Pith. sign in

REVIEW 6 minor 17 references

Statistically secure uncloneable encryption of arbitrary messages

T0 review · 0 major / 6 minor · reviewed 2026-07-31 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read One-time uncloneable encryption of messages of any length is statistically secure, with efficient Clifford encoding.

desk verdict Clean group-invariance reduction plus a tight MoE bound closes statistical multi-bit uncloneable encryption for the Clifford scheme. read the letter →

arxiv 2607.28561 v1 pith:K3AK4CAM submitted 2026-07-30 quant-ph

Archishna Bhattacharyya , Anne Broadbent , Eric Culf This is my paper
classification quant-ph PACS 03.67.Dd03.67.Hk
keywords uncloneableencryptionCliffordgroupmonogamyofentanglementstatisticalsecurityquantumclassicalmessagescloning-distinguishingattacksobservableoverlap
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Uncloneable encryption lets a sender encode a classical message as a quantum state so that an adversary who tries to split the ciphertext between two receivers cannot make both recover the message. Single-bit schemes with unconditional security and efficient encoding were already known; this paper shows the same holds for messages of arbitrary length. The authors take the Clifford unitary encoding used for one bit and, using the group structure of the Cliffords, reduce any multi-bit cloning-distinguishing attack to a one-bit attack on fewer qubits. A refined monogamy-of-entanglement bound then gives a security advantage that vanishes as the number of extra qubits grows. The result is an efficient one-time scheme whose cloning success probability is at most the trivial guessing probability plus a term that is negligible whenever the padding is super-logarithmic in the security parameter.

What carries the argument

Haar invariance of the uniform measure on the finite Clifford group (Theorem 3.1): any cloning-distinguishing attack on m-bit Clifford ciphertexts translates into a one-bit attack against the Clifford group on n-m+1 qubits, after which an observable-overlap bound on monogamy-of-entanglement games controls the advantage.

What would settle it

Exhibit an explicit cloning or cloning-distinguishing attack on the n-qubit m-bit Clifford scheme whose success probability exceeds 1/2 + 1/(2√(2^{n-m+1})), or show that some attack family cannot be reduced via the Clifford group action to a one-bit instance.

Watch

Extended reading notes

Core claim

For the Clifford quantum encryption scheme on n qubits encrypting m-bit messages, the cloning-distinguishing value is at most 1/2 + (d^{3/2}-1)/(2(d^2-1)) where d = 2^{n-m+1}, which is at most 1/2 + 1/(2√d). Consequently the cloning value itself is at most 2^{-m} + 2^{-(n-m+1)/2}. Whenever n-m grows faster than the log of the security parameter, the efficient family is therefore strongly uncloneable and strongly uncloneable-indistinguishable secure.

Load-bearing premise

The reduction step assumes that the uniform distribution over Clifford unitaries is invariant under left group action in a way that faithfully converts every multi-bit attack into a one-bit attack on a smaller Clifford subgroup; if that translation fails for some attacks, the multi-bit bound does not follow.

Editorial extensions

If this is right

  • One-time uncloneable encryption of arbitrary-length classical messages admits statistical security with polynomial-time encryption and decryption.
  • The security gap matches the known optimal lower-bound order Θ(2^{-(n-m)/2}), so the Clifford scheme is essentially tight.
  • Reusable uncloneable encryption remains only computationally secure; the information-theoretic barrier is confined to the multi-use setting.
  • Any further improvement in single-bit Clifford monogamy bounds immediately upgrades the multi-bit security parameter via the same reduction.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same group-invariance reduction should apply to other unitary designs that contain a large Clifford subgroup, potentially yielding uncloneable schemes from weaker randomness sources.
  • Because the bound is tight up to constants, practical parameter selection reduces to choosing padding length slightly larger than twice the security parameter in bits.
  • The technique separates the combinatorial structure of the Clifford group from the analytic monogamy bound, suggesting a modular template for other uncloneable primitives built on designs.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

