Cryptography

The design and analysis of protocols that protect information or authenticate messages in the presence of adversaries. It includes ciphers, digital signatures and cryptographic hash functions.

Cryptographic confidentiality protects the content of a message against specified adversaries. The security claim must identify which participants are excluded from learning the protected content and what side information or metadata is outside the claim. A provider that receives plaintext is not excluded merely because its incoming connection uses encryption.

Transport Layer Security creates a protected channel between protocol peers. The application determines the intended peer and how its authentication is interpreted; a provider-authorised CDN edge can be such a peer. Channel protection does not make that peer unable to read data delivered to it.^[ref]

TLS termination occurs at a TLS peer that decrypts incoming records and participates in the channel authentication and key agreement. An intermediary terminating one TLS channel and initiating another is an endpoint of each channel, not an opaque forwarder.

Suppose client A uses a protected channel to proxy P, which reads the message and sends it over a second protected channel to service B. Even if both channels protect against outsiders, P has the plaintext by construction. Therefore the conjunction of those channel protections does not imply cryptographic confidentiality from P. This counterexample does not imply that P is unauthorised; it identifies a trust assumption that application designers must state.

Cryptographic tasks and protocols using quantum systems. Quantum key distribution is one application; it should not be confused with post-quantum cryptography, which studies classical schemes intended to resist quantum computation.

A verification scheme using quantum states as part of a banknote or token. Secret-basis qubits can make extra copies hard to produce because their encodings are nonorthogonal. Security claims must specify the adversary's information, access to original tokens and the verification procedure; the no-cloning theorem alone does not fix every forging probability.

If a known classical bit is independently encoded in a secret uniformly chosen X or Z eigenbasis, the averaged verification operator is $A_b=I/2+(-1{)}^b(X+Z)/4$. Its largest eigenvalue is the displayed optimal acceptance probability for a counterfeit prepared without the original qubit. The maximizing state bisects the two candidate Bloch directions. For $n$ independent secret bases, the maximal all-pass probability is the $n$th power, because the total acceptance operator is a tensor product. Randomly choosing one of the legitimate encodings instead passes with probability $3/4$ per bit.

Cryptography intended to remain secure against adversaries with quantum computers. It includes classical algorithms based on problems other than the integer factorization and discrete logarithm problems efficiently treated by Shor's algorithm. A candidate's security still depends on its precise construction, parameters and known attacks; the label alone is not a proof. It is distinct from requiring quantum hardware for quantum key distribution.

A one-way function is efficiently computable but computationally infeasible to invert on a randomly sampled input with nonnegligible success probability, under its stated security assumption. An RSA cryptosystem supplies the candidate map $x\mapsto x^e\mathrm{mod}N$ on units modulo $N$. Inversion hardness is an assumption; it is not a proved consequence of merely choosing large primes.

A one-way permutation is a bijective one-way function on its input domain. Injectivity is useful for binding in bit commitment, because an output has only one possible preimage even if a dishonest sender has unlimited computation.

A hard-core predicate is an efficiently computable bit of an input to a one-way function that cannot be predicted from the function output with nonnegligible advantage over random guessing. For a one-way function $f$, padding it to $F(x,r)=(f(x),r)$ gives the inner-product predicate $h(x,r)={\sum }_j{x}_j{r}_j\mathrm{mod}2$. This is the Goldreich–Levin construction. It provides a way to mask a bit using an otherwise publicly revealed one-way function value.

A bit commitment allows a sender to fix a bit while concealing it from the receiver until an opening phase. Binding prevents a sender from opening the same commitment as either bit; hiding prevents the receiver from learning the bit prematurely. With a one-way permutation $F$ and a hard-core predicate $h$, a commitment can consist of $F(x)$ and the masked bit $b\oplus h(x)$. Opening reveals $x$. Injectivity gives binding, while unpredictability of the hard-core predicate gives computational hiding. For an RSA cryptosystem, the receiver must not possess the inverse trapdoor.

If the two honest quantum state ensembles have the same density operator, their independently prepared blocks are perfectly hiding. A dishonest sender can instead send one half of a purification of a density operator and retain the other. The Hughston–Jozsa–Wootters theorem allows a measurement of the retained system to prepare either honest ensemble after commitment. If verification checks only the declared states, either opening is then accepted with the honest probabilities. This gives a concrete failure of binding while preserving perfect hiding.

