Pith. sign in

REVIEW 4 major objections 5 minor 51 references

On Post-Quantum Cryptography Authentication for Quantum Key Distribution

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper proves that Post-Quantum Cryptography authentication can bootstrap QKD sessions to information-theoretic security, provided the PQC algorithms stay unbroken during the protocol's active window.

desk verdict Serious formal analysis of PQC-authenticated QKD, but clean_HPT allows one long-term key corruption while the proof assumes none, so Theorem 0 overreaches as written. read the letter →

arxiv 2507.21325 v1 pith:RPQBILPZ submitted 2025-07-28 quant-ph cs.CR

Juan Antonio Vieira Giestinhas , Timothy Spiller This is my paper · ORCID
classification quant-phcs.CR MSC 94A6081P94 PACS 03.67.Dd
keywords QuantumKeyDistributionPost-QuantumCryptographyhybridauthenticatedexchangeT_HPT-termsecurityinformation-theoreticencapsulationmechanismsignature-then-MACauthenticationboundedadversary
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Quantum Key Distribution promises information-theoretically secure keys, but only if the classical channel used to distill them is authenticated, and pre-shared keys do not scale to large networks. This paper tries to establish that Post-Quantum Cryptography with certificates can replace those pre-shared keys for the very first QKD iteration, and that the keys distilled in that iteration can then authenticate all later iterations. It formally specifies two PQC-authenticated key exchanges, one signature-based and one KEM-based, plus a shared-key MAC-based protocol for later rounds, and proves them secure in a hybrid authenticated key exchange model against a bounded hybrid polynomial-time adversary together with a conditioned unbounded adversary. The central conclusion is that, as long as the PQC algorithms remain unbroken during the active window of the protocol, the distilled QKD keys are information-theoretically secure and $\varepsilon_{\mathrm{QKD}} + \varepsilon_{\mathrm{auth}}$-secure, which makes remote onboarding of new QKD users scalable.

What carries the argument

The load-bearing machinery is the hybrid authenticated key exchange (HAKE) security experiment with cleanness predicate $\mathrm{clean}_{\mathrm{HPT}}$, paired with $T_{\mathrm{HPT}}$-term security of PQC primitives: an algorithm is secure for a specified time $T < T_{\mathrm{HPT}}$, where $T_{\mathrm{HPT}}$ is the estimated time a hybrid adversary needs to break it. Each protocol treats the unauthenticated QKD key as an ephemeral secret, binds the QKD transcript and nonces to derived keys through a dual pseudorandom function and a hash, authenticates identities with a PQC signature or KEM, and confirms liveness with a MAC tag, while the cleanness predicate forces the adversary to leave at least one authentication secret uncompromised during the active window. This carries the argument because every game hop in the proof replaces only uncompromised key material with random values.

What would settle it

Run one of the protocols with a concrete NIST-standard signature or KEM, record the wall-clock time from the first public PQC material to the final accept, and compare with the best documented attack time against that algorithm: a successful forgery or decapsulation within that measured window would directly contradict Theorem 0. Alternatively, a distinguishing attack against the dual PRF with a non-negligible advantage in a polynomial number of queries would invalidate the key-derivation chain.

Watch

Extended reading notes

Core claim

The paper's central claim is Theorem 0: the multi-stage and dynamic protocol family $\Pi \in \{\Pi_\Sigma, \Pi_{\mathrm{KEM}}, \Pi_{\mathrm{MAC}}\}$ is HAKE-secure with cleanness predicate $\mathrm{clean}_{\mathrm{HPT}}$ and confidentiality secure, meaning that for any hybrid polynomial-time adversary and any conditioned unbounded adversary, the advantage in the HAKE key-indistinguishability game is negligible in the security parameter $\kappa$. Consequently, the QKD keys distilled with an authenticated transcript are information-theoretically secure and $(\varepsilon_{\mathrm{QKD}} + \varepsilon_{\mathrm{auth}})$-secure, where $\varepsilon_{\mathrm{auth}}$ is the post-quantum authentication security. The proof covers the case of an initiator session without an origin session, a responder session without an origin session, and a matching-session case, in each case splitting by which protocol is run. This construction gives forward secrecy for stored QKD keys, and it permits later QKD iterations to switch from PQC to non-ITS MAC authentication once the shared secret key pool is populated.

Load-bearing premise

The whole argument rests on equation 1: the honest parties' combined authentication computation and transmission time must stay below the estimated time $T_{\mathrm{HPT}}$ it would take a hybrid polynomial-time adversary to break the PQC algorithm, and the paper admits that $T_{\mathrm{HPT}}$ is very hard to estimate and may be overestimated; if a PQC break lands inside the active window, authentication is subverted and the QKD keys are neither authenticated nor information-theoretically secure.