0 major / 6 minor

Summary. The paper shows that the Clifford-based quantum encryption of classical messages (QECM) scheme, already known to give unconditional uncloneable encryption of a single bit, extends to messages of arbitrary length while retaining statistical (information-theoretic) security and efficient encryption/decryption. The argument proceeds in three steps: a group-invariance reduction (Theorem 3.1) that bounds the m-bit cloning-distinguishing value by the 1-bit value on n-m+1 qubits; a refined monogamy-of-entanglement bound for unitary observables via an observable-overlap quantity and a conditional-overlap lemma (Theorem 4.2); and an evaluation of that bound on the Pauli observables of the Clifford game, yielding cd(Q_{C_n,m}) ≤ 1/2 + (d^{3/2}-1)/(2(d^2-1)) ≤ 1/2 + 1/(2√d) with d = 2^{n-m+1} (Theorem 5.1) and the cloning-value corollary c(Q_{C_n,m}) ≤ 2^{-m} + 2^{-(n-m+1)/2}. Consequently, whenever the pad length n-m is ω(log λ), the efficient family is strongly uncloneable and strongly uncloneable-indistinguishable secure.

Significance. The result closes a natural open question left by the recent unconditional single-bit constructions and by computational multi-bit schemes: one-time uncloneable encryption of arbitrary-length messages admits statistical security with polynomial encoding. The reduction exploits only the Clifford group structure and Haar invariance, and the overlap analysis is elementary and self-contained; together they give a clean, essentially optimal security bound (matching the known Ω(1/√d) lower-order term). The work therefore completes the information-theoretic picture for the one-time primitive and supplies a reusable technical lemma (Theorem 4.2) of independent interest for monogamy games.

minor comments (6)
  1. [§2] Definitions 2.5–2.6 both introduce the symbol Q_{V,m} (once for the QECM, once for the MoE game); the subsequent text then switches to G_{V,m}. Please adopt a single consistent notation (e.g., always G for games) and fix the sentence after Def. 2.6 that still writes w(G_{V,m}).
  2. [§5] Opening sentence of §5: “we shown unconditional” → “we show unconditional”.
  3. [Corollary 5.2] Corollary 5.2 display: the second term is rendered as “1/2^{n-m+1}_2” in the source text; it should read 2^{-(n-m+1)/2} (or 1/2^{(n-m+1)/2}) to match the proof calculation that uses the looser 1/(2√d) bound of Theorem 5.1.
  4. [§4, proof of Thm. 4.2] In the proof of Theorem 4.2 the appeal to density of invertible matrices when handling (B-Γ) and (I-Δ) is correct but terse; a one-sentence remark that the operator-norm bound is continuous under norm-limits would make the approximation step fully explicit.
  5. [§3] Theorem 3.1: the reduction first replaces an arbitrary pair (x_0,x_1) by (0^m,0^{m-1}1) via a Clifford C. It would help the reader to record that conjugation by C merely relabels the attack POVMs and therefore does not change the success probability.
  6. [References] References: several arXiv identifiers appear with “DOI: doi.org/...”; standardize to either arXiv: or a proper DOI link. Also “E-print arXiv:” vs “arXiv preprint” is inconsistent.

Circularity Check

1 steps flagged · score 1.0 of 10

Self-contained group-invariance and observable-overlap proofs; self-citations are contextual, not load-bearing for the multi-bit upper bound.

  1. self citation load bearing [§5, Theorem 5.1 paragraph on optimality]
    "A result of [BCR26] gives that the cloning-distinguishing value is lower-bounded by 1/2 + O(1/√(2^{n-m})), so this gives the optimal behaviour."

    The matching lower bound is cited from overlapping authors (Broadbent–Culf–Rochette). It is not used to derive the upper bound or the security claim, only to label the bound optimal; therefore it is a minor non-load-bearing self-citation, not a circular forcing of the main theorem.

