Unconditional Unclonable Encryption

Amit Sahai; Prabhanjan Ananth

REVIEW 1 major objections 5 minor 3 cited by

Unconditional Unclonable Encryption

T0 review · 1 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper proves that unclonable encryption with exponentially small indistinguishability advantage is achievable in the plain model with a classical key, using only single-qubit Clifford gates for encryption and local Pauli measurements f

desk verdict The proof of the operator-norm bound is the real contribution; it likely settles the security of the Botteron et al. scheme, and the auxiliary-register gap is a minor patch, not a fatal flaw. read the letter →

arxiv 2607.21551 v1 pith:D2MDPJLZ submitted 2026-07-23 quant-ph cs.CR

Prabhanjan Ananth , Amit Sahai This is my paper

classification quant-phcs.CR MSC 81P94

keywords unclonableencryptionquantumcryptographyindistinguishabilitysecurityno-cloningPauliobservablesoperatornormboundone-timekeyinformation-theoretic

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper establishes an unconditional, information-theoretically secure scheme for unclonable encryption of one-bit messages: a sender uses a (2n−1)-bit classical key to encrypt a bit into an n-qubit state, and any adversary who splits the ciphertext between two non-communicating recipients before the key is revealed cannot make both recipients recover the bit with probability better than 1/2 + 2^−(n+1)/2. This closes a gap in unclonable cryptography: previous efficient plain-model constructions with classical keys achieved only inverse-polynomial advantage, while optimal (negligible) advantage was known only from inefficient constructions or idealized models. The proof reduces the winning probability to an operator-norm bound on a single averaged matrix G, then proves that bound using Hilbert–Schmidt orthogonality of Pauli operators and a filtered-overlap argument. The construction itself is borrowed from earlier work, but the paper supplies the missing security analysis showing that the scheme actually achieves exponential indistinguishability.

What carries the argument

The central object is the averaged correlation operator G=1/2(E_B+E_C+E_BC−I), built from E_B and E_C, the averaged correlations between the Choi reference system and Bob's and Charlie's signed decoder observables, and E_BC, the averaged Bob–Charlie agreement. The winning probability of any pre-key splitting attack equals 1/2(1+Tr(Gτ)) on the Choi state τ of the splitting channel, so security reduces to bounding ∥G_+∥∞. The proof achieves this with a chain of Pauli-orthogonality and filtered-overlap estimates: a conditional-overlap lemma bounds ∥E_B E_C∥∞≤d/L, a propagation argument extends this to ∥E_B E_BC^ℓ E_C∥∞≤d/L for every ℓ, and a polarization identity with a positive filter F=2t(2tI

What would settle it

Run the unclonable-indistinguishability game for small n (e.g., n=1,…,8) with a generic adversary that holds an entangled reference system, performs an optimal quantum cloning/splitting channel, and then brute-force searches Bob's and Charlie's binary POVMs; if the observed success probability exceeds 1/2+2^−(n+1)/2, the theorem's bound is wrong. A more targeted check would verify the auxiliary-register reduction by computing the winning probability for the channel Φ'(·)=Φ(·⊗ρ_Z) with a fixed ρ_Z and comparing it to the G-operator bound.

Watch

Extended reading notes

Core claim

The central discovery is Theorem 1.1: for every n≥1 there is a one-time private-key quantum encryption scheme for one-bit messages with a (2n−1)-bit classical key and an n-qubit ciphertext, perfect correctness, encryption by single-qubit Clifford gates, decryption by local Pauli measurements, such that every information-theoretic pre-key splitting adversary wins the unclonable-indistinguishability game with probability at most 1/2+2^−(n+1)/2. The load-bearing assertion is Proposition 3.8: the positive part of the averaged operator G=1/2(E_B+E_C+E_BC−I) has operator norm at most √(d/L)=√(2/d), where d=2^n is the ciphertext dimension and L=2^{2n−1} is the number of keys. Because the winning pr

Load-bearing premise

The proof that the operator-norm bound still holds when the adversary's splitting channel may act on an arbitrary auxiliary register Z is asserted in a footnote without being shown; the full security theorem claims security for exactly this larger adversary class.