Editorial extensions

If this is right

  • A new QKD user with a valid certificate can join a quantum network remotely, without a physical meeting to exchange pre-shared key material.
  • After the first PQC-authenticated iteration, later QKD iterations can be authenticated with non-ITS MACs from the shared key pool, so PQC use can be limited to the bootstrap stage.
  • Even if the PQC secret keys are revealed after a session reaches accept, previous and current stored QKD keys remain information-theoretically secure because the protocol has perfect forward secrecy.
  • The security analysis is agnostic to the QKD protocol and to the concrete PQC signature or KEM, so the bound applies across discrete-variable and continuous-variable QKD with any NIST-class algorithm.
  • The overall advantage grows polynomially in the number of parties, sessions, and stages, so the first-distilled keys are the most secure ones and should be preferred for later MAC authentication.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the runtime condition $T_A + T_B + T_T < T_{\mathrm{HPT}}$ could be turned into an operational parameter by issuing certificates whose validity period is set by a conservative lower bound on $T_{\mathrm{HPT}}$, and by requiring fresh PQC keys once that period lapses; the paper gestures at such certificates but does not specify how the bound is certified.
  • Editorial inference: a practical deployment would need a way for honest parties to learn $T_{\mathrm{HPT}}$; one testable benchmark is to measure the wall-clock time of the full protocol with a specific NIST KEM and compare it with the best published attack time against that KEM on realistic hardware.
  • Editorial inference: if $T_{\mathrm{HPT}}$ is overestimated, the security collapse is total rather than a graceful degradation from ITS to computational security, because the affected session's authentication is simply absent; this suggests an engineering preference for conservative, short-lived PQC keys.
  • Editorial inference: the same framework could be reused to compare the cost of PQC bootstrap against pure pre-shared ITS-MAC authentication, quantifying by how much $\varepsilon_{\mathrm{auth}}$ worsens when pre-shared secrets are removed.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a general approach for authenticating the classical channel of quantum key distribution (QKD) using post-quantum cryptography (PQC) rather than pre-shared keys, so that new users can join a quantum network remotely. It presents three protocols: a signature-then-MAC protocol (Π_Σ), a KEM-then-MAC protocol (Π_KEM), and a MAC-only protocol (Π_MAC) for subsequent QKD iterations, and analyzes them in an adapted version of the HAKE framework of the Muckle series. The main theorem (Section 8, 'Theorem 0') claims that all three protocols are HAKE-secure under the clean_HPT cleanness predicate and that the distilled QKD keys are information-theoretically secure (ITS) and (ε_QKD + ε_auth)-secure, with ε_auth being the PQC authentication advantage. The security model introduces a hybrid polynomial-time (HPT) bounded adversary and a 'conditioned unbounded adversary' that can control the quantum channel and read the classical QKD traffic but is not allowed to interact with the authentication steps. The proof is a game-hopping argument with a union bound over signature, KEM, MAC, PRF, AEAD, hash, and QKD advantages.

Significance. If the main theorem were established as stated, the paper would provide a useful scalable authentication option for QKD networks, formalizing a design pattern already present in experimental prototypes and connecting it to the Muckle HAKE framework. The paper is transparent about its main assumption: it explicitly introduces T_HPT-term PQC security (Definition 17, Eq. (1)) and acknowledges the practical difficulty of estimating T_HPT (Section 4.2). It also gives full protocol listings and a detailed game sequence, which is valuable for implementers. However, the proof as written does not support the theorem statement: there is a mismatch between the cleanness predicate and the corruption assumptions used in the game hops, one of the central replacements (uniform-random PQC secret keys) is not justified by the primitive definitions, and the claimed ITS property is conditional on an adversary model that is weaker than the standard unbounded adversary. These issues are repairable in a revision, but they currently block the paper's central claim.