full rationale

The central claims (Theorem 3.1 reducing m-bit Clifford cloning-distinguishing value to a 1-bit Clifford game via Haar invariance of the finite Clifford group; Theorem 4.2 bounding MoE winning probability by observable overlap; Theorem 5.1/Corollary 5.2 evaluating that bound on Pauli observables) are written out as elementary operator-norm and power-series arguments inside the paper. Overlap c(A,μ) and winning probability w(G) are independent game quantities; the Pauli-basis evaluation is parameter-free and does not redefine the security target as an input. Citations to BBC26a/BC26/AS26/Rag26 supply the single-bit motivation and the Clifford scheme definition, while BCR26 is invoked only for a matching lower-bound optimality remark—none of these force the multi-bit upper bound by construction. No fitted parameters, no self-definitional loop, and no uniqueness theorem imported to forbid alternatives. Minor self-citation presence warrants score 1 rather than 0; the derivation chain itself is not circular.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The claim rests on standard finite-dimensional quantum information, the algebraic structure of the Clifford/Pauli groups, and the paper's own MoE overlap bound. No fitted numerical parameters. No new physical entities. Background single-bit schemes and MoE formalism are imported from cited theory; the multi-bit security inequality is derived inside the paper from those axioms.

assumptions (5)
  • standard math Standard quantum mechanics on finite-dimensional Hilbert spaces: CPTP cloning maps, POVMs, partial trace, operator norm, and pure-state/projective w.l.o.g. for MoE strategies.
    Used throughout Definitions 2.1–2.6 and in the proof of Theorem 4.2.
  • standard math The Clifford group on n qubits is a finite unitary group; the uniform distribution is Haar (left/right invariant), and there exist Cliffords mapping any pair of distinct computational-basis message states to 0^m and 0^{m-1}1.
    Invoked as the engine of Theorem 3.1's attack translation and message normalization.
  • standard math Non-identity n-qubit Pauli operators form an orthogonal basis under the Hilbert–Schmidt inner product; including the identity only adds a trivial always-agree measurement that can be deweighted.
    Used in §5 to evaluate observable overlap c = d/d^2 = 1/d and relate w(G) to w(G_{C_N,1}).
  • domain assumption Uncloneable security definitions (cloning value c(Q) and distinguishing value cd(Q)) and the relation c(Q_{V,m}) ≤ w(G_{V,m}), c(Q_{V,1})=cd(Q_{V,1}) as set in the preliminaries.
    Standard in the uncloneable-encryption literature the paper continues; security claims are stated in these metrics.
  • domain assumption Efficient implementability of Clifford sampling/encoding/decoding on p(λ) qubits for polynomial p, so {Q_{C_{p(λ)},q(λ)}} is an efficient QECM family.
    Stated after Definition 2.5; needed for the 'efficient encryption and decryption' part of the main claim.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Statistically secure uncloneable encryption of arbitrary messages." pith.science (2026). https://pith.science/paper/K3AK4CAM

@misc{pith2026260728561,
  author       = {Pith},
  title        = {Pith review of: Statistically secure uncloneable encryption of arbitrary messages},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/K3AK4CAM}},
  note         = {Machine review of arXiv:2607.28561}
}
read the original abstract

Unconditional uncloneable encryption of a single bit with efficient encryption and decryption is now possible. However, whether the extension to messages of arbitrary length achieves statistical security remains to be known. Using the fact that the encoding bases for the single-bit scheme known to be secure consist of a subset of the Clifford unitaries, we show that this scheme can be upgraded to achieve unconditional uncloneable encryption for messages of arbitrary length, with encoding time polynomial in the message length and security parameter. This establishes that one-time uncloneable encryption of arbitrary messages enjoys statistical security.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

17 extracted references · 11 canonical work pages

  1. [1]

    Ananth and A

    [AB24] P. Ananth and A. Behera. A modular approach to unclonable cryptography. In Advances in Cryptology—CRYPTO 2024, volume 7, pages 3–37,

    2024

  2. [7]

    [AS26] P

    DOI: 10.1007/978-3-030-77886-6_17. [AS26] P. Ananth and A. Sahai. Unconditional unclonable encryption.arXiv preprint arXiv:2607.21551,

    arXiv

  3. [9]

    The uncloneable bit exists

    DOI: doi.org/10.48550/arXiv.2603.08916. [BBC+26b] P. Botteron, A. Broadbent, E. Culf, I. Nechita, C. Pellegrini, and D. Rochette. Towards unconditional uncloneable encryption. Quantum, 10: 2157,

    work page Pith review arXiv doi:10.48550/arxiv.2603.08916

  4. [11]

    10 [BC26] A

    arXiv: 2303.00048. 10 [BC26] A. Bhattacharyya and E. Culf. Uncloneable encryption from decoupling. Nature Physics, 22: 315–318,

    arXiv

  5. [12]

