Mahshid Delavar

Physical Unclonable Functions (PUFs) are physical devices that have unique behaviour which is hard to clone. These hardware structures are considered as an effective and feasible security primitive. The application of a wide variety of PUF structures for different security purposes such as identification and key generation has been widely studied in the context of Classical PUFs. In addition, the quantum-readout PUF (QR-PUF) has been studied as a proposition for a quantum version of classical PUFs. In this paper, we do a comprehensive study on Quantum Physical Unclonable Functions with quantum cryptographic tools. We use a quantum game-based security framework for our analysis and we define a new class of quantum attacks, called General Quantum Emulation Attack (GQEA), applicable on current quantum-readout and hybrid quantum-classical PUFs. This class of attacks are based on using a database of inputs and outputs to emulate the action of an unknown quantum transformation on a new input. We define a concrete attack based on an existing emulation algorithm and use it to show the vulnerability of the current schemes under this attack. Furthermore, we formally define a QPUF for the first time and discuss the security of Unitary QPUFs (UQPUFs) by formally defining the unforgeability property of UQPUFs. We prove any UQPUF provides selective unforgeability property while they cannot provide unconditional and existential unforgeabilities.

In this paper, we continue the line of work initiated by Boneh and Zhandry at CRYPTO 2013 and EUROCRYPT 2013 in which they formally define the notion of unforgeability against quantum adversaries. We develop a general and parameterised quantum game-based security model unifying unforgeability for both classical and quantum constructions allowing us for the first time to present a complete quantum cryptanalysis framework for unforgeability. In particular, we prove how our definitions subsume previous ones while considering more fine-grained adversarial models, capturing the full spectrum of superposition attacks. The subtlety here resides in the characterisation of a forgery. We show that the strongest level of unforgeability in our framework, namely existential unforgeability, can only be achieved if only orthogonal to previously queried messages are considered to be forgeries. We further show that deterministic constructions can only achieve the weaker notion of unforgeability, that is selective unforgeability, against such adversaries, but that selective unforgeability breaks if more general quantum adversaries (capable of general superposition attacks) are considered. On the other hand, we show that PRF is sufficient for constructing a selective unforgeable classical primitive against full quantum adversaries. Moreover, we show similar positive results relying on Pseudorandom Unitaries (PRU) for quantum primitives. \\ These results demonstrate the generality of our framework that could be applicable to other primitives beyond the cases analysed in this paper.

Recently, major progress has been made towards the realisation of the quantum internet to enable a broad range of applications that would be out of reach for classical internet. Most of these applications such as delegated quantum computation require running a secure identification protocol between a low-resource and a high-resource party to provide secure communication. Physical Unclonable Functions (PUFs) have been shown as resource-efficient hardware solutions for providing secure identification schemes in both classical and quantum settings. In this work, we propose two identification protocols based on quantum PUFs (qPUFs) as defined recently by Arapinis et al. In the first protocol, the low-resource party wishes to prove its identity to the high-resource party and in the second protocol, it is vice versa. Unlike existing identification protocols based on Quantum Read-out of PUFs which rely on the security against a specific family of attacks, our protocols provide provable exponential security against any Quantum Polynomial-Time adversary with only polynomial resource parties. We provide a comprehensive comparison between the two proposed protocols in terms of resources such as quantum memory and computing ability required in both parties as well as the communication overhead between them. A stand-out feature of our second protocol is secure identification of a high-resource party by running a purely classical verification algorithm. This is achieved by delegating quantum operations to the high-resource party and utilising the resulting classical outcomes for identification. An interesting application idea that emerges from our second protocol is certification or benchmarking of general quantum computation schemes based on purely running a classical test on the resulting measurement outcomes.