Pith. sign in

REVIEW 4 major objections 6 minor 30 references

Hybrid Encryption with Certified Deletion in Preprocessing Model

T0 review · 4 major / 6 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A verified deletion certificate in the proposed hybrid scheme is claimed to erase the message information-theoretically, even from a computationally unbounded adversary.

desk verdict The framework is a reasonable synthesis, but the central DEM-CD verification is a tautology, so the paper's main claim collapses; a one-line fix would make it worth revisiting. read the letter →

arxiv 2601.10542 v3 pith:TDUQH75U submitted 2026-01-15 cs.CR cs.ITmath.IT

Kunal Dey , Reihaneh Safavi-Naini This is my paper
classification cs.CRcs.ITmath.IT MSC 94A6081P94
keywords certifieddeletionhybridencryptionpreprocessingmodeleverlastingsecurityinformation-theoreticquantumcryptographyconjugatecodingkeyencapsulationmechanism
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that certified deletion—the ability for a sender to get a verifiable guarantee that a remotely stored file has been irreversibly erased—can be combined with hybrid encryption in the preprocessing model, where sender and receiver start from correlated randomness instead of a one-time pad. The central claim is a composition theorem: if the key-encapsulation component is information-theoretically secure against chosen encapsulation queries and the data-encapsulation component is one-time secure with everlasting certified deletion, then the combined scheme is secure against a computationally unbounded adversary after a deletion certificate verifies. This would matter because it promises everlasting deletion for arbitrarily long messages while keeping the sender's key reusable, removing the one-time-pad key-length cost and making the deletion guarantee independent of computational hardness assumptions. The paper gives two instantiations: one with fully information-theoretic security, and one that uses a block cipher for encryption while still aiming for everlasting certified deletion.

What carries the argument

The carrying object is the composition theorem (Theorem 4), together with a conjugate-coding DEM-CD. The iKEM supplies a key that is statistically close to uniform given the adversary's side information and ciphertext; the DEM-CD supplies a one-time certified-deletion mechanism whose verification step is intended to certify that the conjugate-coded qubits have been measured and therefore no longer carry information about the message. The composition transfers the one-time deletion guarantee to a scheme with many encryption queries, which is what allows arbitrarily long messages to be encrypted efficiently.

What would settle it

Take Construction 2's deletion and verification procedures with a single qubit: if the qubit is encoded in the computational basis and deletion measures in the conjugate basis, the returned bit matches the encoded bit only with probability 1/2. Under an all-positions check, a valid deletion is rejected half the time; under the written comparison, every certificate is accepted. Neither behavior simultaneously satisfies correctness and the imported theorem's hypothesis, so the construction as stated is not a working instantiation.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that the hybrid-encryption framework—an information-theoretic key encapsulation mechanism (iKEM) paired with a data encapsulation mechanism—can be upgraded to support certified deletion, provided the data component is a DEM-CD. The security goal is EV-q_e-CD: after the adversary makes up to q_e encryption queries and then supplies a deletion certificate, if the certificate verifies, even a computationally unbounded adversary who is handed the decryption key cannot tell which of two messages was encrypted. The proof uses a hybrid game that swaps the real encapsulated key for a uniform key, bounding the gap by the iKEM's IND-q_e-CEA advantage, and the

Load-bearing premise

The proof hinges on the deletion certificate being accepted exactly when the message-carrying qubits have been measured in the conjugate basis, but the verification step as written either compares the certificate to itself or demands agreement on all positions, so the certificate's validity does not certify loss of the message.