    [BCR26] A

    DOI: 10.1038/s41567-025-03154-7. [BCR26] A. Broadbent, E. Culf, and D. Rochette. Optimal untelegraphable encryption and implications for uncloneable encryption. To appear in IACR Communications in Cryptology ,

    work page doi:10.1038/s41567-025-03154-7

  6. [13]

    [BL20] A

    DOI: 10.48550/arXiv.2510.00903. [BL20] A. Broadbent and S. Lord. Uncloneable quantum encryption via oracles. In 15th Conference on the Theory of Quantum Computation, Communication and Cryptography—TQC 2020 , pages 4:1–4:22,

    work page doi:10.48550/arxiv.2510.00903 2020

  7. [15]

    [HKNY24] T

    DOI: 10.1007/978-3-030-84242-0_20. [HKNY24] T. Hiroka, F. Kitagawa, R. Nishimaki, and T. Yamakawa. Robust combiners and universal constructions for quantum cryptography. InTheory of Cryptography Conference, pages 126–158,

    work page doi:10.1007/978-3-030-84242-0_20

  8. [17]

    [Rag26] S

    arXiv: 2103.14510. [Rag26] S. Ragavan. Efficient unclonable encryption from Pauli eigenstates,

    arXiv

Show all 17 references
  1. [18]

    [TFKW13] M

    DOI: 10.48550/ARXIV.2607.21811. [TFKW13] M. Tomamichel, S. Fehr, J. Kaniewski, and S. Wehner. A monogamy-of-entanglement game with applications to device-independent quantum cryptography. New Journal of Physics, 15(10): 103002,

    doi arXiv

  2. [2013]

    DOI: 10.1088/1367-2630/15/10/103002. 11

    doi

  3. [2020]

    [CLLZ21] A

    DOI: 10.4230/LIPIcs.TQC.2020.4. [CLLZ21] A. Coladangelo, J. Liu, Q. Liu, and M. Zhandry. Hidden cosets and applications to unclonable cryptography. In Advances in Cryptology—CRYPTO 2021, volume 1, pages 556–584,

    2020 doi

  4. [2021]

    [AKL+22] P

    DOI: 10.1007/978-3-030-90459-3_11. [AKL+22] P. Ananth, F. Kaleoglu, X. Li, Q. Liu, and M. Zhandry. On the feasibility of unclonable encryption, and more. In Advances in Cryptology—CRYPTO 2022, volume 2, pages 212–241,

    2022 doi

  5. [2022]

    [AKL23] P

    DOI: 10.1007/978-3-031-15979-4_8. [AKL23] P. Ananth, F. Kaleoglu, and Q. Liu. Cloning games: A general framework for unclonable primitives. In Advances in Cryptology—CRYPTO 2023, volume 5, pages 66–98,

    2023 doi

  6. [2023]

    [AKY25] P

    DOI: 10.1007/978-3-031-38554-4_3. [AKY25] P. Ananth, F. Kaleoglu, and H. Yuen. Simultaneous Haar indistinguishability with applications to unclonable cryptography. In 16th Innovations in Theoretical Computer Science Conference (ITCS 2025), pages 7–1. Schloss Dagstuhl–Leibniz-Z...

    2025 doi

  7. [2024]

    [AK21] P

    DOI: 10.1007/978-3-031-68394-7_1. [AK21] P. Ananth and F. Kaleoglu. Unclonable encryption, revisited. In 18th Theory of Cryptography Conference—TCC 2021, volume 1, pages 299–329,

    2021 doi

  8. [2025]

    Ananth and R

    [ALP21] P. Ananth and R. L. La Placa. Secure software leasing. In Advances in Cryptology— EUROCRYPT 2021, volume 2, pages 501–530,

    2021

  9. [2026]

    [BBC26a] A

    DOI: doi.org/10.48550/arXiv.2607.21551. [BBC26a] A. Bhattacharyya, A. Broadbent, and E. Culf. The uncloneable bit exists. arXiv preprint arXiv:2603.08916,

    doi arXiv

Pith tools

Reviewed July 31, 2026 · model on record in the stance chip above.