Quantum key distribution uses a quantum channel and an authenticated public classical channel to establish matching random keys for two parties while limiting an eavesdropper's information. The public transcript is included in the adversary's information. In an ideal successful protocol, a key of length $\ell$ is uniform and independent of that information. Actual protocols allow small disagreement and secrecy errors and may abort. Measurement in quantum mechanics disturbance provides parameter tests, while privacy amplification removes residual knowledge after classical reconciliation. The BB84 protocol and entanglement-based protocols are examples.

The disagreement probability of Alice's and Bob's sifted bits under their agreed outcome-to-bit maps. A finite test sample estimates this probability; the estimate and its uncertainty enter parameter estimation before information reconciliation and privacy amplification.

Classical error correction used to make two candidate keys agree. The disclosed information is part of the eavesdropper's side information and must be included when choosing the amount of privacy amplification.

Selecting the raw key rounds from announced measurement settings and other public acceptance data. Outcomes revealed for parameter estimation must be excluded from the secret raw key. Basis announcements follow receipt of the quantum systems; premature basis announcement in quantum key distribution can permit a memory attack.

A communication channel whose messages are public but whose origin and integrity are authenticated. In quantum key distribution, Eve may read basis announcements and reconciliation data, but must not be able to replace them while impersonating a legitimate party. Authentication itself consumes a prior trust resource; the quantum transmission does not authenticate the classical peer automatically.

Entanglement-based key distribution that tests correlations with a Bell inequality. Equal measurement axes generate correlated key data; other settings test the quantum channel. Authentication, statistical parameter estimation, information reconciliation and privacy amplification are needed to turn observed correlations into a secure shared key under specified assumptions.^[ref]

An eavesdropper measures quantum carriers and forwards states consistent with the outcomes. The resulting disturbance is tested statistically by the legitimate users. For a singlet measured by Eve on both sides along ${\mathbf{n}}_a,{\mathbf{n}}_b$, the forwarded correlation is $-(\mathbf{a}\cdot {\mathbf{n}}_a)({\mathbf{n}}_a\cdot {\mathbf{n}}_b)(\mathbf{b}\cdot {\mathbf{n}}_b)$. It follows by averaging the product of the conditional local outcome means over Eve's correlated outcomes. This model does not cover every general quantum attack.

Measuring the transmitted qubit in the computational basis and forwarding its measured state produces a dephasing channel for users who do not know the outcome. For a Bell state $|{\Psi }^{+}⟩$, the reduced state becomes $(|01⟩⟨01|+|10⟩⟨10|)/2$. It retains perfect $Z$ anticorrelation while destroying $X$ correlation. Thus a single perfectly correlated key basis need not reveal an intercept-resend attack; incompatible-basis correlation tests can.

Use Alice's CHSH axes $\hat{x},\hat{y}$ and Bob's $(\hat{x}+\hat{y})/\sqrt{2},(-\hat{x}+\hat{y})/\sqrt{2}$, with sign pattern $S=C_{11}-C_{13}+C_{31}+C_{33}$. If Eve measures both singlet particles along planar angles $\alpha ,\beta$, the intercept-resend attack correlation gives $S=-\sqrt{2}{\cos }^2(\alpha -\beta )$. Consequently $-\sqrt{2}\le S\le 0$. Randomly mixing axes independently of the users' secret settings preserves this interval by averaging. The bound is specific to these settings and this attack, rather than a general security theorem.

If basis information and test positions are announced before the receiver confirms receipt of quantum carriers, an eavesdropper can store the carriers until learning that information. In a scheme sending one half of each Bell pair after a Hadamard gate encoding, the eavesdropper then forwards test qubits untouched and measures all data qubits in their now-known correct bases. Every test passes, while data are changed to classically correlated product states whose bit labels the eavesdropper knows. This invalidates the sampling argument needed to justify entanglement purification and quantum key distribution. A sound additional purification certification could detect this attack and abort; it cannot generate private Bell pairs from the separable attacked data. Announcing bases only after receipt prevents this particular delayed-carrier attack.