major comments (4)
  1. [Definition 21 / Section 8.1.1] Definition 21, Condition 3, for a test session with no origin session, states that one of the listed query sets has not been issued; in particular the first bullet permits exactly one of CorruptQK(i,s,t) and CorruptQK(j,r,t) to be issued before accept. In the Case 1 proof for Π_Σ (Section 8.1.1, Game 4), the replacement of sk_B by a random value is justified by the assertion that 'the HPT adversary A has not issued either CorruptQK(i,j) or CorruptQK(j,i)' — a strictly stronger condition than the predicate. The same gap affects Section 8.1.3, Game 4, for Π_KEM. Consequently the game-hopping argument does not cover all sessions that are clean under clean_HPT, and Theorem 0 is not established as stated. Concretely, if CorruptQK(j,r,t) and CompromiseSK(i,s,t') are issued for an initiator test session, the session can remain clean under a literal reading of Condition 3 while the adversary obtains sk_B and ss_QKD; with the public initial SecState it can then compute K0, K1, and the MAC keys and impersonate the responder before accept.
  2. [Section 8.1.1, Game 4; Section 8.1.3, Game 4] The proofs replace the PQC secret key sk_B (resp. k_B) with 'a uniformly random and independent value of the same length', asserting that the original key is itself uniformly random and independent. Definitions 9 and 11 only require KeyGen to output a key pair; EUF-CMA and IND-CCA security do not imply that the secret key is uniformly distributed over its bit-string encoding (e.g., RSA or lattice secret keys are not uniform). The replacement is therefore not distribution-preserving, and the game hop is invalid as written. A repair would be to replace the key by a fresh independent sample from the scheme's KeyGen distribution, with an appropriate security reduction, or to add an explicit uniformity requirement to the primitive definitions.
  3. [Theorem 0 / Section 4.2 and Definition 17] Theorem 0 states its hypotheses only in terms of standard EUF-CMA, IND-CCA, PRF, and MAC security, but the protocols' security is conditional on the T_HPT-term security assumption and Eq. (1) introduced in Section 4 and used in Section 7.1. Without an explicit hypothesis that Σ and KEM are T_HPT-term HPT-secure and that the runtime condition of Eq. (1) holds, the theorem is false in the stated model, since an HPT adversary could in principle break the PQC authentication if given enough time. The theorem statement and the final security claim should quantify T_HPT and include Eq. (1) as a premise.
  4. [Definitions 1–2 / Section 7.5] The 'ITS' conclusion is stated for the conditioned unbounded adversary of Definition 2, which is explicitly forbidden from interacting with the authentication steps. Since an unbounded adversary can always break the PQC authentication (the paper itself notes in Section 7.5 that 'if an adversary is permanently unbounded, the presented algorithms are not secure'), the final QKD keys are not ITS against the standard unbounded adversary. The theorem and abstract should state the security guarantee as conditional on the conditioned-adversary model, not as ITS in the usual sense; otherwise the headline claim overstates what is proved.
minor comments (5)
  1. [Definition 10] There is a typographical error at the start of the EUF-CMA definition: 'vThe signature scheme' should read 'The signature scheme'.
  2. [Section 6 / Section 8] The main result is called 'Theorem 0' in Section 8 but is referred to as 'Theorem 23' in Section 6 and in the discussion; the numbering should be made consistent.
  3. [Definition 21, Condition 3] The logical structure of Condition 3 is ambiguous: it is not clear whether each bullet is a conjunction that must not be issued as a whole, or a list of individual queries. Formal Boolean conditions, such as ¬(A∧B) versus ¬A∧¬B, would remove the ambiguity that is central to the proof gap discussed above.
  4. [Definition 16] The claimed IND-CPA game for AEAD, described as 'the same as Experiment 4 but there is no public key involved', is not a standard AEAD IND-CPA experiment; Experiment 4 is written for KEM with adversary-chosen keys, whereas AEAD IND-CPA should encrypt challenge messages under a fixed key.
  5. [Section 8.1.1, Game 4] The claim that the adversary 'can target six different digests: H(m'_QKD, m1 to mi), i∈{2,3,4,6,7,8}' is unclear because the hash inputs in the protocol combine the QKD transcript with nonces and labels; the list should be tied to the exact protocol messages and the union bound should be explicit.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the theorem is a conditional game-hopping reduction to external primitive and framework assumptions.

full rationale

The central security claim, Theorem 0, is obtained by a game-hopping reduction in the HAKE framework imported from the Muckle series [15,17,18]. The bound is expressed as a sum of the advantages of the stated primitives (EUF-CMA signatures, IND-CCA KEMs, dual PRFs, AEAD, MACs, hash collision resistance) plus the QKD failure probability ε_QKD. There is no fitted parameter that is later renamed as a prediction, and no quantity is defined in terms of the theorem's own conclusion. The references used for the HAKE framework and QKD composition are external, with no author overlap with the present paper, so the self-citation patterns are absent. The 'conditioned unbounded adversary' in Definition 2 is restricted from attacking the PQC authentication layer; this is an explicit modeling choice rather than a hidden equivalence, and the paper states the resulting limitation that the ITS conclusion holds only under this adversary model and under the T_HPT-term security assumption of Equation 1 and Definition 17, including the admitted difficulty of estimating T_HPT. The skeptic's identified mismatch between clean_HPT Condition 3 and the stronger assumption in Game 4 of Section 8.1.1 is a potential proof gap affecting whether Theorem 0 is established as stated, but it is not a circular reduction by construction: it does not make the conclusion equivalent to its inputs. Under the hard rule that circularity must be exhibited as an equation reducing to itself or a fitted value renamed as a prediction, no such step is found.