Editorial extensions

If this is right

  • If Theorem 4 is sound, any IND-q_e-CEA iKEM can be paired with any one-time EV-CD-secure DEM-CD to yield an EV-q_e-CD pHE-CD scheme, giving a modular route to certified deletion.
  • If Construction 2 is secure, a constant-length key suffices to encrypt arbitrarily long messages with quantum-safe encryption and everlasting certified deletion, eliminating the key-length dependence of one-time-pad-based schemes.
  • If the construction is secure, the deletion guarantee is everlasting: once the certificate verifies, the adversary's advantage is negligible even with unbounded computation, so future algorithmic breakthroughs would not retroactively break past deletions.
  • Both constructions use conjugate coding, which is implementable with current quantum technology, so the achieved functionality is not merely theoretical.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The composition theorem suggests a direct route from quantum key distribution to certified deletion: any iKEM instantiated with QKD that can be upgraded to answer encapsulation queries would satisfy Theorem 4; the paper notes this as future work, but the theorem makes it a natural next step.
  • The one-bit Construction 2 is extended to multi-bit messages by encrypting bits independently; this parallel composition would need its own security argument, because the DEM-CD proof is stated for a single challenge and the paper does not provide an explicit multi-bit reduction.
  • An implementer should treat the deletion-verification predicate as a parameter and audit it before deployment: the security proof imports a check that only inspects positions encoded in the conjugate basis, whereas the written verification step describes either an always-true comparison or an all-positions comparison that almost always rejects a valid deletion.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces hybrid encryption with certified deletion in the preprocessing model (pHE-CD), combining an information-theoretic key encapsulation mechanism (iKEM) with a data encapsulation mechanism that supports certified deletion (DEM-CD). It defines EV-q-e-CD security for the composed scheme and gives two constructions: Construction 1, which is claimed to provide information-theoretic security for both encryption and deletion, and Construction 2, which uses an AES-based DEM-CD to provide computational encryption security and everlasting deletion security. The central claim is that, after a deletion certificate is successfully verified, confidentiality becomes information-theoretic. The paper proves a composition theorem (Theorem 4) and instantiates it via Construction 2 (Theorems 5–7).

Significance. If the construction and proofs were correct, the paper would make a useful contribution: it extends certified deletion from the one-time-pad and public-key settings to the preprocessing model, where an iKEM from correlated randomness/QKD could be reused, and it aims to encrypt arbitrary-length messages with a constant-length key. The composition framework is clean, and the idea of combining an iKEM with a DEM-CD is natural. The formal definitions of pHE-CD and EV-q-e-CD security are a reasonable starting point. However, the central instantiation as written has a load-bearing verification bug, and the proof of the main deletion-security theorem relies on that broken predicate. The contribution is therefore not yet established, though the flaw appears locally repairable.

major comments (4)
  1. [IV, Construction 2 (pHE-CD.Vrfy and D-CD.Vrfy, steps 4–5)] In Construction 2, step 5 of both D-CD.Vrfy and pHE-CD.Vrfy parses vk=(x,θ) and cert as x′, then outputs ⊤ if cert_i = x′_i for all i∈[λ]. Since x′ is simply the parsed certificate, this predicate is cert_i=cert_i, so every string is accepted. This is not a minor typo: an adversary can output an arbitrary certificate without touching the quantum register, receive K (because verification passes), and then measure |x⟩_θ in basis θ using K and recover m. Hence the scheme does not satisfy one-time EV-CD security, and Theorems 5 and 7 do not hold for the written construction. If the intended check was cert_i=x_i on all λ positions, honest deletion certificates fail with probability 1 − E_θ[2^{−#{{i:θ_i=0}}}] = 1 − (3/4)^λ, since Hadamard-basis measurement is uniformly random on θ_i=0 positions. Thus neither reading yields a correct verification. The fix is to verify only positions with θ_i=1,
  2. [IV, Theorem 5 and Appendix, Theorem 8] The proof of Theorem 5 invokes [3, Theorem 3.1], restated as Theorem 8, whose deletion check is 'x_i = x′_i for all i such that θ_i=1'. That hypothesis is not satisfied by the written Vrfy, which either checks nothing or checks the wrong set. Moreover, the application in the Appendix does not instantiate Theorem 8 cleanly: the operation Z_λ is said to 'compute m′ := m⊕...' with m undefined, and the three inputs (θ, b′, A) of Theorem 8 are not matched to the construction. The concluding step 'by the correctness of the certified deletion procedure' is exactly what is at issue and cannot be assumed. The trace-distance conclusion is therefore unsupported.
  3. [II, Definition II.8] Definition II.8 states verification correctness as Pr[Vrfy(vk,cert)=⊥]=1, i.e., an honest certificate is rejected with probability 1. The intended property is certainly Pr[...=⊤]=1. As printed, the definition makes verification trivially 'correct' and the deletion experiment always outputs ⊥; it must be corrected before the security definitions are meaningful.
  4. [IV, Construction 1] Construction 1 is not actually specified or proved: the text says the description and proof are omitted because they 'largely follow' Construction 2. Since Construction 2's verification and proof currently fail, the information-theoretic pHE-CD of Construction 1 is not established by the manuscript. Please provide the explicit scheme and a self-contained proof (or a correct reduction to the fixed Construction 2). This is load-bearing because Construction 1 is one of the two advertised contributions.
minor comments (6)
  1. [IV, Construction 2, step 2(c)] Missing closing parenthesis in 'D.Encap(K,(θ, m⊕ L_{i:θ_i=0} xi)'.
  2. [III, Figure 5] Definition III.1 gives pHE-CD.KeyGen input (1^λ, P), but the algorithm in Figure 5 calls iK.KeyGen(1^λ) without P; align the notation.
  3. [IV, Theorem 5] The heading contains the typo 'delection'; should be 'deletion'.
  4. [II, Definition II.9 and III, Definition III.2] The syntax returns (vk, CT) from Enc, but the security experiments send only CT to the adversary. It should be stated explicitly that vk is challenger-side and never revealed before deletion; otherwise a reader may think the verification key is public, which would break the scheme.
  5. [II, Definition II.4] The paper claims 'post-quantum' security for the DEM in Construction 2, but Definition II.4 quantifies over computationally bounded adversaries without specifying QPT. State the quantum adversary model explicitly.
  6. [V, Concluding Remarks] The concluding remarks mention Grover's bound as a basis for security, but the formal proofs in the paper do not use Grover. Either remove that remark or justify it.

