Sebastianus A. Goorden, Marcel Horstmann, Allard P. Mosk, Boris Škorić, and Pepijn W. H. Pinkse
Abstract
Authentication of persons and objects is a crucial aspect of security. We experimentally demonstrate quantum-secure authentication (QSA) of a classical multiple-scattering key. The key is authenticated by illuminating it with a light pulse containing fewer photons than spatial degrees of freedom and verifying the spatial shape of the reflected light. Quantum-physical principles forbid an attacker to fully characterize the incident light pulse. Therefore, he cannot emulate the key by digitally constructing the expected optical response, even if all information about the key is publicly known. QSA uses a key that cannot be copied due to technological limitations and is quantum-secure against digital emulation. Moreover, QSA does not depend on secrecy of stored data, does not depend on unproven mathematical assumptions, and is straightforward to implement with current technology.
© 2014 Optical Society of America
Authentication of persons can be based on “something that you know,” e.g., digital keys, or “something that you have,” e.g., physical objects such as classical keys or official documents. A drawback of digital keys is that their theft can go unnoticed; a drawback of traditional physical keys is that they can be copied secretly. A physical unclonable function (PUF) is a physical object that cannot feasibly be copied because its manufacture inherently contains a large number of uncontrollable degrees of freedom. Making a sufficiently accurate clone or concocting a device that mimics its physical behavior is infeasible, though not theoretically impossible, given the properties of PUFs [1,2]. See also Supplement 1. A PUF is a function in the sense that it reacts to a stimulus (“challenge”) by giving a response. After manufacture there is a one-time characterization of the PUF in which its challenge–response behavior is stored in a database. The PUF (from this point referred to as the “key”) can later be authenticated by comparing its response behavior to the database; see Fig. 1(a).
Fig. 1. Idea of QSA: (a) In classical authentication of an optical unclonable physical key, a challenge wavefront of sufficient complexity is sent to the key. The response wavefront is compared with those stored in a database (yellow pieces) to make a pass (green light) or fail (red light) decision. However, this verification can be spoofed by an emulation attack (b) in which the challenge wavefront is completely determined and the expected response is constructed by the adversary who knows the challenge–response behavior of the key. (c) In QSA, the challenge is a quantum state for which an emulation attack (d) fails because the adversary cannot actually determine the quantum state, and, hence, any attempt to generate the correct response wavefront fails.
When they are read out classically, PUFs are vulnerable to a class of attacks that we will refer to as digital emulation [Fig. 1(b)]. Here the adversary has knowledge of the key’s properties either from physical inspection of the key or by access to the challenge–response database. He intercepts challenges and is able to provide the correct responses by looking them up in his database. This is a highly relevant scenario as accessible databases are notoriously difficult to protect. So far the only defense against digital emulation is to deploy various sensors that try to detect if some form of spoofing is going on. This leads to an expensive arms race in which it is difficult to ascertain the level of security.
In this Letter we present quantum-secure authentication (QSA) of optical keys, a scheme with highly desirable properties. QSA:
– uses a key that is infeasible to emulate physically;
– is unconditionally secure against digital emulation attacks;
– does not depend on secrecy of any stored data;
– does not depend on unproven mathematical assumptions; and
– is straightforward to implement with current technology.
No comparable object authentication method currently exists, to our knowledge. The use of quantum physics in QSA is inspired by quantum cryptography [3,–5]. However, there are major differences. The aim of quantum cryptography is to generate a secret digital key known only to Alice and Bob, whereas QSA allows Alice to check if Bob possesses a unique physical object. Quantum cryptography requires the existence of an authenticated channel between Alice and Bob, typically based on a secret key that is shared beforehand [6]. In contrast, QSA needs only publicly available information; there are no secrets. See Supplement 1 for an overview of cryptographic primitives and their properties.
Our implementation of QSA uses a three-dimensional random scattering medium as a PUF [1,7,8]. Details are provided in Supplement 1. The challenges are high-spatial-dimension states of light [9–11] with only a few photons. The response is speckle-like and depends strongly on the challenge and the positions of the scatterers. Due to the no-cloning theorem [12] it is impossible for an adversary to fully determine the challenge and therefore to construct the expected response [Figs. 1(c) and 1(d)]. The verifier can, however, easily verify the presence of the encoded information with an appropriate basis transformation, authenticating the key.
