{'fraction_non_alphanumeric': 0.05459900317172633, 'fraction_numerical': 0.012573629361123698, 'mean_word_length': 4.308779314491882, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A Quantum-Classical Scheme towards Quantum Functional Encryption

Quantum encryption is a well studied problem for both classical and quantum information. However, little is known about quantum encryption schemes which enable the user, under different keys, to learn different functions of the plaintext, given the ciphertext. In this paper, we give a novel one-bit secret-key quantum encryption scheme, a classical extension of which allows different key holders to learn different length subsequences of the plaintext from the ciphertext. We prove our quantum-classical scheme secure under the notions of quantum semantic security, quantum entropic indistinguishability, and recent security definitions from the field of functional encryption.


Introduction
In a pioneering work, Boneh, Sahai and Waters formalized the notion of functional encryption in 2010 [3]. This generalization of an encryption scheme enabled users possessing different keys to learn different functions over the plaintext from the ciphertext. There have been many (classical) schemes proposed to realize different variants of functional encryption since the inception of the notion. However, despite it's power, there have been no equivalent formalizations of functional encryption for quantum information.
Over the last few years, formal definitions of quantum entropic security [1] and quantum computational security [2] have been introduced and accepted. Moreover, for classical functional encryption schemes, refined security definitions [4] have been recently presented, which extend the notion of security given in the original paper [3]. In this work, we first present a one-qubit secret-key quantum encryption scheme for classical information. The scheme is proven secure under quantum semantic security (Definition 8, [2]) and quantum entropic indistinguishability (Definition 3, [1]). The classical, functional extension of this scheme is then proven to be full-message private, full-function private (Definitions 2.4,3.2 [4]) and weakly simulation-secure (Definition 5, [3]). Intuitively, the security of the quantum encryption scheme and it's extension are based upon distinguishing computationally between two different but uniformly distributed bits, which is a hard problem. Also the functional extension allows the user to learn different length subsequences of the message, with a different subsequence per instantiation of the scheme. This paper is organized as follows. First, we present the syntax -the notations and definitions used to present our scheme, in the preliminaries section. The third section of the paper gives the construction and correctness arguments for our scheme. The proofs of security are given in the following section. We then give the operational aspects of the scheme in the discussion section. To catalogue other works in quantum encryption, we give next a section on related work. In the final section, we present our conclusions and future extensions possible for this work.

Preliminaries
In this section, we define the syntax and the definitions used for presenting our cryptosystem and establishing it's correctness and security.

Notation
Let λ be the security parameter. Let poly(λ), exp(λ), negl(λ), non-negl(λ) denote the set of all polynomial, exponential, negligible, and non-negligible functions on λ respectively. We will sometimes abuse notation and place these function classes in place of functions that belong to these classes. Let {|0 , |1 } be the computational basis for our QPT algorithms. For both our QPT and PPT algorithms, we will use A O to denote that A has oracle access to O. We will use U(V ) to denote uniform distribution on universe V .

Correctness Definitions
We begin by defining the functionality to be realized and the structure of our scheme. These definitions are inspired from [3], but modified appropriately. This scheme must satisfy the following correctness condition given A, ∀k ∈ K, ∀m ∈ M : It is mandated that msk contains a, and n = F a (k, m) with probability 1.
Note that that hardwiring of the master-secret allows only oracle access to KeyGen and Enc . This allows any user to encrypt any message m via an oracle call to get the quantum cipher-text. However in our proofs of security the adversary has only oracle access to KeyGen and Enc . Thus the above definition is limited but sound.

Security Definitions
We give definitions for quantum IND-secure encryptions, and quantum entropic indistinguishability first. Note that they are reproduced from their original sources.
where ρ ME ← M(1 λ ), ρ E = Tr M (ρ ME ) and the probabilities are taken over the internal randomness of QE, M, D.
We next give security definitions for classical functional ciphers adopted from [4] in the context of our quantum-classical scheme. Note that superscripts are not exponentiations but indexes. Also ∀b, Enc msk,b (m 0 , m 1 ) = Enc msk (m b ),

Definition 8 (Full Function Privacy, Definition 3.2, [4]). A private-key functional encryption scheme (Setup, KeyGen, Enc, Dec) is fully message private if for any valid function-privacy adversary
Finally we give a scheme security definition from the seminal work [3]. This has been updated to make the functionality index a part of the comparison (so that we are comparing the same function).

