论文标题
在叠加攻击上分发神话：正式的安全模型和攻击分析
Dispelling Myths on Superposition Attacks: Formal Security Model and Attack Analyses
论文作者
论文摘要
民俗的信念是，如果允许对手执行叠加查询，而诚实的玩家被迫对量子状态执行行动，那么经典加密协议的安全就会自动损坏。另一个广泛的直觉是，在交换消息上执行测量足以保护协议免受这些攻击。 However, the reality is much more complex.处理叠加攻击的安全模型仅考虑无条件安全。相反，考虑到计算安全的安全模型假设所有据称是经典消息都测量了，该消息禁止通过构造叠加攻击分析。 Boneh和Zhandry已开始在Crypto'13的开创性工作中研究经典原始的量子计算安全性，但仅在单党环境中。据我们所知，多方设置中的同等模型仍然缺失。 在这项工作中，我们提出了考虑多党协议叠加攻击的第一个计算安全模型。我们证明，通过证明众所周知的一次性PAD协议的安全性，并对同样信誉良好的YAO协议的变体进行了攻击，可以满足我们的新安全模型。这次攻击后的验尸揭示了失败的确切点，产生了高度违反直觉的结果：添加额外的经典沟通，这对经典安全无害，可以使该协议变得受到叠加攻击。我们使用这种新的知识来构建对叠加攻击具有抵抗力的安全两方计算的第一个具体协议。我们的结果表明，没有直接的答案可以提供对叠加攻击的经典协议的漏洞，也没有适应的对策。
It is of folkloric belief that the security of classical cryptographic protocols is automatically broken if the Adversary is allowed to perform superposition queries and the honest players forced to perform actions coherently on quantum states. Another widely held intuition is that enforcing measurements on the exchanged messages is enough to protect protocols from these attacks. However, the reality is much more complex. Security models dealing with superposition attacks only consider unconditional security. Conversely, security models considering computational security assume that all supposedly classical messages are measured, which forbids by construction the analysis of superposition attacks. Boneh and Zhandry have started to study the quantum computational security for classical primitives in their seminal work at Crypto'13, but only in the single-party setting. To the best of our knowledge, an equivalent model in the multiparty setting is still missing. In this work, we propose the first computational security model considering superposition attacks for multiparty protocols. We show that our new security model is satisfiable by proving the security of the well-known One-Time-Pad protocol and give an attack on a variant of the equally reputable Yao Protocol for Secure Two-Party Computations. The post-mortem of this attack reveals the precise points of failure, yielding highly counter-intuitive results: Adding extra classical communication, which is harmless for classical security, can make the protocol become subject to superposition attacks. We use this newly imparted knowledge to construct the first concrete protocol for Secure Two-Party Computation that is resistant to superposition attacks. Our results show that there is no straightforward answer to provide for either the vulnerabilities of classical protocols to superposition attacks or the adapted countermeasures.
