<p>One can encrypt an n-qubit state using a 2n-bit classical secret key. The idea is to use the key to select a random Pauli operator, and apply that operator to the secret as an encryption. (The inverse operator is applied to decrypt.)</p>

<p>The resulting scheme is perfectly secure -- if the key is selected uniformly at random, then even an attacker who know a state entangled with the plaintext cannot distinguish the true ciphertext from an independent random state. </p>

<p>This observation was first made in
A Ambainis, M Mosca, A Tapp, R de Wolf. "Private quantum channels", FOCS 2000.</p>

<p>They also showed that 2n bits of key are necessary for encryption of entangled quantum states. </p>

<p>If you have a classical PRG secure against quantum distinguishers, then you can get away with a much shorter key (as short as seed length required by the generator to generate 2 n output bits). </p>

CC BY-SA 3.0
2016-04-10T02:11:20.167Z
Is this analogous to a one-time pad?
Demi
CC BY-SA 3.0
2016-04-10T02:42:22.907Z
Yes, it is in fact called a quantum one-time pad. In the quantum case, you have to be a bit careful in how you define the security requirement for computational or statistical notions of secrecy. But for perfect secrecy, it is fairly straightforward: for every input state, the density matrix of the ciphertext should be the same when you average over keys.
Adam Smith
CC BY-SA 3.0
2016-04-10T02:43:10.433Z
Ah okay.  So the version with a CSPRNG is a quantum stream cipher.
Demi
CC BY-SA 3.0
2016-04-10T02:06:26.220Z
2016-04-10T02:06:26.220Z
Adam Smith
<p>Is it possible to encrypt a quantum state, such that a $BQP$ attacker who does not know the secret key cannot obtain any information about the original state, but a $BQP$ decryptor with the key can recover the original state?</p>

<p>Assume (classical) one-way functions that are hard for quantum attackers to break exist (as is believed to be the case).</p>

<quantum-computing><cr.crypto-security><quantum-information>
Is it possible to encrypt quantum states under reasonable assumptions?
Demi
# Is it possible to encrypt quantum states under reasonable assumptions?

(Asked by: username_0 on 2016-04-09)

Is it possible to encrypt a quantum state, such that a $BQP$ attacker who does not know the secret key cannot obtain any information about the original state, but a $BQP$ decryptor with the key can recover the original state?

Assume (classical) one-way functions that are hard for quantum attackers to break exist (as is believed to be the case).

**Tags:** quantum-computing, cr.crypto-security, quantum-information

---

## 1 answers

### Answer by username_1 on 2016-04-10. Score: 7 | Accepted answer

One can encrypt an n-qubit state using a 2n-bit classical secret key. The idea is to use the key to select a random Pauli operator, and apply that operator to the secret as an encryption. (The inverse operator is applied to decrypt.)

The resulting scheme is perfectly secure -- if the key is selected uniformly at random, then even an attacker who know a state entangled with the plaintext cannot distinguish the true ciphertext from an independent random state.

This observation was first made in
A Ambainis, M Mosca, A Tapp, R de Wolf. "Private quantum channels", FOCS 2000.

They also showed that 2n bits of key are necessary for encryption of entangled quantum states.

If you have a classical PRG secure against quantum distinguishers, then you can get away with a much shorter key (as short as seed length required by the generator to generate 2 n output bits).

> **Comments:**
> **username_0**: Is this analogous to a one-time pad?  
> **username_1**: Yes, it is in fact called a quantum one-time pad. In the quantum case, you have to be a bit careful in how you define the security requirement for computational or statistical notions of secrecy. But for perfect secrecy, it is fairly straightforward: for every input state, the density matrix of the ciphertext should be the same when you average over keys.  
> **username_0**: Ah okay.  So the version with a CSPRNG is a quantum stream cipher.  

---