Circularity Check

0 steps flagged · score 0.0 of 10

No construction-level circularity; the broken Vrfy predicate is a correctness flaw, not a circular derivation.

full rationale

At the level of the claimed derivation chain, I find no circularity. The main composition theorem (Theorem 4) is a standard hybrid argument: game G1 replaces the iKEM key with a random key, and the two transitions are bounded respectively by the iKEM IND-qe-CEA advantage (Proposition 1) and the DEM-CD EV-CD advantage (Proposition 2). No parameter is fitted from the target advantage, and no equation is reused as its own conclusion. Theorem 5's security claim for D-CD is obtained by importing [3, Theorem 3.1] (restated as Theorem 8) and applying it to a Z_lambda built from an IND-OT DEM; that is an external, parameter-free theorem, not a self-citation chain, and it does not presuppose D-CD's EV-CD security. The self-citation of [22] provides the iKEM/pHE definitions and a prior composition theorem for the encryption part; it is load-bearing for the encryption guarantee but is a previously published, parameter-free result, not an unverified assertion peculiar to this paper. I do flag a serious non-circular bug: Construction 2's Vrfy parses cert as x' and checks cert_i = x'_i, which is the identity predicate, so every certificate is accepted; and the appendix maps the verifier to [3]'s check on positions with theta_i=1, which the written construction does not implement. This breaks the security reduction, but it is a defective or vacuous verification predicate, not a circular derivation: the claimed bound does not follow because the theorem's hypothesis is unsatisfied, not because the bound is assumed as an input. Accordingly, the circularity score is 0; the paper's problems are correctness/verification gaps, not self-referential reasoning.

Assumptions & free parameters 0 free parameters · 6 assumptions · 0 invented entities

No fitted constants appear; the free-parameter count is zero. The paper's claims rest on imported cryptographic theorems (iKEM from [22], the BB84 deletion theorem from [3]) and on a intended-but-not-written verification predicate. The most fragile items are the DEM assumption (making encryption only computationally secure) and the mismatch between the written Vrfy and the imported theorem's hypothesis.

assumptions (6)
  • domain assumption Existence of an IND-qe-CEA secure iKEM
    Used throughout (Definition II.2, Theorems 3, 4, 6, 7). The paper does not construct or prove such an iKEM; it cites [22].
  • domain assumption Existence of an IND-OT secure DEM D
    Used in Construction 2 and Theorems 5–7. The paper proposes AES as an example, making encryption security computational and post-quantum only under a hardness assumption, despite the conclusion's claim of no computational intractability.
  • domain assumption Theorem 3.1 of Bartusek–Khurana [3] (restated as Theorem 8)
    The deletion-security proof of D-CD in Theorem 5 and Appendix VI is a direct application of this external theorem. The paper provides no self-contained proof of the core quantum deletion step.
  • ad hoc to paper Correct deletion-test behavior of the BB84-based Vrfy predicate (checks θ_i=1 positions)
    Required by Theorem 5/Theorem 8, but the written Vrfy in Construction 2 checks all positions or is a tautology. The intended predicate is imported from [3] and is not what is written.
  • standard math No-cloning theorem and conjugate-coding security of BB84 states
    Invoked via [3] and [6]; the paper relies on the standard quantum-information fact that measuring in the wrong basis gives no reliable bit information.
  • domain assumption Correlated randomness distribution P(XYZ) with side information Z to Eve
    The preprocessing model (Definition II.1) assumes Alice and Bob start with correlated samples and Eve holds leakage Z; this physical setup (e.g., QKD) is the basis for iKEM security.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hybrid Encryption with Certified Deletion in Preprocessing Model." pith.science (2026). https://pith.science/paper/TDUQH75U