Assumptions & free parameters 1 free parameters · 7 assumptions · 1 invented entities

The central claim rests on unproven PQC hardness (T_HPT-term security), composable QKD security from prior literature, and the HAKE framework; the main novel modeling element is the conditioned unbounded adversary, which makes the ITS conclusion possible but also limits its meaning. The game-hopping proof also assumes uniform PQC secret keys, which is not justified.

free parameters (1)
  • T_HPT (adversary runtime bound) = unknown, estimated by benchmarking/risk assessment
    Introduced in Eq. 1; the security proofs require T_A + T_B + T_T < T_HPT, but T_HPT is not measurable or specified; central to the PQC-security assumption.
assumptions (7)
  • domain assumption PQC algorithms are T_HPT-term HPT secure (Definition 17): no HPT adversary can obtain non-negligible advantage before time T_HPT.
    Section 4.2/Definition 17; unproven hardness of the underlying mathematical problems; explicitly acknowledged as a belief. If false, all three protocols fail.
  • standard math Unauthenticated QKD is ε_QKD-secure against the conditioned unbounded adversary (Definitions 4, 5).
    Takes composable QKD security from Portmann-Renner [23], Abidin-Larsson [26], Ben-Or et al. [27]; assumes correct implementation of QKD.
  • standard math The HAKE security experiment of Muckle [15], Figure 5 of Appendix C, correctly models key-exchange security and is reused without being reproduced.
    Section 7 recalls and adapts the framework; the proof depends on this external formal model.
  • domain assumption Symmetric primitives (PRF, dual PRF, MAC, AEAD) are long-term HPT secure (Definition 18), with key sizes doubled against Grover's algorithm.
    Section 4.1; standard heuristic for quantum-resistant symmetric cryptography.
  • standard math Hash function H is at least weakly collision resistant (Definition 8).
    Definition 8; used throughout to compress public transcripts into PRF inputs.
  • ad hoc to paper The conditioned unbounded adversary, though unbounded in resources, is forbidden from interacting with the authentication steps; this restriction is sufficient to establish the paper's ITS claim.
    Definition 2 and Section 7.5; if the adversary were fully unbounded and could attack PQC, the protocols would not be secure, as the paper admits.
  • ad hoc to paper In the game-hopping proof, PQC secret keys (e.g., sk_B in Game 4, Section 8.1.1) can be replaced by uniformly random values while preserving the distribution.
    Section 8.1.1 Game 4 claims sk_B is 'uniformly random and independent'; this is not generally true for signature schemes and is not justified by a key-generation challenger.
invented entities (1)
  • Conditioned unbounded adversary
    purpose: A hypothetical unbounded adversary restricted from interacting with the authentication steps; used as a tool to prove the ITS property of final QKD keys.
    Definition 2. Without this restriction, the scheme is not secure against fully unbounded adversaries (Section 7.5). No falsifiable handle outside the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On Post-Quantum Cryptography Authentication for Quantum Key Distribution." pith.science (2026). https://pith.science/paper/RPQBILPZ

@misc{pith2026250721325,
  author       = {Pith},
  title        = {Pith review of: On Post-Quantum Cryptography Authentication for Quantum Key Distribution},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RPQBILPZ}},
  note         = {Machine review of arXiv:2507.21325}
}
read the original abstract

The traditional way for a Quantum Key Distribution (QKD) user to join a quantum network is by authenticating themselves using pre-shared key material. While this approach is sufficient for small-scale networks, it becomes impractical as the network grows, due to the total quadratic increase in the number of pre-shared keys required. To address this scalability issue, Public Key Infrastructure (PKI) combined with Post-Quantum Cryptography (PQC) offers a more scalable solution, allowing users to authenticate the QKD traffic remotely to obtain information-theoretical secure (ITS) keys under the presented assumptions. Unlike traditional PKI, which relies on classical cryptographic algorithms such as RSA, the approach presented in this paper leverages PQC algorithms that are believed to be resistant to quantum attacks. Similarly to the SIGMA or TLS protocols, authentication, confidentiality, and integrity are achievable against bounded adversaries to ensure secure and scalable quantum networks.