Definition 9 (Weak Simulation Security, Definition 5, [3]). A functional encryption scheme (Setup, KeyGen, Enc, Dec) is weakly simulation-secure if for all polynomial-time algorithms (Msg,Adv) there exists a polynomial-time algorithm
Sim such that the distribution ensembles given in Algorithm 1 are computationally indistinguishable.

The One-Qubit Quantum Cryptosystem
We introduce our novel single qubit secret-key quantum cipher Ξ in Algorithm 2. Note that the secret key is given by the enclosing hFE cipher. The scheme is proven correct in Theorem 1 under the appropriate unitary map.

Algorithm 2
The Scheme Ξ = (QE, QD), given the secret-key bit s, Blochsphere equatorial-position θ, message-bit b Prepare |s from s and |b from b.
with probability 1, as we obtain the inverting map of H θ r |b after recovering r. Note that encrypting the randomness under the secret is equivalent to encrypting the secret under the randomness -a unique property of the unitary map H θ u .

The hFE Scheme
Our message (plaintext) length |m| will be greater that or equal to the security parameter. Furthermore, |m| = Q ∈ poly(λ). We will use Σ = {σ : Our scheme is given in Algorithm 3. We will also use the following nomenclature for our correctness and security proofs.
Definition 10. We say that an arbitrary key k = κ q if there exists (exactly one) Intuitively, κ q reveals the first q-bits of the message, and there is exactly one such κ q .
Correctness and Positional Secrecy Given for a message m, a particular user has key κ q , Dec QD (KeyGen a (κ q ), Enc QE a (m)) = Dec QD (s 1 s 2 ...s q , (QE sj ,θj (m j )) j∈[Q] ) = m 1 m 2 ...m q with probability 1. The different positions of the cipher-qubit on the Bloch sphere equator allow recovery of different subsequences of the message, a notion we call positional secrecy. More formally, let η : {0, 1} Q → {0, 1} Q be a permutation that is predecided, or optionally is the output of Setup . Then we use QE to encrypt m η(j) under s j , θ j . This results in key κ q recovering the q-subsequence induced by η (rearranging the message bits so that the indices are in order): (2) ...m η(q) with probability 1.

Scheme Security
We will use the following corollary for our security proofs in this section.

Security of the Quantum Encryption Scheme
We first note that (before prepending with the randomness) |QE s,θ (b)| = 2|b| and so the core-function based impossibility result (Definition 6.1,6.2 Theorem 6.3, [5]) does not apply to Ξ.
Theorem 2 (Semantic Security). The one-qubit secret-key encryption scheme Ξ is quantum semantically secure.
Proof. First, we prove that Ξ = (QE, QD) is IND-secure under Definition 3. Let's say there exists a QPT distinguisher qD that can distinguish between QE s,θ (|b ) and QE s,θ (|0 ) in time poly(λ) with a probability non-negl(λ). Consider the following attack where cD is a distinguisher between r ⊕ 0 and r ⊕ b, given s, θ and a uniformly random r: 1. The message adversary chooses b.

