Key Agreement and Oblivious Transfer
from Free-Energy Limitations

In the past decades, several attempts were made to achieve cryptographic security from physical properties of communication channels: Most prominently, of course, quantum cryptography [BB84, Eke91]; other systems made use of noise in communication channels [Wyn75] or bounds on the memory space accessible by an adversary [Mau92]. These schemes have in common that no limit is assumed on the opponent’s computational power: They are information-theoretically secure.

Our schemes for achieving confidentiality (key agreement or, more precisely, key expansion) as well as secure coöperation (multiparty computation, i.e., oblivious transfer) rely solely on a bound on the accessible free energy¹¹1Free energy is “free” in the sense that it can be used to do work — it is not “entrapped” in a system. of an adversary. More specifically, we propose schemes the security of which follows from Landauer’s principle, which is a quantification of the second law of thermodynamics: In a closed system, “entropy” does not decrease (roughly speaking).

Landauer’s principle states that the erasure of information unavoidably costs free energy, the amount of which is proportional to the length of the string to be erased. On the “positive” side, the converse of the principle states that the all-$0$ string of length $N$ has a free-energy value proportional to $N$. More precisely, the erasure cost and work value are both quantified by $k_{\rm B}{\rm T}\ln 2\cdot N$, where $k_{\rm B}$ is Boltzmann’s constant (in some sense the nexus between the micro- and macroscopic realms), and ${\rm T}$ is the absolute temperature of the environmental heat bath.

Our result can be seen as one episode in a series of results suggesting information-theoretic security to be, in principle, achievable under the assumption that at least one in a list of physical theories, such as quantum mechanics or special relativity, is accurate: We add to this list the second law of thermodynamics — to which not much glamour has been attached before.

We base the “free-energy-bounded model” of information-theoretic cryptography upon the observation that the second law of thermodynamics has a cryptographically useful corollary: “Copying information has a fundamental cost in free energy.” Bounding the free energy of an adversary forces them into picking parsimoniously what to copy, and that can be exploited in a reversible-computing context to ensure information-theoretic security. Our secret-key establishment protocol demonstrates how bounds in free energy can lead to cryptographic mechanisms similar to the ones used in quantum-key distribution and in the bounded-storage model, while our oblivious-transfer protocol exemplifies the novelty of our model.

This is an overview of our article: In Section 2, we review the subjects of information-theoretic cryptography and of reversible computing. In Section 3, we introduce, based on reversible computing, a novel model of computation and interaction that captures the consumption and the production of free energy in Turing machines. In Section 4, we establish some prerequisites: we prove a version of Landauer’s principle in our framework, and construct a game that is basically equivalent to a thermodynamical “almost-no-cloning theorem,” which we later use in our security proofs. In Sections 5 and 6, we offer protocols for secret-key establishment and oblivious transfer, respectively; their information-theoretical security is based fundamentally on Landauer’s principle. It is assured against adversaries whose bound in free energy is exponential compared to the one of the honest players. While the present work focuses on classical information, we sketch in Section 7 how all our results generalize in presence of quantum adversaries.

In parallel to the development of computationally secure cryptography — and somewhat in its shadow —, attempts were made to obtain in a provable fashion stronger, information-theoretic security, based not on the hardness of obtaining the (uniquely determined) message in question, but on the sheer lack of information. Hereby, the need for somehow “circumventing” Shannon’s pessimistic theorem of perfect secrecy is met by some sort of physical limitation. The latter can come in the form of simple noise in a communication channel, a limitation on accessible memory, the uncertainty principle of quantum theory, or the non-signalling postulate of special relativity.

The first system of the kind, radically improving on the perfectly secret yet impractical one-time pad, has been Aaron Wyner’s wiretap channel [Wyn75]: Here, information-theoretic secret-key establishment becomes possible — under the assumption, however, that the legitimate parties already start with an advantage, more specifically, that the adversary only has access to a non-trivially degraded version of the recipient’s pieces of information. A broadcast scenario was proposed by Csiszár and Körner [CK78] — where, again, an initial advantage in terms of information proximity or information quality was required by the legitimate partners versus the opponent. A breakthrough was marked by the work of Maurer [Mau93], who showed that the need for such an initial advantage on the information level can be replaced by interactivity of communication: Maurer, in addition, conceptually simplified and generalized the model by separating the noisily correlated data generation from public yet authenticated communication, the latter being considered to be for free. The model shares its communication setting with both public-key as well as quantum cryptography. Maurer and Wolf [MW96] have shown that in the case of independent-channel access to a binary source, key agreement is in fact possible in principle in all non-trivial cases, i.e., even when Eve starts with a massive initial advantage in information quality.