@misc{pith2026260110542,
  author       = {Pith},
  title        = {Pith review of: Hybrid Encryption with Certified Deletion in Preprocessing Model},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TDUQH75U}},
  note         = {Machine review of arXiv:2601.10542}
}
read the original abstract

Certified deletion allows Alice to outsource data to Bob and, at a later time, obtain a verifiable guarantee that the file has been irreversibly deleted at her request. This functionality, while impossible using classical information alone, can be achieved using quantum information. Existing approaches rely either on one-time pad (OTP) encryption or on computational hardness assumptions that may be vulnerable to future advances in classical or quantum computing. In this work, we introduce and formalize hybrid encryption with certified deletion in the preprocessing model (pHE-CD) and propose two constructions. Each construction composes an information-theoretic key encapsulation mechanism (iKEM) with a data encapsulation mechanism that provides certified deletion (DEM-CD) security, offering different security guarantees depending on the properties of DEM-CD. When DEM-CD is one-time information-theoretically secure, the composition provides information-theoretic security for both encryption and certified deletion. When DEM-CD is computationally secure, the composed construction provides computationally secure (post-quantum) encryption and everlasting certified deletion, where confidentiality is computational until the deletion certificate is successfully verified. After successful verification, confidentiality becomes unconditional. That is, successful verification of the deletion certificate guarantees that the data has been removed information-theoretically from the adversary's view. Both pHE-CD constructions support the encryption of arbitrarily long messages. Construction 2 is key-efficient and uses a DEM-CD built from quantum coding and AES, providing quantum-safe security for encryption. We conclude by discussing the implications of our results and directions for future research.

Figures

Figures reproduced from arXiv: 2601.10542 by the authors.

Figure 1
Figure 1. The distinguishing game IKINDatk-b iK,A are generated by the challenger in the above game using the encapsulation algorithm. Oracle accesses for each attack are defined below. ε denotes an empty string. atk O1(·) O2(·) ot ε ε qe-cea iK.Encap(X, ·) ε (qe, qd) -cca {iK.Encap(X, ·), iK.Decap(Y, ·)} {iK.Encap(X, ·), iK.Decap(Y, ·)} We say that iK provides σ(λ)-IND-ATK security if Advikind-atk iK,A (λ) ≤ σ(λ) for all com… view at source ↗
Figure 2
Figure 2. The distinguishing game INDatk-b D,A where oracle access for each attack is defined below, and ε denotes an empty string [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 4
Figure 4. The distinguishing game INDatk-b pHE,A versaries A where atk ∈ {ot, qe-cpa,(qe, qd)-cca}, and σ(λ) is a negligible function of λ. Security Theorem for pHE: Security of pHE against a com￾putationally bounded adversary with access to qe encapsulation queries, constructed from an iKEM and a computationally secure DEM, was proved in the following theorem. Theorem 2 ( [22, Theorem 2]). Let an iKEM iK be σ(λ)-IND￾qe-CEA s… view at source ↗
Figures from the paper (2 more)
Figure 3
Figure 3. Figure 3: Hybrid encryption in preprocessing model [PITH_FULL_IMAGE:figures/full_fig_p004_3.png]
Figure 5
Figure 5. Figure 5: Hybrid encryption with certified deletion in preprocessing model [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

30 extracted references

  1. [3]

    Cryptography with certified deletion

    James Bartusek and Dakshita Khurana. Cryptography with certified deletion. InAnnual International Cryptology Conference, pages 192–

  2. [1]