Figures

Figures reproduced from arXiv: 2507.21325 by the authors.

Figure 1
Figure 1. Authenticated key exchange general steps (left); [PITH_FULL_IMAGE:figures/full_fig_p017_1.png] view at source ↗
Figure 2
Figure 2. Example of QKD mono-authenticated with PQC signat [PITH_FULL_IMAGE:figures/full_fig_p020_2.png] view at source ↗
Figure 3
Figure 3. Example of QKD mono-authentication with PQC KEM th [PITH_FULL_IMAGE:figures/full_fig_p026_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Example of shared key-based long-term HPT-secure [PITH_FULL_IMAGE:figures/full_fig_p029_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 37 canonical work pages

  1. [1]

    The Hidden Subgrou p Problem and Post- quantum Group-Based Cryptography

    Kelsey Horan and Delaram Kahrobaei. “The Hidden Subgrou p Problem and Post- quantum Group-Based Cryptography”. In: Mathematical Software – ICMS 2018 . Ed. by James H. Davenport et al. Cham: Springer International Pu blishing, 2018, pp. 218–

    work page 2018

  2. [2]

    Algorithms for quantum computation: discre te logarithms and factoring

    P.W. Shor. “Algorithms for quantum computation: discre te logarithms and factoring”. In: Proceedings 35th Annual Symposium on Foundations of Compute r Science . 1994, pp. 124–134. doi: 10.1109/SFCS.1994.365700

    arXiv 1994

  3. [3]

    Quantum cryptography

    Nicolas Gisin et al. “Quantum cryptography”. In: Rev. Mod. Phys. 74 (1 Mar. 2002), pp. 145–195. doi: 10.1103/RevModPhys.74.145. url: https://link.aps.org/doi/ 10.1103/RevModPhys.74.145

    doi:10.1103/revmodphys.74.145 2002

  4. [4]

    Advances in quantum cryptography

    S. Pirandola et al. “Advances in quantum cryptography”. In: Advances in Optics and Photonics 12.4 (Dec. 2020), p. 1012. issn: 1943-8206. doi: 10 . 1364 / aop . 361502. url: http://dx.doi.org/10.1364/AOP.361502

    doi:10.1364/aop.361502 2020

  5. [5]

    Secure quantum key distribution with rea listic devices

    Feihu Xu et al. “Secure quantum key distribution with rea listic devices”. In: Reviews of Modern Physics 92.2 (May 2020). doi: 10.1103/revmodphys.92.025002 . url: https://doi.org/10.1103%2Frevmodphys.92.025002

    doi:10.1103/revmodphys.92.025002 2020

  6. [6]

    New hash function s and their use in authentication and set equality

    Mark N. Wegman and J.Lawrence Carter. “New hash function s and their use in authentication and set equality”. In: Journal of Computer and System Sciences 22.3 (1981), pp. 265–279. issn: 0022-0000. doi: https : / / doi . org / 10 . 1016 / 0022 - 0000(81)90033-7. url: https://www.sciencedirect.com/science/article/pii/ 0022000081900337

    work page 1981

  7. [7]

    Lightweight Authentication for Quantum Key Distribu- tion

    Evgeniy O. Kiktenko et al. “Lightweight Authentication for Quantum Key Distribu- tion”. In: IEEE Transactions on Information Theory 66.10 (2020), pp. 6354–6368. doi: 10.1109/TIT.2020.2989459

    work page arXiv 2020

  8. [8]

    Post-Quantum Cryptography

    National Institute of Standards and Technology (NIST). Post-Quantum Cryptography

    work page

Show all 51 references
  1. [9]

    Enhancing the Securit y of Classical Commu- nication with Post-Quantum Authenticated-Encryption Sch emes for the Quantum Key Distribution

    Farshad Rahimi Ghashghaei et al. “Enhancing the Securit y of Classical Commu- nication with Post-Quantum Authenticated-Encryption Sch emes for the Quantum Key Distribution”. In: Computers 13.7 (2024). issn: 2073-431X. doi: 10 . 3390 / computers13070163. url: https://www.mdpi.c...