In the same model, it has also been shown that multiparty computation becomes possible, namely bit commitment and (the universal primitive of) oblivious transfer [CK88, Cré97]. More generally, oblivious transfer has also been achieved from unfair noisy channels, where the error behaviour is prone to be influenced in one way or another by the involved, distrusting parties willing to coöperate.

The public-randomizer model by Maurer [Mau92] has generally been recognized as the birth of the idea of “memory-bounded models,” based on the fact that the memory an opponent or cheater (depending on the context) can access is limited. Specifically, Maurer assumes the wire-tapper can obtain a certain fraction of the physical bits. This was generalized to arbitrary types of information by Dziembowski and Maurer [DM02]. Analogously, also oblivious transfer has been shown achievable with a memory-bounded receiver [CCM98, DHRS04]. The main limitation to the memory-bounded model, for both secret-key establishment and multiparty computation, is that the memory advantage of the honest participants over the adversaries is at most quadratic [DM04].

The idea to use quantum physics for cryptographic ends dates back to Wiesner, who, for instance, proposed to use the uncertainty principle to realize unforgeable banknotes. His “conjugate coding” [Wie83] resembles oblivious transfer; the latter — even bit commitment, actually — we know now to be unachievable from quantum physics only [May97, LC98]. A breakthrough has been the now famous “BB84” protocol for key agreement by communication through a channel allowing for transmitting quantum bits, such as an optic fibre, plus a public yet authenticated classical channel [BB84].

A combination of the ideas described is the “bounded quantum-storage model” [DFSS08]: Whereas no quantum memory is needed at all for the honest players, a successful adversary can be shown to need more than $n/2$ of the communicated quantum bits. The framework has been unified and generalized to the “noisy” model by König, Wehner, and Wullschleger [KWW12].

Very influential has been a proof-of-principle result by Barrett, Hardy, and Kent [BHK05]: The security in key agreement that stems from witnessing quantum correlations can be established regardless of the validity of quantum theory, only from the postulate of special relativity that there is no superluminal signalling. The authors combined Ekert’s [Eke91] idea to obtain secrecy from proximity to a pure state, guaranteed by close-to-maximal violation of a “Bell inequality,” with the role this same “nonlocality” plays in the argument that the outcomes of quantum measurements are, in fact, random and not predetermined: In the end, reasoning results that are totally independent of the completeness of quantum theory. Later, efficient realizations of the paradigm were presented [HRW, MPA11]. Conceptually, an interesting resulting statement is that information-theoretic key agreement is possible if either quantum mechanics OR relativity theory are complete and accurate “descriptions of nature.” Another point of interest is that trust in the manufacturer is not even required: “device independence” [VV14].

Kent also demonstrated that bit commitment can be information-theoretically secure thanks to special relativity alone [Ken99]. On the other hand, oblivious transfer cannot be information-theoretically secure even when combining (without further assumptions) the laws of quantum mechanics and special relativity [Col07].

The fundamental laws of physics are logically reversible. We hence base our formal notion of player (or adversary) on reversible Turing machines.

The free-energy tape of a TTM imitates a “reservoir” of free energy:

For example, if a machine always manages to return the free-energy tape as blank as it was — it uses no free energy and computes both logically and thermodynamically reversibly; if a machine writes, and leaves, some information on the first $n$ cells of the initially blank free-energy tape, we say it consumes an amount $w_{\rm in}=n$ of free-energy. (In this work we have set $k_{\rm B}{\rm T}\ln 2\coloneqq 1$.)

Our security proofs will rely on a concept we name proof-of-work.

We consider agents (TTMs) with bounds, in the security parameter $\nu$, on the free-energy input.

In other words, every time a $f(\nu)$-BFE agent reaches a halting state, the non-blank portion of its free-energy tape ends at a distance at most $f(\nu)$ from the extremity, by definition.