    Cryptography from pseudorandom quantum states

    Prabhanjan Ananth, Luowen Qian, and Henry Yuen. Cryptography from pseudorandom quantum states. InAnnual International Cryptology Conference, pages 208–236. Springer, 2022

    2022

  3. [2]

    Experimental quantum key distribution with finite-key security analysis for noisy channels.Nature communications, 4(1):2363, 2013

    Davide Bacco, Matteo Canale, Nicola Laurenti, Giuseppe Vallone, and Paolo Villoresi. Experimental quantum key distribution with finite-key security analysis for noisy channels.Nature communications, 4(1):2363, 2013

    2013

  4. [4]

    Quantum cryptography: Public key distribution and coin tossing.Theoretical computer science, 560:7– 11, 2014

    Charles H Bennett and Gilles Brassard. Quantum cryptography: Public key distribution and coin tossing.Theoretical computer science, 560:7– 11, 2014

    2014

  5. [5]

    Tight bounds on quantum searching.Fortschritte der Physik: Progress of Physics, 46(4-5):493–505, 1998

    Michel Boyer, Gilles Brassard, Peter Høyer, and Alain Tapp. Tight bounds on quantum searching.Fortschritte der Physik: Progress of Physics, 46(4-5):493–505, 1998

    1998

  6. [6]

    Quantum encryption with certified deletion

    Anne Broadbent and Rabib Islam. Quantum encryption with certified deletion. InTheory of Cryptography: 18th International Conference, TCC 2020, Durham, NC, USA, November 16–19, 2020, Proceedings, Part III 18, pages 92–122. Springer, 2020

    2020

  7. [7]

    A practical public key cryp- tosystem provably secure against adaptive chosen ciphertext attack

    Ronald Cramer and Victor Shoup. A practical public key cryp- tosystem provably secure against adaptive chosen ciphertext attack. InAdvances in Cryptology—CRYPTO’98: 18th Annual International Cryptology Conference Santa Barbara, California, USA August 23–27, 1998 Proceedings 18, pages 13–25. Springer, 1998

    1998

  8. [8]

    Secure composition of quantum key distribution and symmetric key encryption

    Kunal Dey and Reihaneh Safavi-Naini. Secure composition of quantum key distribution and symmetric key encryption. In2025 IEEE Interna- tional Symposium on Information Theory (ISIT), pages 1–6, 2025

    2025

Show all 30 references
  1. [9]

    Practical challenges in quantum key distribution.npj Quantum Information, 2(1):1–12, 2016

    Eleni Diamanti, Hoi-Kwong Lo, Bing Qi, and Zhiliang Yuan. Practical challenges in quantum key distribution.npj Quantum Information, 2(1):1–12, 2016

    2016

  2. [10]

    Communication by epr devices.Physics Letters A, 92(6):271–272, 1982

    DGBJ Dieks. Communication by epr devices.Physics Letters A, 92(6):271–272, 1982

    1982

  3. [11]

    A fast quantum mechanical algorithm for database search

    Lov K Grover. A fast quantum mechanical algorithm for database search. InProceedings of the twenty-eighth annual ACM symposium on Theory of computing, pages 212–219, 1996

    1996

  4. [12]

    Practical evaluation of security for quantum key dis- tribution.Physical Review A—Atomic, Molecular, and Optical Physics, 74(2):022307, 2006

    Masahito Hayashi. Practical evaluation of security for quantum key dis- tribution.Physical Review A—Atomic, Molecular, and Optical Physics, 74(2):022307, 2006

    2006

  5. [13]

    Concise and tight security analysis of the bennett–brassard 1984 protocol with finite key lengths

    Masahito Hayashi and Toyohiro Tsurumaru. Concise and tight security analysis of the bennett–brassard 1984 protocol with finite key lengths. New Journal of Physics, 14(9):093014, 2012

    1984

  6. [14]

    Kem/dem: Necessary and sufficient conditions for secure hybrid encryption.IACR Cryptology ePrint Archive, 2006

    Javier Herranz, Dennis Hofheinz, and Eike Kiltz. Kem/dem: Necessary and sufficient conditions for secure hybrid encryption.IACR Cryptology ePrint Archive, 2006

    2006

  7. [15]

    Certified everlasting secure collusion-resistant functional encryption, and more

    Taiga Hiroka, Fuyuki Kitagawa, Tomoyuki Morimae, Ryo Nishimaki, Tapas Pal, and Takashi Yamakawa. Certified everlasting secure collusion-resistant functional encryption, and more. InAnnual Inter- national Conference on the Theory and Applications of Cryptographic Techniques, pa...