Editorial extensions

If this is right

Any pre-key splitting adversary—not just computationally bounded ones—is confined to advantage at most 2^−(n+1)/2, so the scheme is information-theoretically secure in the plain model.
Encryption and decryption are efficient and hardware-friendly: single-qubit Clifford gates on the sender side and single-qubit Pauli measurements on the receiver side, with key size 2n−1 bits and ciphertext n qubits.
The exponential bound is explicit and uniform in the security parameter, so concrete parameter choices can be read off directly from the theorem.
Because the key is classical, the usual assumption that the key holder can store and copy key material does not conflict with the ciphertext's unclonability; only the ciphertext needs quantum protection.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The proof technique, based on Pauli orthogonality and a filtered overlap, likely generalizes to other tight-frame observable ensembles; a natural test would be replacing the Pauli half-frame with a random stabilizer code and checking whether the same G-operator bound emerges.
The scheme encrypts one bit; encrypting ℓ bits by independent repetitions should give advantage at most ℓ·2^−(n+1)/2 by a union bound, though the paper does not state this multi-bit extension.
If the footnote's auxiliary-register claim is made rigorous, the same bound would also hold for adversaries who start with arbitrary quantum side information, which is the standard formulation for composable one-time encryption.
A natural next step is to prove a matching lower bound: an explicit distinguishing attack achieving roughly 2^−(n+1)/2 would show the scheme's parameters are tight; the paper does not address this.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Punchline: this paper does not introduce a new encryption scheme—the scheme is from Botteron et al.—but it supplies the missing security proof: an operator-norm estimate showing the (2n−1)-bit key, n-qubit scheme has unclonable-indistinguishability advantage at most 2^{−(n+1)/2} against arbitrary pre-key splitting attacks. If the proof holds, that resolves an open problem.

The proof is well structured and the main technical content is new. The Choi reduction to the G operator follows Broadbent–Lord, but the filtered-overlap machinery—the conditional-overlap lemma, the agreement-moment propagation, and the positive-part bound—is original. I checked the key steps: the block regrouping in Lemma 3.3, the Hilbert–Schmidt orthogonality in Prop 3.5, the sandwich argument in the quadratic estimate, and the geometric approximation of the filter in Prop 3.8. I did not find an algebraic error.

The soft spot the reader flagged is real but minor. Footnote 5 omits the auxiliary register Z and simply asserts the analysis goes through. The stress-test note correctly shows the fix: fix the adversary's auxiliary state ρ_S and define Φ'(·)=Φ(·⊗ρ_S); the rest of the proof applies verbatim. So the gap is readily closed, but it should be patched in the text. There is also a small typo: Theorem 2.4 should be Definition 2.4.

The construction is explicitly attributed to Botteron et al., so the novelty is in the proof, not the scheme. That is fine. The paper is long and AI-assisted, so independent verification is prudent, but that is not an objection to the mathematics.

Who should read this: quantum cryptographers and anyone working on unclonable primitives. It deserves a serious referee—send it to someone who will carefully check Proposition 3.8 and ask for the auxiliary-register step to be written out. If the referee confirms those, accept.

Referee Report

1 major / 5 minor

Summary. This paper constructs a one-time private-key unclonable encryption scheme for one-bit messages with a (2n-1)-bit classical key and an n-qubit ciphertext, using only single-qubit Clifford gates for encryption and local Pauli measurements for decryption. The main theorem (Theorem 3.2) asserts that every information-theoretic pre-key splitting adversary wins the unclonable-indistinguishability game with probability at most 1/2 + 2^{-(n+1)/2}. The proof expresses the ciphertext as rho = (I + (-1)^m P_{x,z})/2^n, uses the Choi representation to reduce the winning probability to the positive spectrum of an averaged operator G, and then proves the operator-norm bound ||G_+||_infty <= sqrt(2/d) through Pauli orthogonality, a conditional-overlap lemma, and a filtered-overlap argument. The construction is attributed to Botteron et al.; the paper's contribution is the security proof.

