Quantum Fire with Delegated Cloning

AI summary

Overview

Research area: Quantum cryptography — specifically uncloneable cryptography, quantum fire, one-shot signatures, and access control for quantum states.

Technical level: Advanced. The paper assumes familiarity with quantum computation, oracle models (classical oracles queried in superposition), one-shot signatures, and cryptographic reductions involving entangled adversaries.

Scope: The paper introduces delegatable quantum fire — quantum fire in which cloning requires a separate key — and gives two oracle-model constructions: one using a classical secret key and one ("torch-fire") using reusable, uncloneable quantum cloning keys called torches.

What This Paper Is About

Quantum fire is a primitive consisting of efficiently preparable quantum states ("flames") that anyone can efficiently clone but that cannot be efficiently telegraphed — reconstructed from classical communication alone, without pre-shared entanglement. In all prior constructions, cloning is a public operation, so every flame holder can clone. This paper asks whether cloning can instead be delegated to designated parties holding an appropriate key, while flames remain unclonable (in a functional sense) and untelegraphable for everyone else. The authors answer yes with two constructions in the classical-oracle model, the second of which uses reusable quantum keys ("torches") that cannot be used to enable cloning at more locations than the number of torches issued.

Key Contributions

1. A new primitive: delegatable quantum fire. The authors formalize quantum fire augmented with keyed cloning, and argue that the guarantee must be functional uncloneability: a party without the key must be unable to produce two states that each pass verification, regardless of whether they are copies of the original flame.

2. A construction with a classical secret key (Theorem 1.1, informal). Relative to classical oracles, there is a privately verifiable quantum fire scheme with a classical secret cloning key, where flames can be cloned up to O(log λ) generations by any key holder, are uncloneable for efficient quantum adversaries without the key, and are untelegraphable. The secret key is the dual oracle D of the Shmueli–Zhandry one-shot signature scheme, which is needed for signing but not for key generation or verification.

3. Torch-fire: reusable quantum cloning keys with global non-proliferation (Theorem 1.2, informal). A scheme with publicly verifiable flames, reusable quantum torches, untelegraphability even against torch holders, and the guarantee that for any polynomial N and any m ≤ R, no efficient adversary given m torches can enable more than m non-communicating parties to each clone a fresh challenge flame, except with negligible probability. Setting m = 0 implies flames are functionally uncloneable for parties with no torch.

4. A general extraction lemma for separated computations. A lemma handling N separated oracle computations run on an arbitrary, possibly entangled joint input: if at least d of the original computations accept, this is bounded by the probability that at least d efficient local extractors each output a "witness," plus an error term. The authors believe this may be of independent interest for settings with non-communicating parties sharing entanglement.

Main Findings

• Cloning can be keyed without losing untelegraphability. Withholding the dual oracle D from the public makes signing — and hence flame cloning — an authorized operation, while flames remain untelegraphable.

• Classical-key delegation is achievable but bounded in two ways. Flames are privately verifiable (the same secret key verifies and clones), cloning is limited to O(log λ) generations, and a classical key can be copied freely, so the issuer has no control over how many parties can eventually clone.

• Torches are reusable. A single torch can clone a flame polynomially many times in succession, and all resulting flames pass verification with overwhelming probability. Torches work because they are used to sign only in superposition and are never measured — a torch is a one-shot signing state used repeatedly without being consumed.

• Non-proliferation is stronger than uncloneability of the torch state itself. The guarantee is not that a torch cannot be copied, but that m torches cannot confer cloning capability on more than m locations, even if the adversary processes its torches and flames jointly and distributes arbitrarily entangled registers among parties before they separate.

• Security is unconditional relative to classical oracles. Following Çakan–Goyal–Shmueli, each instance is associated with its own sampled collection of classical oracles; the authors note the result can be lifted to a standard oracle model with one global oracle, where setup samples public and secret keys specifying the corresponding oracles.

• Untelegraphability for torch-fire is inherited from CGS fire. Since the flame's accepting effect is |A_a⟩⟨A_a| ⊗ B, dominated by I ⊗ B, it suffices to show the adversary cannot telegraph the CGS part; queries to the combined oracle Γ can be simulated with two queries to the public CGS interface.

• Cloning incurs only negligible disturbance. Cloning makes 2L queries to the oracle Γ, each acting as the ideal affine query up to error 2√d in Euclidean norm, where d is the total signing and tagging error; a hybrid argument over the 2L queries shows the output is negligibly close in trace distance to the torch plus two honest flames.

• Pigeonhole drives the reduction for untelegraphability. Because flame depth is bounded by c(λ) = O(log λ), the reduction has the telegraphing adversary repeat more than 2^{c log(λ)} times; two clones then share a terminal public key, or a terminal key of one appears in the other's history, yielding a one-shot signature forgery either way.

Methodology in Plain English

The authors build both schemes on the Shmueli–Zhandry one-shot signature scheme, in which a signing state is a uniform superposition over an affine coset W_y and signing requires a special "dual oracle" D that is not needed for generating keys or verifying signatures.