    2024

  2. [10]

    Quantum Authentication Evolution: No vel Approaches for Securing Quantum Key Distribution

    Hassan Termos. “Quantum Authentication Evolution: No vel Approaches for Securing Quantum Key Distribution”. In: Entropy 26.6 (2024). issn: 1099-4300. doi: 10.3390/ e26060447. url: https://www.mdpi.com/1099-4300/26/6/447 . 60

    2024

  3. [11]

    Experimental authentication of qu antum key distribution with post-quantum cryptography

    Liu-Jun Wang et al. “Experimental authentication of qu antum key distribution with post-quantum cryptography”. In: npj Quantum Information 7.1 (May 2021), p. 67. doi: 10.1038/s41534- 021- 00400- 7 . url: https://doi.org/10.1038/s41534- 021-00400-7

    2021 doi

  4. [12]

    Quantum Key Distribution in the Classical Authenticated Key Exchange Framework

    Michele Mosca, Douglas Stebila, and Berkant Ustao˘ glu . “Quantum Key Distribution in the Classical Authenticated Key Exchange Framework”. In : Post-Quantum Cryp- tography. Ed. by Philippe Gaborit. Berlin, Heidelberg: Springer Ber lin Heidelberg, 2013, pp. 136–154. isbn: 978-3...

    2013 doi

  5. [13]

    SIGMA: The ‘SIGn-and-MAc’ Approach to Authenticated Diffie- Hellman and Its Use in the IKE Protocols

    Hugo Krawczyk. “SIGMA: The ‘SIGn-and-MAc’ Approach to Authenticated Diffie- Hellman and Its Use in the IKE Protocols”. In: Advances in Cryptology - CRYPTO

  6. [14]

    Rescorla

    E. Rescorla. The Transport Layer Security (TLS) Protocol Version 1.3 . RFC 8446

  7. [15]

    Many a Mickle Makes a Muckle: A Framework for Provably Quantum-Secure Hyb rid Key Exchange

    Benjamin Dowling, Torben Brandt Hansen, and Kenneth G. Paterson. “Many a Mickle Makes a Muckle: A Framework for Provably Quantum-Secure Hyb rid Key Exchange”. In: Post-Quantum Cryptography. Ed. by Jintai Ding and Jean-Pierre Tillich. Cham: Springer International Publishing, 20...

    2020

  8. [16]

    Experimental Integration of Quantu m Key Distribution and Post- Quantum Cryptography in a Hybrid Quantum-Safe Cryptosyste m

    Lydia Garms et al. “Experimental Integration of Quantu m Key Distribution and Post- Quantum Cryptography in a Hybrid Quantum-Safe Cryptosyste m”. In: Advanced Quantum Technologies 7.4 (2024), p. 2300304. doi: https : / / doi . org /10 .1002 / qute.202300304 . eprint: https://o...

    2024

  9. [17]

    Muckle+: End-to- End Hybrid Authenticated Key Exchanges

    Sonja Bruckner, Sebastian Ramacher, and Christoph Str iecks. “Muckle+: End-to- End Hybrid Authenticated Key Exchanges”. In: Post-Quantum Cryptography . Ed. by Thomas Johansson and Daniel Smith-Tone. Cham: Springer N ature Switzerland, 2023, pp. 601–633. isbn: 978-3-031-40003-2

    2023

  10. [18]

    Quantum-Safe Hybrid Key Exchanges with KEM-Based Authentication

    Christopher Battarbee et al. Quantum-Safe Hybrid Key Exchanges with KEM-Based Authentication. Preprint at https://arxiv.org/abs/2411.04030. 2024. ar Xiv: 2411 . 04030 [cs.CR] . url: https://arxiv.org/abs/2411.04030

    2024 arXiv

  11. [19]

    Pos t-Quantum TLS Without Handshake Signatures

    Peter Schwabe, Douglas Stebila, and Thom Wiggers. “Pos t-Quantum TLS Without Handshake Signatures”. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security . CCS ’20. Virtual Event, USA: Association for Computing Machinery, 2020, pp. 1461–1480...

    2020

  12. [20]

    A single quan- tum cannot be cloned

    William K. Wootters, William K. Wootters, and Wojciech H. Zurek. “A single quan- tum cannot be cloned”. In: Nature 299 (1982), pp. 802–803. url: https : / / api . semanticscholar.org/CorpusID:4339227

    1982

  13. [21]

    Heisenberg’s original derivation of t he uncertainty principle and its universally valid reformulations

    Masanao Ozawa. “Heisenberg’s original derivation of t he uncertainty principle and its universally valid reformulations”. In: Current Science 109.11 (2015), pp. 2006–

    2015

  14. [22]

    Quantum cryptography based on Bell’s t heorem

    Artur K. Ekert. “Quantum cryptography based on Bell’s t heorem”. In: Phys. Rev. Lett. 67 (6 Aug. 1991), pp. 661–663. doi: 10 . 1103 / PhysRevLett . 67 . 661. url: https://link.aps.org/doi/10.1103/PhysRevLett.67.661