In our protocols, the honest players are asymptotically $\mathcal{O}(\nu)$-BFE, while the adversary is assumed exactly $2^{\nu}$-BFE. An important limitation of $f(\nu)$-BFE agents is given by the following theorem, to which the security of our protocols will be reduced.

The theorem is a consequence of the logical-reversibility characteristic imposed by the second law of thermodynamics. The proof is done in Section 4.2, based on Definitions 1 and 4 (i.e., with no further references to thermodynamics).

Our cryptographic model can be formalized further by integrating BFE parties into a multi-round interactive protocol that uses reversible computing, however, let us focus on how Alice and Bob can exchange information. There are of two distinct resources:

• •

  Standard communication for messages of length $\mathcal{O}(\nu)$.

• •

  Reversible transfer for longer messages, up to length $\mathcal{O}(2^{\nu})$.

Most of our formal propositions rely on the variational distance.

It is the optimal probability of correctly guessing $X$ given side information $Y$.

Smoothing entropies [RW04, RW05] is done to ignore events that are typically unlikely. We will typically use smoothing with a parameter $\epsilon={\bf negl}(\nu)$. We denote by ${\bf negl}(\nu)$ the functions that are negligible in $\nu$, meaning asymptotically bounded from above by the inverse of every function that is polynomial in $\nu$.

Smooth conditional min-entropy is used mainly for privacy amplification.

We define and prove formally a version of Landauer’s principle (Theorem 3.1), which is the claim in Section 3 that BFE players modelled as thermodynamical Turing machines cannot produce more free energy than they consume, except with exponentially vanishing probability. The theorem follows from the logical reversibility of a TTM — the existence of a thermodynamically free logically irreversible physical process would be a violation of the second law of thermodynamics. We introduce some algorithmic-information-theory notation along the way; a more exhaustive introduction is the excellent book by Li and Vitányi [LV⁺08].

$\{p,x,y\}$ are, respectively, the representation of the instruction, memory, and (blank) free-energy tapes, at the beginning of the computation.

We start with the simpler case of assuming that all of these tapes are finite (but arbitrarily long), and then generalize our analysis to the infinite case.

We detail here in a game format a reduction that we later use in our security proofs. Our memory games involve an adversary against a verifier. The adversary sends, using a reversible channel SWAP, an exponentially long string to the verifier, but is also asked to try to keep a copy of it; the verifier then interrogates the adversary about either all of that string (in the exhaustive variant), or about a random linear-size subset of it (in the sampled variant); we show that the adversary has limited advantage in guessing as compared to a trivial strategy, unless they made an accurate copy of the whole string of exponential length — a process that requires, in light of Landauer’s principle, an exponential amount of either luck or free energy. We formalize this intuition, starting with the non-sampled version of the game.

The constraint also holds if the adversary is quizzed only on a random subset of positions.

Universal hashing is useful for both privacy amplification and authentication.

In what follows, the variables $(A,B)\in(\mathcal{A},\mathcal{B})$ are strings from registers of length roughly $\mathcal{O}(\nu\log\nu)$, while $(X,Y)\in(\mathcal{X},\mathcal{Y})$ denote strings from registers of length $\mathcal{O}(2^{\nu})$.

Soundness is analyzed in Section 5.3, and security in Section 5.4.

$h_{b}(p)\coloneqq-p\log_{2}p-(1-p)\log_{2}(1-p)$ is the binary entropy.

Note that for any fixed $p_{\rm error}$ (as long as it is not trivially $1/2$), Alice and Bob can choose a security parameter $k$ for which the protocol will be secure for that value of $p_{\rm error}$. That is unlike, for example, the BB84 quantum-key-distribution protocol, which only tolerates error rates less than $1/4$ (any more and Eve can intercept the whole quantum state).

If the protocol does not abort, Eve has negligible information about the key $K_{B}$ at the end. This security resides on the fact that even if Eve intercepts $X$ (which was sent from Alice to Bob) and replaces it with $Y$, she cannot keep roughly more than a fraction $1/k$ of the information about $Y$. Thus, since the key is based on $Y$, Eve has limited knowledge about it.