After its manufacture, the key is enrolled: the challenge–response pairs are measured with as much light as needed. Each of our challenges is described by a 50×5050×50 binary matrix. Each element corresponds to a phase of either 0 or 𝜋π. A spatial light modulator (SLM1) is used to transform the incoming plane wavefront into the desired challenge wavefront. The challenge is sent to the key and the reflected field is recorded in a phase-sensitive way. The challenge along with the corresponding response is stored in a challenge–response database. In our current implementation this requires 20 kB of computer memory per challenge–response pair. Linearity of the system ensures that every superposition of challenge–response pairs is also a challenge–response pair. Storing a basis of challenge–response pairs, which requires 50 MB of computer memory in our implementation, is sufficient to fully characterize a key.
After enrollment, keys are authenticated using the setup illustrated in Fig. 2. The light source, SLMs, pinhole, and photon detector are part of the authentication device. In the current work, we assume the authentication device is tamper-resistant. Our light source is an attenuated laser beam chopped into 500 ns light pulses each containing 𝑛=230±40 photonsn=230±40 photons. Quantum readout of optical keys can be achieved with single or bi-photon states [13], squeezed states [14], or other fragile quantum states [15]. We use coherent states of light with low mean photon number [16], because in QSA they provide security similar to other quantum states and are easier to implement in real-life applications. A challenge–response pair is constructed using information from the database. SLM1 is used to shape the few-photon challenge wavefront, which is then sent to the key. The reflected wavefront is sent to SLM2, which adds to it the conjugate phase pattern of the expected response wavefront. Therefore, SLM2 transforms the reflected speckle field into a plane wave only when the response is correct. In case the response is wrong, SLM2 transforms the field into a completely different speckle field. When the response is correct, the lens positioned behind SLM2 focuses the plane wave to a point in the analyzer plane, as shown in Fig. 2(b). A false key will result in a speckle on the analyzer plane, as shown in Fig. 2(c). Compared to the typical peak height in Fig. 2(b) of 1000 times the background, the loss of intensity in the center of Fig. 2(c) is dramatic. We spatially filter the field in the analyzer plane with a pinhole and image it onto a photon-counting detector. In Fig. 3(a) we show the typical photodetector signal for the correct response and for an incorrect response provided by the true and a false key, respectively. Only with the true key are multiple photodetections seen. After repeating the measurement 2000 times, Fig. 3(b) shows the histogram of the number of photodetections for the true key, resembling a Poissonian distribution with a mean of 4.3. Figure 3(b) also shows the average histogram of photodetections when 5000 random challenges are sent to the key, with the key and SLM2 kept unchanged. This experiment gives an upper bound on the photodetections in case of an attack with a random key. This histogram resembles a Poissonian distribution with a mean of 0.016 photodetections. We can clearly discriminate between true and false keys.
Fig. 2. Quantum-secure optical readout of a physical key. (a) Setup: a spatial light modulator (SLM1) creates the challenge by phase shaping a few-photon wavefront. In the experiment a 50×5050×50 binary phase pattern is used with 0 and ππ phase delays. The challenge is sent to the ZnO key (scale bar is 4 μm) by a microscope objective (not shown). The response is coupled out by a polarizing beam splitter (PBS). The response is transformed back by SLM2 and then focused onto the analyzer plane. (b) Only if the key is the true unique key, the response has a bright spot in the center, holding ≈60% of the power in the image and allowing that fraction to pass a pinhole and land on a detector where photodetection clicks authenticate the key. (c) In case of a false key, the response in the analyzer plane is a random speckle pattern.
Fig. 3. Quantum-secure readout of an unclonable physical key (PUF), using challenge pulses with 230±40 photons230±40 photons distributed over 1100±2001100±200 modes. (a) Real-time examples for the true key (blue line) and a false key (red line, offset for clarity). (b) Measured number of photodetections in cases of the true key, a random key (imitated by sending random challenges to the same key), and for an optimal attack given 𝑆=4S=4. The threshold is chosen such that the false positive and negative probabilities are approximately equally small assuming an optimal attack. (c) Acceptance and rejection probabilities in cases of the true key, a random key, and an optimal digital emulation attack. (d) Number of photodetections extrapolated to 10 repetitions; the false positive and false negative probabilities quickly decrease to order 0.01%.