Significance. If the proof holds after the revisions below, this is a significant result: the first efficient, information-theoretically secure unclonable encryption scheme with classical keys and negligible advantage in the plain model. The proof is self-contained and the bound is explicit and parameter-free (gamma = d/L = 2/d). The technical core, the filtered-overlap estimate in Proposition 3.8 and the agreement-moment propagation in Proposition 3.6, is clean and appears correct. The paper also gives a careful Choi-Jamiolkowski identity and a proof of perfect correctness. No code or machine-checked proofs are provided, but the derivation is detailed enough for hand verification.

major comments (1)

[Footnote 5 / Section 3.1, Part 2] The game in Definition 2.4 gives A the state rho_ct (x) rho_S, but Equation (5) and the subsequent Choi argument treat Phi as a channel on the ciphertext register alone. The footnote asserts that the auxiliary register can be omitted, but gives no proof. This is load-bearing for the 'every adversary' statement. The gap is readily closed: fix rho_S and define Phi'(sigma)=Phi(sigma (x) rho_S), a CPTP map from L(Ct) to L(B (x) C); the winning probability equals the right-hand side of (5) with Phi' in place of Phi, and the proof of Parts 2-3 applies verbatim. Please include this reduction explicitly.

minor comments (5)

[Proposition 3.8, Eq. (40)] The line 'Since E_B, E_C, and F are self-adjoint, <psi|E_C F E_B|psi> = <psi|E_B F E_C|psi>' is not generally true; the two quantities are conjugates. The displayed identity (40) is correct, but the justification should say that the sum of the two cross terms equals 4 Re <psi|E_B F E_C|psi>.
[Theorem 3.2] The phrase 'where Pr[...] is defined in Theorem 2.4' should refer to Definition 2.4 (the game) rather than a theorem.
[Notation] The symbol G is used both for the adversary generator in Definition 2.4 and for the averaged operator in Eq. (8). This is confusing; use e.g. \mathcal{G} for the generator.
[Section 3.1, Part 2] The indexing of POVMs 'for each k in {0,1}^{2n-1}' is slightly imprecise because the key space K_n is a subset (x_1=1); choose an explicit bijection to {0,1}^{2n-1}.
[Proofreading] In Proposition 3.8, 'Fomr' should be 'From'. In the technical overview, the bound '1/(2n-1)' should be typeset as 1/2^{n-1} to avoid ambiguity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the security proof is self-contained and the cited construction is analyzed rather than assumed secure.

full rationale

The derivation chain is self-contained. The encryption scheme is taken from [Bot+26], but the paper does not invoke any security claim from [Bot+26]; it gives its own proof. Part 1 derives the ciphertext density operator rho_ct^(k,m) = (I+(-1)^m P_{x,z})/2^n directly from the encryption procedure (Eq. (4)). Part 2 rewrites the winning probability as 1/2(1+Tr(G tau)) via the Choi-Jamiolkowski identity and then uses the elementary bound Tr(G tau) <= ||G_+||_inf; no fitted parameters or prior security results are used. Part 3 proves ||G_+||_inf^2 <= d/L through Lemma 3.3 (conditional overlap), Proposition 3.5 (Pauli orthogonality gives ||E_B E_C|| <= d/L), Proposition 3.6 (agreement-moment propagation), and Proposition 3.8 (filter argument). The filter F is defined in terms of t=||G_+||_inf, but the final bound ||E_B F E_C||_inf <= gamma is obtained by a geometric-series approximation and is independent of t, so this is not a circular fixed-point. The only textual gap is footnote 5: the auxiliary register Z is omitted. This is an omitted proof rather than circularity; it is closed by fixing the adversary's auxiliary state rho_Z and defining Phi'(sigma)=Phi(sigma tensor rho_Z), after which the Choi argument and Proposition 3.8 apply unchanged. Self-citations ([Ana+22] for the definition, [BL20] for the reduction setup) are background and not load-bearing. No circular step can be exhibited.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The derivation is parameter-free. It relies on standard quantum-information facts and the Choi representation, plus one unproved reduction concerning auxiliary registers.