Sample r ⇐ U({0, 1}).
3. Prepare H θ r⊕s |0 and send it to qD as it's first argument. 4. Choose a challenge c * uniformly between r ⊕ 0 and r ⊕ b and send it to cD. 5. cD prepares H θ c * |0 and sends it to qD as it's second argument. 6. qD now has one of the encryptions between QE s,θ (|0 ) and QE s,θ (|b ). 7. qD distinguishes between the two possible encryptions and sends it's decision, 0 or b, to cD (in time poly(λ) with a probability non-negl(λ)). 8. cD, for the challenge c * outputs it's decision (0 or b), the same as the result given by qD.
Thus we have constructed a computational distinguisher cD between two statistically identical distributions r ⊕ 0 and r ⊕ b, even for a b different than 0, a contradiction. So qD cannot exist (step 7 cannot happen) and Ξ is IND-secure. We next use Theorem 9 from [2] to conclude that Ξ is quantum semantic secure.
Proof. Here we prove entropic-indistinguishability (Definition 4) of the message qubit under Ξ. Since the secret qubit comes from the uniform distribution, it is perfectly indistinguishable (under the same superoperator) and it's security proof is thus implied. Let ρ = j∈{0,1} γ j |j j| be the operator corresponding to the message qubit. The only associated interpretations of ρ are classical, according to our scheme. Let E be the superoperator corresponding to our unitary map. So E(ρ) := H θ r ρ(H θ r ) † for uniformly random r and the message space distribution has minentropy t = − log(max{γ 0 , γ 1 }) ∈ [0, 1]. Firstly, it's an easy verification that

Security of the hFE scheme
Now we prove security of the classical extension of our quantum encryption using the definitions of privacy/security from the domain of classical functional encryption.

Theorem 4 (Fully Message Private). The hFE scheme (Π, Ξ) is fully message private (under Definition 6).
Proof. We start by observing that since the QPT adversary A is a valid messageprivacy adversary (Definition 5), the messages m 0 and m 1 agree on all bits [q] such that A queries κ q . Let q * = max{q : A queries κ q }. Then ∃j * ∈ {q * + 1, ..., Q} such that m 0 j * = 1 − m 1 j * , otherwise the two encryption oracle calls are identical. Now, let's say A can distinguish between Enc a,0 (m 0 , m 1 ) and Enc a,1 (m 0 , m 1 ) in time poly(λ)with a probability non-negl(λ). Let cD j , ∀j ∈ [Q] be distinguishers on a bit. Let s ∈ {0, 1} Q be the given secret and θ j = 2πj Q , ∀j ∈ [Q] be the given encryption angles. Now consider the following attack for a uniformly random r ∈ {0, 1} Q : 1. The adversary chooses messages m 0 , m 1 . 2. Sample r ⇐ U({0, 1} Q ). 3. Prepare ∀j, H θj rj ⊕sj |0 and send them to A in order as it's odd-position arguments. 4. Choose a challenge bit b uniformly between 0 and 1. 5. Send challenge ∀j, u j = r j ⊕ m b j to cD j . 6. Each cD j prepares H θj uj |0 and sends it (in order) to A as it's even-position arguments. 7. A now has the encryption Enc a (m b ). 8. A outputs b ′ = b sends it to cD j , ∀j (in time poly(λ) with a probability non-negl(λ)). 9. cD j , for the challenge u j outputs it's decision b ′ .
Thus we have constructed a computational distinguisher cD j * between two statistically identical distributions r⊕m b j * and r⊕m 1−b j * where m b j * = 1−m 1−b j * . This is a contradiction. So, A cannot exist (step 8 cannot happen with a non-negligible probability) and (Π, Ξ) is fully message private.
Proof (Sketch). Intuitively, we will show that the output distributions of the adversary and simulator are statistically identical (i.e., having zero statistical distance). By virtue of the game, other distributions are same and proving the α's identical is sufficient to prove the real and ideal distribution tuples are statistically identical. First, let us define the following (deterministic) function: S a (k) := If k = κ q for some q ∈ [Q], return the first q-bits of σ(κ Q ). Otherwise return ⊥. And let α = (α 1 , α 2 , ..., α l ) corresponding to key query distributions (y j ) j∈ [l] . The first thing to note is that the α j 's are distributions on m 1 m 2 ...m q for q ∈ {0} ∪ [Q], and these distributions are a deterministic map, say φ, from S a (y j ). To see this in the real world game, first observe that since the quantum cipher-text is IND-secure, it does not leak any information about the message to Adv, and so α real j = φ(KeyGen a (y j )) = φ(S a (y j )). In the ideal world game, firstly, F a (ℵ, m) = zQ for some integer z, leaking nothing additional about the chosen message vector. Also, from the view of comparing the distribution vectors, and since the m distributions are identical by definition, the queries of Sim to F a (y j , m) can be reduced to a function of a and y j alone. That function is exactly α ideal j = φ(S a (y j )) since only one key κ q maps to one m 1 m 2 ...m q , q ∈ [Q] and all other keys map to the null message. Now let's say there is a non-zero statistical distance ∆ between α real j and α ideal