To characterize the achievable security for one repetition of our readout, we introduce the quantum security parameter S,
(1)𝑆≡𝐾/𝑛,S≡K/n,
as the ratio of the number of controlled modes 𝐾K and the average number of photons 𝑛n in the challenge. The parameter 𝐾K quantifies the dimensionality of the challenge space and is equal to the number of independent response wavefronts that are obtained by sending in different challenge wavefronts. It is well approximated by the number of speckles on the key illuminated by the challenge [17]. In our experiment we have 𝐾=1100±200K=1100±200 and 𝑛=230±40n=230±40, yielding 𝑆=5±1S=5±1. Because a measurement of a photon can extract only a limited amount of information, a large 𝑆S implies that the adversary can obtain only a small fraction of the information required to characterize the challenge. Therefore, he cannot determine the correct response.
For quantum state estimation attacks based on various classes of measurements, it has been shown [18–20] that the adversary cannot achieve a fidelity better than approximately
(2)𝐹=𝐹OK/(𝑆+1),F=FOK/(S+1),
where 𝐹F is the fraction of photons detected by the verifier’s hardware in case of an attack and 𝐹OKFOK is the fraction of photons detected when the response is correct.
(The attack classes covered in the existing proofs are very broad and include, e.g., field quadrature measurements, which are believed to optimally extract information from coherent states.) The result of Eq. (2) holds for 𝑆>1S>1 and 𝐾≫1K≫1 and is in line with the intuition that a measurement of 𝑛n photons can provide information only about 𝑛n modes. Operating the readout in the regime 𝑆>1S>1 therefore gives the verifier an eminent security advantage, which has its origin in the quantum character of light.
In the verification we aim to discriminate a correct key from an optimal attack. Given a conservative lower bound of 𝑆=4S=4, the number of photodetections on the single-photon detector in a single readout in case of an optimal (digital emulation) attack follows a Poissonian distribution with mean 0.86, as shown in Fig. 3(b). We assume that the attacker returns within the statistical error the correct total number of photons, which can be ensured by counting the photons that miss the pinhole. Choosing a threshold of three or more photodetections for accepting the key, we find that the measured false reject ratio is 9%. In the case of random challenges the false accept ratio is 1.7×10−4%1.7×10−4% and the theoretical maximum false accept probability in the case of the digital emulation attack [Eq. (2)] is 6% [Fig. 3(c)]. The security improves exponentially by repeating the verification, every time choosing a different challenge and its corresponding SLM2 setting from the database. The individual photon counts are added, and a combined threshold is set. As illustrated in Fig. 3(d), after 10 repetitions the false accept and false reject probabilities are of order 10−410−4. As detailed in Supplement 1, after 20 repetitions they are both of order 10−910−9. Thus, the false decision rates can be made negligible in a small number of repetitions.
In our implementation, the time for readout is limited to about 100 ms by the switching time of the SLM. Using faster micromirror-based SLMs [21,22], the complete authentication protocol with 20 repetitions can be performed in less than a millisecond. The one-time enrollment of the key then takes of the order of a second. QSA does not require any secret information and is, therefore, invulnerable to adversaries characterizing the properties of the key (“skimming”). Hence, QSA provides a practical way of realizing unprecedentedly secure authentication of IDs, credit cards, biometrics [23], and communication partners in quantum cryptography.