A protocol for two distant parties to agree on a random bit without trusting either party to announce an unverified coin toss. In the Rabin-Williams scheme, a publicly committed square hides which of two half-interval roots the sender selected. The other party guesses a digit distinguishing those roots; subsequent root and factor revelations verify the completed exchange. The protocol's fairness relies on prescribed randomness and the difficulty of finding a second root; it does not force a party to complete communication.

Privacy amplification compresses a partially secret random string into a shorter key by a publicly selected hash function, reducing an adversary's information about the final key. In the BB84 protocol it follows parameter estimation and error correction, and accounts for information leaked in the public reconciliation transcript. Authentication of the public channel remains necessary.

Assurance of the source and integrity of a message against specified adversarial capabilities. Digital signatures permit public verification, whereas a message authentication code uses a shared secret; encryption alone need not authenticate.

A keyed function producing a tag that a holder of the shared secret can verify. Its message authentication security requires that valid tags for new messages cannot be forged under the allowed adversarial queries. Unlike a digital signature, verification is not inherently public and the verifier also knows a key capable of making tags.

Combine a secret randomly selected almost strongly universal hash family member with a fresh secret output mask. An observed message authentication code tag leaves the hash-selection key hidden, and the conditional hash bound controls substitution forgery probability. The message itself need not be encrypted. Mask reuse can reveal hash differences; repeated-use guarantees require fresh masks and an appropriate analysis of verification information. A one-use polynomial construction needs only two secret field elements, even for a much longer message.

A protocol value intended to be used only once under a specified key. In the ElGamal signature scheme the signing nonce must also be secret and invertible modulo the group order; mere distinctness does not imply unpredictability.

Cryptography using a public key and a corresponding private key. Public-key encryption lets others encrypt for the private-key holder; a digital signature instead lets the holder authenticate messages for public verification.

The published member of a public-key cryptographic key pair. Its association with a particular identity must itself be authenticated; mere knowledge of a purported public key does not establish that identity.

The secret member of a public-key cryptographic key pair, used for decryption or signing according to the scheme. In the RSA cryptosystem the private exponent is not interchangeable with a security proof for textbook signing.

The transformation of a message into a ciphertext using a key, with decryption recovering the message using an appropriate key. Confidentiality and message authentication are separate properties; an encryption scheme needs explicit security hypotheses.

End-to-end encryption protects content between specified ultimate application endpoints, rather than merely protecting transport to an intermediary that may read it. A claimed provider-excluding secrecy property requires that provider to lack the relevant decryption capability. Endpoint compromise and communication metadata remain separate issues.

An attack in which an adversary obtains decryptions of selected ciphertexts, subject to the protocol’s restrictions. The multiplicative structure of textbook RSA cryptosystem permits blinding an intercepted ciphertext by a known invertible factor.

A function mapping messages of arbitrary length to fixed-length digests, designed to provide preimage resistance and collision resistance. In a digital signature protocol the digest also needs an encoding and security properties appropriate to that protocol.

Finding any distinct messages with equal cryptographic hash values should be computationally infeasible under the specified security model. A collision can let a signed digest authenticate an unintended message.

Given a target digest h, finding a message m with H(m)=h should be computationally infeasible under the specified security model. This is distinct from finding two messages with equal digests.

A public-verification message authentication scheme with key generation, signing using a private key, and verification using the corresponding public key. Signing an appropriate digest binds the signature to the message; encryption alone does not provide this authenticity.

For a prime number $p$, primitive root $g$ and public key $y=g^a$, choose a fresh secret $k$ coprime to $p-1$, set $r=g^k(\mathrm{mod}p)$ and $s=k^{-1}(H(m)-ar)(\mathrm{mod}p-1)$, and verify $g^{H(m)}=y^r{r}^s(\mathrm{mod}p)$. Reusing the cryptographic nonce can reveal secret information. The unhashed historical construction allows existential forgery of specially chosen message exponents, so authentication claims require suitable hashing and protocol assumptions.

A signature based on private RSA cryptosystem exponentiation, with public exponentiation used for verification. Textbook $s=m^d(\mathrm{mod}N)$ is multiplicatively forgeable; a secure scheme requires an appropriate encoding and message digest rather than raw message exponentiation.