Philosophical Transactions of the Royal Society of London A: Mathematical, Physical and Engineering Sciences , 370(1971):3385--3417, 2012. [ 10.1098/rsta.2011.0326 , arxiv 1201.4390 ]

    1971

  14. [22]

    Quantum theory with bold operator tensors

    Lucien Hardy. Quantum theory with bold operator tensors. Philosophical Transactions of the Royal Society of London A: Mathematical, Physical and Engineering Sciences , 373(2047), 2015. [ 10.1098/rsta.2014.0239 ]

    2015

  15. [23]

    The order of encryption and authentication for protecting communications (or: How secure is SSL ?)

    Hugo Krawczyk. The order of encryption and authentication for protecting communications (or: How secure is SSL ?). In Advances in Cryptology -- CRYPTO 2001 , volume 2139 of Lecture Notes in Computer Science , pages 310--331. Springer, 2001. [ 10.1007/3-540-44647-8_19 ]

    2001 doi

  16. [24]

    Small accessible quantum information does not imply security

    Robert K\"onig, Renato Renner, Andor Bariska, and Ueli Maurer. Small accessible quantum information does not imply security. Physical Review Letters , 98:140502, April 2007. [ 10.1103/PhysRevLett.98.140502 , arxiv quant-ph/0512021 ]

    2007 arXiv

  17. [25]

    Characterization of security notions for probabilistic private-key encryption

    Jonathan Katz and Moti Yung. Characterization of security notions for probabilistic private-key encryption. Journal of Cryptology , 19(1):67--95, January 2006. [ 10.1007/s00145-005-0310-8 ]

    2006 doi

  18. [26]

    Indistinguishability of random systems

    Ueli Maurer. Indistinguishability of random systems. In International Conference on the Theory and Applications of Cryptographic Techniques , pages 110--132. Springer, 2002

    2002

  19. [27]

    Constructive cryptography---a new paradigm for security definitions and proofs

    Ueli Maurer. Constructive cryptography---a new paradigm for security definitions and proofs. In Proceedings of Theory of Security and Applications, TOSCA 2011 , volume 6993 of Lecture Notes in Computer Science , pages 33--56. Springer, 2012. [ 10.1007/978-3-642-27375-9_3 ]

    2011 doi

  20. [28]

    Indistinguishability amplification

    Ueli Maurer, Krzysztof Pietrzak, and Renato Renner. Indistinguishability amplification. In Annual International Cryptology Conference , pages 130--149. Springer, 2007

    2007

  21. [29]

    Abstract cryptography

    Ueli Maurer and Renato Renner. Abstract cryptography. In Proceedings of Innovations in Computer Science, ICS 2011 , pages 1--21. Tsinghua University Press, 2011

    2011

  22. [30]

    From indifferentiability to constructive cryptography (and back)

    Ueli Maurer and Renato Renner. From indifferentiability to constructive cryptography (and back). In Theory of Cryptography, Proceedings of TCC 2016-B, Part I , volume 9985 of Lecture Notes in Computer Science , pages 3--24. Springer, 2016. [ 10.1007/978-3-662-53641-4_1 , crypt...

    2016 doi

  23. [31]

    u edlinger, and Bj \

    Ueli Maurer, Andreas R \"u edlinger, and Bj \"o rn Tackmann. Confidentiality and integrity: A constructive perspective. In Ronald Cramer, editor, Theory of Cryptography , pages 209--229, Berlin, Heidelberg, 2012. Springer Berlin Heidelberg. [ 10.1007/978-3-642-28914-9_12 ]

    2012 doi

  24. [32]

    On the soundness of authenticate-then-encrypt: Formalizing the malleability of symmetric encryption

    Ueli Maurer and Bj\"orn Tackmann. On the soundness of authenticate-then-encrypt: Formalizing the malleability of symmetric encryption. In Proceedings of the 17th ACM Conference on Computer and Communication Security , pages 505--515. ACM, 2010

    2010

  25. [33]