assumptions (5)

domain assumption The adversary's splitting operation is a completely positive trace-preserving quantum channel; the measurement setup is captured by binary POVMs (Δ_B, Δ_C).
This is the standard model for quantum adversaries in the cited literature (Section 2, definitions).
ad hoc to paper Security for channels on the ciphertext register alone implies security for channels on ciphertext-plus-auxiliary-register; the proof omits the auxiliary register.
Footnote 5 states 'our analysis goes through even if Z was taken into account' without showing the reduction; this is an unproved assertion the theorem depends on.
standard math Pauli half-frame orthogonality: Tr(P_{x,z}P_{x',z'}) = d·1[(x,z)=(x',z')] for the key set K_n.
Used in Proposition 3.5; follows from single-qubit Pauli trace orthogonality in Section 2.1.
standard math Spectral theorem and existence of an eigenvector for the top eigenvalue of a Hermitian operator in finite dimension.
Used in Proposition 3.8 to pick |ψ⟩ with G|ψ⟩=t|ψ⟩.
standard math The normalized Choi–Jamiołkowski identity (Theorem 2.1), with the stated normalization.
Used to express the winning probability as a trace against the Choi state τ; standard result from [Jam72; Cho75].

how reviews work

0 comments

Cite this review

Pith. "Pith review of Unconditional Unclonable Encryption." pith.science (2026). https://pith.science/paper/D2MDPJLZ

@misc{pith2026260721551,
  author       = {Pith},
  title        = {Pith review of: Unconditional Unclonable Encryption},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D2MDPJLZ}},
  note         = {Machine review of arXiv:2607.21551}
}

read the original abstract

We give an unconditional construction of information-theoretically secure one-time private-key unclonable encryption scheme for one-bit messages, with efficient encryption and decryption and exponentially small unclonable-indistinguishability advantage.

Discussion (0). Sign in to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

Pauli Encodings & Unclonable Encryption
quant-ph 2026-07 conditional novelty 6.0 of 10

Every Pauli Encoding with K keys has MoE winning probability at least 1/2 + 1/(2√K), BB84-style X/Z encodings are insecure, pairwise arguments cannot beat 3/4, and several Pauli families have partial unclonable security.
Pauli Encodings & Unclonable Encryption
quant-ph 2026-07 conditional novelty 6.0 of 10

Introduces Pauli Encodings, proves a universal cloning lower bound 1/2+1/(2*sqrt(K)), a 3/4 obstruction against pairwise-marginal arguments, and a level-3 NPA upper bound approximately 0.5556 for anticommuting keys.
Statistically secure uncloneable encryption of arbitrary messages
quant-ph 2026-07 accept novelty 6.0 of 10

Clifford-based one-time uncloneable encryption extends from one bit to arbitrary-length messages with statistical security and polynomial-time encoding.

Reference graph

Works this paper leans on

21 extracted references · 2 linked inside Pith · cited by 2 Pith papers

[1]

and Zurek, Wojciech H

Wootters, William K. and Zurek, Wojciech H. , title =. Nature , volume =. 1982 , doi =

1982
[2]

Prompt Used for ``A Proof of the Cycle Double Cover Conjecture'' , date =
[3]

UCLA Moonshot Harness , year =

Junyi Zhang. UCLA Moonshot Harness , year =
[4]

Physics Letters A , volume =

Dieks, Dennis , title =. Physics Letters A , volume =. 1982 , doi =

1982
[5]

ACM SIGACT News , volume =

Wiesner, Stephen , title =. ACM SIGACT News , volume =. 1983 , doi =

1983
[6]

Quantum Information and Computation , volume =

Gottesman, Daniel , title =. Quantum Information and Computation , volume =. 2003 , doi =

2003
[7]

Uncloneable Quantum Encryption via Oracles , booktitle =

Broadbent, Anne and Lord, S. Uncloneable Quantum Encryption via Oracles , booktitle =. 2020 , doi =

2020
[8]