Discussion
We see that the scheme (Π, Ξ) permits an arbitrary, polynomial-sized stretch in the length of the message, given the security parameter. This is realizable due to the infinitely many cipher positions permissible on the Bloch-sphere equator. Note that this is not possible classically. Also, there needs to be consideration on efficient representations of arbitrary injective functions from λ-bits to Q-bits, which in general have exponential size tables. Note that for the purpose of our scheme (where [[x]] denotes an efficient representation of x), [[a]] := (σ(κ Q ), κ 1 , κ 2 , ..., κ Q ) should suffice (see Definition 10). Finally, it's important to observe that the keys k should be distributed only after instantiating a, that is, running Setup. This is true because under different σ's, the same key k does not necessarily give the same decryption.

Related Work
Over the past twenty years, there has been a lot of work done on quantum ciphers. Most of them encrypt pure quantum states as opposed to classical information. Beginning with private quantum channels [9] whose optimality was proved later [10], quantum vernam ciphers were developed [20]. An optimal scheme based on quantum one-time pads [11] was proposed, later followed by characterisation of a one-way quantum encryption scheme [29] more general than private quantum channels. Initially, Zhou proposed an algorithm to encrypt binary classical information [28]. Zhou then proposed qubit block encryption algorithms [40,39] which were later improved [12] to base their security on the BB84 protocol. Other than these, there have been parallel works on symmetric-key schemes [26,14], a dlevel systems' scheme [15], and schemes based on modified BB84 [18], quantum key generation [7], conjugate coding [21], and quantum shift registers / hill cipher [19]. Quantum public-key encryption (QPKE) schemes have been addressed by the community since the beginning of this century [31]. There have been QPKE schemes with information theoretic security proposed by Pan [32] and Liang [25,24]. Also, there have been QPKE schemes based on single qubit rotations [30,33] and classical NP-complete problems [36]. More recently, quantum (fully) homomorphic encryption (Q(F)HE) schemes have been developed by the community. Liang proposed a perfectly secure QFHE scheme based on the quantum one-time pad [22]. This was followed by a QFHE scheme based on the universal quantum circuit [23]. Also, there has been a QHE scheme for polynomial sized circuits given by Dulek [13]. Very early, a KCQ (keyed communication in quantum noise) approach to cryptography [37] was presented. Other works in the space of conventional quantum encryption include studies on optimality of quantum encryption schemes [27], the use of quantum keys as opposed to classical keys [17], and non-malleable ciphers [8]. Quantum secure direct communication [34] and quantum key distribution [38] via quantum encryption have also been proposed. Finally, other notions of security [35,16] have been professed.

Conclusions and Future Work
In this work, we have introduced a novel one-qubit secret-key quantum encryption scheme for classical information. We have proved this scheme to have quantum semantic security, and quantum entropic indistinguishability as a function of the min-entropy of the message distribution. We have extended this scheme to permit recovery of different length subsequences of the message using different keys, under a new notion of positional secrecy. The resulting (hybrid) functional encryption scheme is proven to be full-message private, full-function private and weakly simulation-secure. We hope to see the following improvements in the future, given the current status of our quantum-classical scheme: 1. Given that, under Ξ, encryptions of both 0 and 1 are statistically indistinguishable, perhaps there exists a proof of entropic security (Definition 2, [1]) for the quantum scheme. 2. We recognize that the biggest drawback of the classical extension is that KeyGen and Enc algorithms are only available via oracle calls, although that does not affect the security proofs. There could be a modification which permits making these algorithms public. 3. We hope that this work motivates a new general definition for quantum functional encryption -fully quantum schemes which permit learning meaningful functions from encryptions of (general) quantum states.