    2024

  8. [16]

    Quantum encryption with certified deletion, revisited: Public key, attribute-based, and classical communication

    Taiga Hiroka, Tomoyuki Morimae, Ryo Nishimaki, and Takashi Ya- makawa. Quantum encryption with certified deletion, revisited: Public key, attribute-based, and classical communication. InAdvances in Cryptology–ASIACRYPT 2021: 27th International Conference on the Theory and Appl...

    2021

  9. [17]

    The one-time pad revisited

    Christian Matt and Ueli Maurer. The one-time pad revisited. In2013 IEEE International Symposium on Information Theory, pages 2706– 2710, 2013

    2013

  10. [18]

    Secret key agreement by public discussion from com- mon information.IEEE transactions on information theory, 39(3):733– 742, 1993

    Ueli M Maurer. Secret key agreement by public discussion from com- mon information.IEEE transactions on information theory, 39(3):733– 742, 1993

    1993

  11. [19]

    The concept of transition in quantum mechanics

    James L Park. The concept of transition in quantum mechanics. Foundations of physics, 1(1):23–33, 1970

    1970

  12. [20]

    Security of quantum key distribution.International Journal of Quantum Information, 6(01):1–127, 2008

    Renato Renner. Security of quantum key distribution.International Journal of Quantum Information, 6(01):1–127, 2008

    2008

  13. [21]

    A mathematical model of communication.Urbana, IL: University of Illinois Press, 11:11–20, 1949

    Claude E Shannon and Warren Weaver. A mathematical model of communication.Urbana, IL: University of Illinois Press, 11:11–20, 1949

    1949

  14. [22]

    Information-theoretic key encapsulation and its application to secure communication

    Setareh Sharifian and Reihaneh Safavi-Naini. Information-theoretic key encapsulation and its application to secure communication. In2021 IEEE International Symposium on Information Theory (ISIT), pages 2393–2398. IEEE, 2021

    2021

  15. [23]

    Tight finite-key analysis for quantum cryptography.Nature communications, 3(1):634, 2012

    Marco Tomamichel, Charles Ci Wen Lim, Nicolas Gisin, and Renato Renner. Tight finite-key analysis for quantum cryptography.Nature communications, 3(1):634, 2012

    2012

  16. [24]

    Everlasting multi-party computation

    Dominique Unruh. Everlasting multi-party computation. InAnnual Cryptology Conference, pages 380–397. Springer, 2013

    2013

  17. [25]

    Revocable quantum timed-release encryption.Jour- nal of the ACM (JACM), 62(6):1–76, 2015

    Dominique Unruh. Revocable quantum timed-release encryption.Jour- nal of the ACM (JACM), 62(6):1–76, 2015

    2015

  18. [26]

    Conjugate coding.ACM Sigact News, 15(1):78–88, 1983

    Stephen Wiesner. Conjugate coding.ACM Sigact News, 15(1):78–88, 1983

    1983

  19. [27]

    A single quantum cannot be cloned.Nature, 299(5886):802–803, 1982

    William K Wootters and Wojciech H Zurek. A single quantum cannot be cloned.Nature, 299(5886):802–803, 1982. VI. APPENDIX Theorem 8( [3, Theorem 3.1]).Let{Z λ(·,·,·)} λ∈N be a quantum operation with three arguments taking as input aλ- bit stringθ, a bitb ′ ∈ {0,1}, and aλ-qubit...

    1982

  20. [28]

    SampleK←D.KeyGen(1 λ)andx, θ← {0,1}λ

  21. [29]

    Computem ′ :=m⊕ L i:θi=0 xi and prepare the BB84 state|x⟩ θ

  22. [30]

    SinceDis an IND-OT secure data encapsulation mechanism (DEM), it follows thatZ λ semantically hides its first input, as required by Theorem 3.1 of [3]

    Output the joint state(|x⟩ θ ,D.Encap(K,(θ, b′))). SinceDis an IND-OT secure data encapsulation mechanism (DEM), it follows thatZ λ semantically hides its first input, as required by Theorem 3.1 of [3]. Letρ b λ denote the joint quantum state consisting of the ci- phertext, ve...

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.