    1991 doi

  15. [23]

    Cryptograph ic security of quantum key distribution

    Christopher Portmann and Renato Renner. “Cryptograph ic security of quantum key distribution”. In: ArXiv abs/1409.3525 (2014). url: https://api.semanticscholar. org/CorpusID:14053576. 61

    2014 arXiv

  16. [24]

    Imp roved composable key rates for CV-QKD

    Stefano Pirandola and Panagiotis Papanastasiou. “Imp roved composable key rates for CV-QKD”. In: Phys. Rev. Res. 6 (2 June 2024), p. 023321. doi: 10 . 1103 / PhysRevResearch . 6 . 023321. url: https : / / link . aps . org / doi / 10 . 1103 / PhysRevResearch.6.023321

    2024

  17. [25]

    Key Recycling in Authenticati on

    Christopher Portmann. “Key Recycling in Authenticati on”. In: IEEE Transactions on Information Theory 60.7 (2014), pp. 4383–4396. doi: 10.1109/TIT.2014.2317312

    2014

  18. [26]

    Direct proof of security of Wegman–Carter authentication with partially known key

    Aysajan Abidin and Jan- ˚ Ake Larsson. “Direct proof of security of Wegman–Carter authentication with partially known key”. In: Quantum Information Processing 13.10 (Oct. 2014), pp. 2155–2170. issn: 1573-1332. doi: 10.1007/s11128- 013- 0641- 6 . url: https://doi.org/10.1007/s1...

    2014 doi

  19. [27]

    The Universal Composable Securi ty of Quantum Key Distri- bution

    Michael Ben-Or et al. “The Universal Composable Securi ty of Quantum Key Distri- bution”. In: Theory of Cryptography . Ed. by Joe Kilian. Berlin, Heidelberg: Springer Berlin Heidelberg, 2005, pp. 386–406. isbn: 978-3-540-30576-7

    2005

  20. [28]

    Universal Hash Families and the Left over Hash Lemma, and Appli- cations to Cryptography and Computing

    Douglas Stinson. “Universal Hash Families and the Left over Hash Lemma, and Appli- cations to Cryptography and Computing”. In: Journal of Combinatorial Mathematics and Combinatorial Computing 42 (Mar. 2001)

    2001

  21. [29]

    Authenticat ed Encryption: Relations among Notions and Analysis of the Generic Composition Parad igm

    Mihir Bellare and Chanathip Namprempre. “Authenticat ed Encryption: Relations among Notions and Analysis of the Generic Composition Parad igm”. In: Advances in Cryptology — ASIACRYPT 2000 . Ed. by Tatsuaki Okamoto. Berlin, Heidelberg: Springer Berlin Heidelberg, 2000, pp. 531–...

    2000

  22. [30]

    A Fast Quantum Mechanical Algorithm for Database Search

    Lov K. Grover. “A Fast Quantum Mechanical Algorithm for Database Search”. In: Proceedings of the Twenty-Eighth Annual ACM Symposium on Theor y of Computing . STOC ’96. Philadelphia, Pennsylvania, USA: Association fo r Computing Machinery, 1996, pp. 212–219. isbn: 0897917855. d...

    1996

  23. [31]

    Quantum-Secure Message Au thentication Codes

    Dan Boneh and Mark Zhandry. “Quantum-Secure Message Au thentication Codes”. In: Advances in Cryptology – EUROCRYPT 2013 . Ed. by Thomas Johansson and Phong Q. Nguyen. Berlin, Heidelberg: Springer Berlin Heide lberg, 2013, pp. 592–608. isbn: 978-3-642-38348-9

    2013

  24. [32]

    Universal hashing and authentication c odes

    D. R. Stinson. “Universal hashing and authentication c odes”. In: Designs, Codes and Cryptography 4.3 (July 1994), pp. 369–380. issn: 1573-7586. doi: 10 . 1007 / BF01388651. url: https://doi.org/10.1007/BF01388651

    1994 doi

  25. [33]

    A Modular Approach to the Inc ompressibility of Block- Cipher-Based AEADs

    Akinori Hosoyamada et al. “A Modular Approach to the Inc ompressibility of Block- Cipher-Based AEADs”. In: Advances in Cryptology – ASIACRYPT 2022 . Ed. by Shweta Agrawal and Dongdai Lin. Cham: Springer Nature Switz erland, 2022, pp. 585–

    2022

  26. [34]