Theory of Cryptography , series =

Ananth, Prabhanjan and Kaleoglu, Fatih , title =. Theory of Cryptography , series =. 2021 , doi =

2021

Show all 21 references

[9]

Advances in Cryptology---CRYPTO 2022, Part II , series =

Ananth, Prabhanjan and Kaleoglu, Fatih and Li, Xingjian and Liu, Qipeng and Zhandry, Mark , title =. Advances in Cryptology---CRYPTO 2022, Part II , series =. 2022 , doi =

2022
[10]

Advances in Cryptology---CRYPTO 2023, Part V , series =

Ananth, Prabhanjan and Kaleoglu, Fatih and Liu, Qipeng , title =. Advances in Cryptology---CRYPTO 2023, Part V , series =. 2023 , doi =

2023
[11]

2021 , eprint =

Majenz, Christian and Schaffner, Christian and Tahmasbi, Mehrdad , title =. 2021 , eprint =

2021
[12]

16th Innovations in Theoretical Computer Science Conference (ITCS 2025) , series =

Ananth, Prabhanjan and Kaleoglu, Fatih and Yuen, Henry , title =. 16th Innovations in Theoretical Computer Science Conference (ITCS 2025) , series =. 2025 , doi =

2025
[13]

Coladangelo, Andrea and Liu, Qipeng and Xie, Ziyi , title =
[14]

Nature Physics , volume =

Bhattacharyya, Archishna and Culf, Eric , title =. Nature Physics , volume =. 2026 , doi =

2026
[15]

Towards Unconditional Uncloneable Encryption , journal =

Botteron, Pierre and Broadbent, Anne and Culf, Eric and Nechita, Ion and Pellegrini, Cl. Towards Unconditional Uncloneable Encryption , journal =. 2026 , doi =

2026
[16]

2026 , eprint =

Bhattacharyya, Archishna and Broadbent, Anne and Culf, Eric , title =. 2026 , eprint =

2026
[17]

2018 , doi =

Watrous, John , title =. 2018 , doi =

2018
[18]

Linear Transformations Which Preserve Trace and Positive Semidefiniteness of Operators , journal =

Jamio. Linear Transformations Which Preserve Trace and Positive Semidefiniteness of Operators , journal =. 1972 , doi =

1972
[19]

Linear Algebra and its Applications , volume =

Choi, Man-Duen , title =. Linear Algebra and its Applications , volume =. 1975 , doi =

1975
[20]

arXiv preprint arXiv:2603.11437 , year=

Unclonable Encryption in the Haar Random Oracle Model , author=. arXiv preprint arXiv:2603.11437 , year=

arXiv
[21]

arXiv preprint arXiv:2103.14510 , year=

Limitations on uncloneable encryption and simultaneous one-way-to-hiding , author=. arXiv preprint arXiv:2103.14510 , year=

arXiv

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.

[1] [1]

and Zurek, Wojciech H

Wootters, William K. and Zurek, Wojciech H. , title =. Nature , volume =. 1982 , doi =

1982

[2] [2]

Prompt Used for ``A Proof of the Cycle Double Cover Conjecture'' , date =

[3] [3]

UCLA Moonshot Harness , year =

Junyi Zhang. UCLA Moonshot Harness , year =

[4] [4]

Physics Letters A , volume =

Dieks, Dennis , title =. Physics Letters A , volume =. 1982 , doi =

1982

[5] [5]

ACM SIGACT News , volume =

Wiesner, Stephen , title =. ACM SIGACT News , volume =. 1983 , doi =

1983

[6] [6]

Quantum Information and Computation , volume =

Gottesman, Daniel , title =. Quantum Information and Computation , volume =. 2003 , doi =

2003

[7] [7]

Uncloneable Quantum Encryption via Oracles , booktitle =

Broadbent, Anne and Lord, S. Uncloneable Quantum Encryption via Oracles , booktitle =. 2020 , doi =

2020

[8] [8]

Theory of Cryptography , series =

Ananth, Prabhanjan and Kaleoglu, Fatih , title =. Theory of Cryptography , series =. 2021 , doi =

2021