Formally, this can be analyzed with the sampled $k\cdot 2^{\nu}\choose s$ memory game in Section 4.3. Theorem 4.2 thereat guarantees a good starting point — Eve (who is $2^{\nu}$-BFE) must have limited information about Bob’s raw key of length $s$:

The next step is to go from low information to essentially no information.

$E_{B}$ denotes all of (a potentially malicious) Bob’s side information. And similarly for $E_{A}$ in regards to Alice.

An OT protocol is information-theoretically secure when it is information-theoretically secure for both Alice and Bob.

The perfect soundness is straightforward. Security is analyzed in Section 6.3.

Our model described in Section 3 is based on Alice, Bob, and Eve being classical computers with thermodynamical restrictions (we call them Thermodynamical Turing Machines) interacting through classical channels (a standard authenticated channel and a SWAP channel).

In a quantum setting, Alice, Bob, and Eve are upgraded to universal quantum computers [Deu85] and their communication channels can carry states in quantum superposition. A quantum computer cannot compute more than a classical computer could (given exponential computational time, a classical computer can simulate a quantum computer). Quantum computing cannot either be used to evade Landauer’s principle [FDOR15]. As such, once all elements are properly defined, a quantum version of our Theorem 3.1 holds.

The ability to send and receive quantum states does enable new possibilities for both honest and malicious agents — we investigate next how this affects the security of our previous SKE and OT protocols.

We extend the proof method developed in Section 4.3 to the quantum world.

First, the bound on the success of an adversary at the exhaustive $k\cdot 2^{\nu}\choose k\cdot 2^{\nu}$ memory game (Proposition 3) is unaffected by the transition from classical to quantum information.

The next step is to sample from $X$ (Theorem 4.2).

The information-theoretical security of the SKE protocol from Section 5 depends uniquely on the one of privacy amplification and on Theorem 4.2.

Since in presence of quantum side information, universal-2 hashing (Lemma 2) remains a universally composably secure way of achieving privacy amplification  [RK05, TSSR11], and that, as we just argued, so is the case of Theorem 4.2, the SKE scheme presented in Section 5.2 is secure against quantum adversaries.

Fundamentally different from standard quantum key distribution, the result is nevertheless an information-theoretically secure key distribution scheme for a quantum world in which entropy is exponentially cheaper than free energy.

Given that the above SKE protocol is quantum-resistant, and that the same argument applies to the security-for-Alice part of our oblivious-transfer protocol, it would be natural for our previously detailed scheme to be also quantum-resistant. But it is not: The security-for-Bob, which is trivial in the classical case (because $x+y=y+x$, see Fig. 2), can be broken by a malicious quantum Alice. The reason is that if Alice acts maliciously and sends the superposed quantum states $X^{(0)}=H\ket{x}$ and $Y^{(0)}=\ket{y}$ to Bob (for some random $x$ and $y$), she can discriminate between the state sent back by Bob when he does $H\ket{x}\overset{\rm CNOT}{\longrightarrow}\ket{y}$ (to keep $X^{(0)}$) compared to when he does $\ket{y}\overset{\rm CNOT}{\longrightarrow}H\ket{x}$ (to keep $Y^{(0)}$). This attack is illustrated in Fig. 3.

But there is a simple patch for this attack, or, in fact, for all quantum attacks by a malicious Alice. Alice’s extra power comes from the fact she can send states in superposition, but Bob can in return preëmptively “classicize” the possibly quantum states ${X^{(0)}}$ and ${X^{(1)}}$ by CNOT-ing each bit to a different bit of the totally mixed environments $\pi_{0}$ and $\pi_{1}$. Given control of a large enough environment (of dimension $2^{{\bf len}(X^{(0)})+{\bf len}(X^{(1)})}$), Bob can do so at no free energy cost. The resulting state, when traced over that environment, is then undistinguishable from a (possibly noisy) state sent by a malicious-but-classical Alice. Even if misbehaviour from Alice’s part might affect the protocol’s correctness (which is allowed for a malicious Alice), it leaves the perfect security intact: a quantum Alice can still not gain any information about Bob’s choice.

The above step reduces the security for Bob in the quantum case to the one of the classical case. The updated protocol does not require the honest players to make any quantum operations per se.