FUNDING INFORMATION
European Research Council (ERC) (279248); Stichting voor Fundamenteel Onderzoek der Materie (FOM); Nederlandse Organisatie voor Wetenschappelijk Onderzoek (NWO) (Vici); Technologiestichting STW. ACKNOWLEDGMENT We thank J. Bertolotti, K.-J. Boller, G. Giedke, J. L. Herek, S. R. Huisman, T. J. Huisman, B. Jacobs, A. Lagendijk, G. Rempe, and W. L. Vos for support and discussions. See Supplement 1 for supporting content. REFERENCES 1. R. Pappu, B. Recht, J. Taylor, and N. Gershenfeld, Science 297, 2026 (2002). [CrossRef] 2. J. D. R. Buchanan, R. P. Cowburn, A. Jausovec, D. Petit, P. Seem, G. Xiong, D. Atkinson, K. Fenton, D. A. Allwood, and M. T. Bryan, Nature 436, 475 (2005). [CrossRef] 3. C. H. Bennett, G. Brassard, S. Breidbard, and S. Wiesner, in Advances in Cryptology: Proceedings of CRYPTO (Plenum, 1982), pp. 267–275. 4. C. H. Bennett and G. Brassard, in International Conference on Computers, Systems, and Signal Processing (IEEE, 1984), pp. 175–179. 5. B. Škorić, Int. J. Quantum. Inform. 10, 1250001 (2012). 6. V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, Rev. Mod. Phys. 81, 1301 (2009). [CrossRef] 7. B. Škorić, P. Tuyls, and W. Ophey, in Applied Cryptography and Network Security (ACNS), Vol. 3531 of Lecture Notes in Computer Science (Springer, 2005), pp. 407–422. 8. P. Tuyls, B. Škorić, S. Stallinga, A. H. M. Akkermans, and W. Ophey, in 9th Conference on Financial Cryptography and Data Security, A. S. Patrick and M. Yung, eds., Vol. 3570 of Lecture Notes in Computer Science (Springer, 2005), pp. 141–155. 9. S. P. Walborn, D. S. Lemelle, M. P. Almeida, and P. H. S. Ribeiro, Phys. Rev. Lett. 96, 090501 (2006). [CrossRef] 10. V. D. Salakhutdinov, E. R. Eliel, and W. Löffler, Phys. Rev. Lett. 108, 173604 (2012). [CrossRef] 11. S. Etcheverry, G. Cañas, E. S. Gómez, W. A. T. Nogueira, C. Saavedra, G. B. Xavier, and G. Lima, Sci. Rep. 3, 2316 (2013). [CrossRef] 12. W. K. Wootters and W. H. Zurek, Nature 299, 802 (1982). [CrossRef] 13. A. Peruzzo, M. Lobino, J. C. F. Matthews, N. Matsuda, A. Politi, K. Poulios, X.-Q. Zhou, Y. Lahini, N. Ismail, K. Wörhoff, Y. Bromberg, Y. Silberberg, M. G. Thompson, and J. L. O’Brien, Science 329, 1500 (2010). [CrossRef] 14. L.-A. Wu, H. J. Kimble, J. L. Hall, and H. Wu, Phys. Rev. Lett. 57, 2520 (1986). [CrossRef] 15. D. Bouwmeester, A. Ekert, and A. Zeilinger, The Physics of Quantum Information (Springer, 2000). 16. P. W. H. Pinkse, T. Fischer, P. Maunz, and G. Rempe, Nature 404, 365 (2000). [CrossRef] 17. J. F. de Boer, M. C. W. van Rossum, M. P. van Albada, T. M. Nieuwenhuizen, and A. Lagendijk, Phys. Rev. Lett. 73, 2567 (1994). [CrossRef] 18. B. Škorić, A. P. Mosk, and P. W. H. Pinkse, Int. J. Quantum. Inform. 11, 1350041 (2013). 19. D. Bruß and C. Macchiavello, Phys. Lett. A 253, 249 (1999). [CrossRef] 20. B. Škorić, “Security analysis of quantum-readout PUFs in the case of challenge-estimation attacks” (2013), http://eprint.iacr.org/2013/479. 21. D. Akbulut, T. J. Huisman, E. G. van Putten, W. L. Vos, and A. P. Mosk, Opt. Express 19, 4017 (2011). [CrossRef] 22. D. B. Conkey, A. M. Caravaca-Aguirre, and R. Piestun, Opt. Express 20, 1733 (2012). [CrossRef] 23. I. M. Vellekoop and A. P. Mosk, Opt. Lett. 32, 2309 (2007). [CrossRef]
Comentarios