The landscape
QKD is the best-known application of quantum information to security, but quantum mechanics enables or constrains many other cryptographic tasks. A recurring theme: some tasks become possible with information-theoretic security (key distribution, randomness, signatures), while others are provably impossible without extra assumptions (bit commitment, oblivious transfer).
Quantum random number generation
Randomness is a resource for every cryptosystem. Measuring a qubit prepared in $|+\rangle$ in the $Z$ basis yields an unpredictable bit by Born’s rule. Implementations include photon-path (BS), photon-arrival-time, and vacuum-fluctuation (homodyne) QRNGs. After raw generation, randomness extraction by Toeplitz hashing gives near-uniform bits. Source-device-independent and fully device-independent QRNGs (using Bell violation) certify randomness even from untrusted devices. Commercial QRNG chips are now deployed in phones and servers.
Quantum secret sharing
Classical secret sharing (Shamir) splits a secret so that any $t$ of $n$ shares reconstruct it and fewer reveal nothing. Quantum secret sharing (Hillery–Bužek–Berthiaume 1999; Cleve–Gottesman–Lo 1999) shares a secret classical bit or an unknown quantum state using multipartite entanglement such as GHZ states. For quantum states, a $(k,n)$ threshold scheme exists only if $n\le2k-1$, otherwise no-cloning would allow two disjoint groups to each reconstruct the state. Applications: distributed key custody and access control in quantum networks.
Quantum digital signatures
(Gottesman–Chuang 2001.) A signer publishes quantum “public keys” (many copies of states derived from a private classical key); recipients check signatures against them. Security is information-theoretic: forgery would require cloning non-orthogonal states, and non-repudiation uses symmetrisation among recipients. Practical variants (Clarke et al. 2012 onward) need no quantum memory, but keys are one-shot and expensive per bit, so QDS is complementary to post-quantum signatures such as ML-DSA.
Bit commitment, oblivious transfer and the no-go theorems
In bit commitment Alice commits to a bit that Bob cannot read (hiding) and Alice cannot change (binding). Mayers (1997) and Lo–Chau (1997) proved that unconditionally secure quantum bit commitment is impossible: if it is hiding, Alice can use an entangled purification to switch her commitment after the fact. Since bit commitment and oblivious transfer imply secure two-party computation, these are also impossible with unconditional security (Lo 1997). Ways around:
- Bounded or noisy quantum storage (Damgård et al. 2005; Wehner–Schaffner–Terhal 2008): adversary has limited quantum memory.
- Relativistic protocols (Kent 1999): exploit finite light speed and multiple separated sites. Experiments have held commitments for many milliseconds up to much longer.
- Computational assumptions secure against quantum attackers (post-quantum), possibly with quantum protocols.
- Cheat-sensitive and weaker security notions.
Coin flipping
Two distrustful parties want a fair random bit. Strong coin flipping (either may cheat toward either outcome): classically a cheater can force any outcome; quantumly the minimum achievable bias is $\tfrac1{\sqrt2}-\tfrac12\approx0.207$ (Kitaev’s bound; achieved by Chailloux–Kerenidis 2009). Weak coin flipping (each party wants a different outcome) can achieve arbitrarily small bias (Mochon 2007).
Private queries, fingerprinting and blind computing
- Quantum private query (Giovannetti–Lloyd–Maccone 2008). A user retrieves one database item while the database learns almost nothing about which, and the user learns little about other items. Practical realisations exist as “cheat-sensitive” protocols.
- Quantum fingerprinting (Buhrman–Cleve–Watrous–de Wolf 2001). Equality of two $n$-bit strings can be tested using $O(\log n)$ qubits sent to a referee, exponentially fewer bits than the classical $\Omega(\sqrt n)$ requirement; demonstrated in small experiments.
- Blind (delegated) quantum computing (Broadbent–Fitzsimons–Kashefi 2009). A client with minimal quantum ability delegates a computation to a server so that the server learns neither input, program nor output, using single-qubit states prepared by the client. Verification protocols detect cheating servers.
Quantum money and certified deletion
- Quantum money (Wiesner, written 1969, published 1983). A banknote carries qubits in random BB84 states, with the classical description stored at the bank. No-cloning makes counterfeiting infeasible. Public-key quantum money (Aaronson 2009 and later) lets anyone verify without the bank. First, historically, of all quantum cryptography.
- Encryption with certified deletion (Broadbent–Islam 2020). Ciphertext can be provably deleted: a verifiable deletion certificate guarantees that the data are no longer recoverable.
- Quantum authentication and MACs (Barnum et al. 2002). Authenticating quantum messages needs encryption too.
- Position-based quantum cryptography: using location as credential; shown breakable in general by entanglement-based attacks (Buhrman et al. 2014).