    Causal boxes: Quantum information-processing systems closed under composition

    Christopher Portmann, Christian Matt, Ueli Maurer, Renato Renner, and Bj\"orn Tackmann. Causal boxes: Quantum information-processing systems closed under composition. IEEE Transactions on Information Theory , 63(5):3277--3305, May 2017. [ 10.1109/TIT.2017.2676805 , arxiv 1512.02240 ]

    2017

  26. [34]

    Quantum authentication with key recycling

    Christopher Portmann. Quantum authentication with key recycling. In Advances in Cryptology -- EUROCRYPT 2017, Proceedings, Part III , volume 10212 of Lecture Notes in Computer Science , pages 339--368. Springer, 2017. [ 10.1007/978-3-319-56617-7_12 , arxiv 1610.03422 ]

    2017 arXiv

  27. [35]

    Cryptographic security of quantum key distribution

    Christopher Portmann and Renato Renner. Cryptographic security of quantum key distribution. Eprint, 2014. [ arxiv 1409.3525 ]

    2014 arXiv

  28. [36]

    Composition and integrity preservation of secure reactive systems

    Birgit Pfitzmann and Michael Waidner. Composition and integrity preservation of secure reactive systems. In Proceedings of the 7th ACM Conference on Computer and Communications Security, CSS '00 , pages 245--254. ACM, 2000. [ 10.1145/352600.352639 ]

  29. [37]

    A model for asynchronous reactive systems and its application to secure message transmission

    Birgit Pfitzmann and Michael Waidner. A model for asynchronous reactive systems and its application to secure message transmission. In IEEE Symposium on Security and Privacy , pages 184--200. IEEE, 2001. [ 10.1109/SECPRI.2001.924298 ]

    2001

  30. [38]

    Security of Quantum Key Distribution

    Renato Renner. Security of Quantum Key Distribution . PhD thesis, Swiss Federal Institute of Technology (ETH) Zurich, September 2005. [ arxiv quant-ph/0512258 ]

    2005 arXiv

  31. [39]

    Cerf, Miloslav Du s s ek, Norbert L\"utkenhaus, and Momtchil Peev

    Valerio Scarani, Helle Bechmann-Pasquinucci, Nicolas J. Cerf, Miloslav Du s s ek, Norbert L\"utkenhaus, and Momtchil Peev. The security of practical quantum key distribution. Reviews of Modern Physics , 81:1301--1350, September 2009. [ 10.1103/RevModPhys.81.1301 , arxiv 0802.4155 ]

    2009 arXiv

  32. [40]

    A characterization of authenticated-encryption as a form of chosen-ciphertext security

    Tom Shrimpton. A characterization of authenticated-encryption as a form of chosen-ciphertext security. IACR Cryptology ePrint Archive , 2004:272, 2004

    2004

  33. [41]

    A largely self-contained and complete security proof for quantum key distribution

    Marco Tomamichel and Anthony Leverrier. A largely self-contained and complete security proof for quantum key distribution. Quantum , 1:14, July 2017. [ 10.22331/q-2017-07-14-14 , arxiv 1506.08458 ]

    2017 arXiv

  34. [42]

    Universally composable quantum multi-party computation

    Dominique Unruh. Universally composable quantum multi-party computation. In Advances in Cryptology -- EUROCRYPT 2010 , volume 6110 of Lecture Notes in Computer Science , pages 486--505. Springer, 2010. [ 10.1007/978-3-642-13190-5_25 , arxiv 0910.2912 ]

    2010 arXiv

  35. [43]

    Vilasini, Christopher Portmann, and L\'idia del Rio

    V. Vilasini, Christopher Portmann, and L\'idia del Rio. Composable security in relativistic quantum cryptography. Eprint, 2017. [ arxiv 1708.00433 ]

    2017 arXiv

  36. [44]

    How to construct quantum random functions

    Mark Zhandry. How to construct quantum random functions. In Proceedings of the 43rd Symposium on Foundations of Computer Science, FOCS '12 , pages 679--687. IEEE, 2012. [ cryptoeprint 2012/182 ]

    2012

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.