    Recommendation for Key Derivation Using Pseudorandom Func tions

    Lily Chen. Recommendation for Key Derivation Using Pseudorandom Func tions. Tech. rep. SP 800-108r1-upd1. Final version, August 2022. N ational Institute of Stan- dards and Technology, 2022. url: https://csrc.nist.gov/pubs/sp/800/108/r1/ upd1/final

    2022

  27. [35]

    Eastlake 3rd

    Tony Hansen and Donald E. Eastlake 3rd. US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF) . RFC 6234. May 2011. doi: 10.17487/RFC6234. url: https://www.rfc-editor.org/info/rfc6234

    2011 doi

  28. [36]

    Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication

    Morris Dworkin. Recommendation for Block Cipher Modes of Operation: the CMAC Mode for Authentication . Tech. rep. SP 800-38B. National Institute of Standards and Technology, 2016. url: https://csrc.nist.gov/pubs/sp/800/38/b/upd1/final

    2016

  29. [37]

    The AES-CMAC Algorithm

    Tetsu Iwata et al. The AES-CMAC Algorithm . RFC 4493. June 2006. doi: 10.17487/ RFC4493. url: https://www.rfc-editor.org/info/rfc4493 . 62

    2006

  30. [38]

    Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC

    Morris Dworkin. Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC . Tech. rep. SP 800-38D. National Institute of Standards and Technology, 2007. url: https://csrc.nist.gov/pubs/sp/800/38/d/final

    2007

  31. [39]

    The Use of Galois Message Authentication Code (GMAC) in IPsec ESP and AH

    John Viega and David McGrew. The Use of Galois Message Authentication Code (GMAC) in IPsec ESP and AH . RFC 4543. May 2006. doi: 10.17487/RFC4543. url: https://www.rfc-editor.org/info/rfc4543

    2006 doi

  32. [40]

    Aggregate Proxy Signature and Verifiably E ncrypted Proxy Signature

    Jin Li et al. “Aggregate Proxy Signature and Verifiably E ncrypted Proxy Signature”. In: Provable Security. Ed. by Willy Susilo, Joseph K. Liu, and Yi Mu. Berlin, Heidel - berg: Springer Berlin Heidelberg, 2007, pp. 208–217. isbn: 978-3-540-75670-5

    2007

  33. [41]

    Beyond eCK: Perfect Fo rward Secrecy under Actor Compromise and Ephemeral-Key Reveal

    Cas Cremers and Mich` ele Feltz. “Beyond eCK: Perfect Fo rward Secrecy under Actor Compromise and Ephemeral-Key Reveal”. In: Computer Security – ESORICS 2012 . Ed. by Sara Foresti, Moti Yung, and Fabio Martinelli. Berlin , Heidelberg: Springer Berlin Heidelberg, 2012, pp. 734–...

    2012

  34. [42]

    O n Post-compromise Secu- rity

    Katriel Cohn-Gordon, Cas Cremers, and Luke Garratt. “O n Post-compromise Secu- rity”. In: 2016 IEEE 29th Computer Security Foundations Symposium (CSF) . 2016, pp. 164–178. doi: 10.1109/CSF.2016.19

    2016 doi

  35. [43]

    Sequences of games: a tool for taming complexity in security proofs

    Victor Shoup. Sequences of games: a tool for taming complexity in security proofs. Cryptology ePrint Archive, Paper 2004/332. 2004. url: https://eprint.iacr.org/ 2004/332

    2004

  36. [44]

    Code-Based Game-P laying Proofs and the Secu- rity of Triple Encryption

    Mihir Bellare and Phillip Rogaway. “Code-Based Game-P laying Proofs and the Secu- rity of Triple Encryption”. In: IACR Cryptol. ePrint Arch. 2004 (2004), p. 331. url: https://api.semanticscholar.org/CorpusID:12916996. 63

    2004

  37. [226]

    isbn: 978-3-319-96418-8

  38. [425]

    isbn: 978-3-540-45146-4

  39. [619]

    isbn: 978-3-031-22966-4

  40. [2003]

    by Dan Boneh

    Ed. by Dan Boneh. Berlin, Heidelberg: Springer Berlin Heid elberg, 2003, pp. 400–

    2003

  41. [2016]

    url: http://www.jstor.org/stable/24906690 (visited on 02/06/2025)

    issn: 00113891. url: http://www.jstor.org/stable/24906690 (visited on 02/06/2025)

    2025

  42. [2018]

    url: https://www.rfc-editor.org/rfc/rfc8446 (visited on 07/03/2025)

    2025

  43. [2024]

    url: https : / / csrc . nist . gov / projects / post - quantum - cryptography (visited on 07/03/2025)

    2025

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.