For the first construction, they adapt the template of Casper–Nehoran–Sattath: a flame is a current signing state plus a chain of signatures certifying its provenance. Cloning means generating two fresh key pairs and using D and the current signing state to sign the pair — consuming the parent and producing two children. Anyone with D can clone; anyone without it can verify but not sign. To argue uncloneability without the key, they replace the full projective test by a weaker coset test, so the whole experiment uses only the forward and inverse oracles, then invoke the delayed collapsing property of Bartusek et al. to move to an experiment where signing states are measured, and finally reduce to one-shot signature security.

For torch-fire, they leave the Çakan–Goyal–Shmueli (CGS) flame intact, so its untelegraphability carries over, and attach an "anchor": an independently generated L-bit one-shot signing state relative to oracles tied to a random label ℓ unique to that flame. A torch is a multi-bit one-shot signing state whose verification keys are published. A dedicated public oracle Γ releases the affine maps needed to re-prepare anchor components only when the query carries a valid anchor signature, a valid torch signature, and a valid CGS tag, all bound to the flame's label and the specific torch. Cloning computes these signatures coherently, queries Γ, and uncomputes everything, leaving the torch essentially undisturbed.

The hard part is non-proliferation. Intuitively, a party that clones its challenge flame must have extracted answers from Γ, hence produced a valid torch signature. Extracting such signatures from m+1 successful parties using only m torches would break one-shot signature security — but the parties share arbitrary entanglement, so success events can be correlated. The authors therefore prove a threshold extraction lemma for N separated computations, using the alternating projector technique of Marriott and Watrous together with a hybrid argument.

Why This Matters

Impact on research. The work separates two things that prior quantum fire conflated: holding a flame and being allowed to replicate it. It introduces a notion of non-proliferation for quantum capabilities that is distinct from standard uncloneability, contributes an extraction lemma for polynomially many entangled, non-communicating parties, and connects one-shot signatures to access control in a new way. It also refines the picture of how no-cloning and no-telegraphing interact under efficient computation.

Real-world applications (as suggested or implied by the paper):

• Delegated credential replication. An issuing authority lets a few trusted quantum servers replicate credentials on demand, without every credential holder gaining that ability.
• Access control mediated by quantum devices. Flames spread freely across quantum devices but cannot be leaked over classical channels, with replication additionally restricted to key holders.
• Bounded distribution of authority. With torch-fire, an organization can issue R torches and know that cloning capability cannot be spread to more than R locations, no matter how insiders collude or entangle their holdings.
• Publicly certifiable randomness and one-shot signing infrastructure. The paper situates torch-fire alongside recent uses of quantum fire for publicly certifiable min-entropy, and torches are built directly from one-shot signing states.

Industry relevance. For any deployment where quantum credentials must be duplicated operationally but not exfiltrated, the distinction between "can use" and "can copy" matters. Torch-fire offers a formal target for such systems, though both constructions currently live in the oracle model and are not yet standard-model deployable.

Future Directions

• Standard-model instantiations. Both constructions are in the classical oracle model; the authors suggest instantiating them in the standard model, for example building on the approach of Casper–Nehoran–Sattath.
• Stronger first construction. Achieving a publicly verifiable variant of the classical-key construction, or supporting an unbounded number of cloning generations with a classical key.
• Stronger untelegraphability for torch-fire. The current guarantee holds against parties that do not share entanglement and communicate classically; a stronger notion would allow arbitrary LOCC protocols between the parties.
• Quantum key-fire with delegatable cloning. The authors flag this as very pertinent and note it seems to require nontrivial additions to their approach.

Target Audience

Quantum cryptography researchers and graduate students already comfortable with the oracle model, one-shot signatures, and reductions involving entangled adversaries. It will be most valuable to those working on uncloneable cryptography, quantum money and lightning, copy-protection, and access control for quantum states, as well as researchers interested in simultaneous extraction techniques for multiple non-communicating parties. Readers without a quantum-computing background will find the technical sections difficult, though the introduction and technical overview are accessible at an intermediate level.

Authors’ abstract

Quantum fire is a recently introduced cryptographic primitive consisting of efficiently preparable quantum states, called \emph{flames}, that admit efficient cloning but resist efficient telegraphing, namely reconstruction via classical communication without preshared entanglement. In all prior constructions of quantum fire, cloning is a public operation that requires no separate key and every holder of a flame state can clone it. For applications to access control, however, an issuer may wish to delegate cloning to designated quantum servers while withholding this capability from other flame holders. To address this, we introduce \emph{delegatable quantum fire}, in which cloning requires a separate key. We give two constructions in the classical-oracle model. Our first construction uses a classical secret key which enables cloning, and any user with the entire key may clone successfully. Our second construction, which we call \emph{torch-fire}, uses quantum cloning keys, called \emph{torches}, which enable cloning while remaining unaffected in the process but cannot otherwise be split or delegated to enable additional cloning. An efficient adversary given $m$ torches cannot, except with negligible probability, enable more than $m$ noncommunicating parties to each clone a fresh, independently issued challenge flame. The adversary may jointly process its resources before separating the parties and distribute arbitrarily entangled registers among them. Both constructions are in the oracle model, relying on public classical oracles that allow queries in quantum superposition.