A Quantum Digital Signature (QDS) refers to the quantum mechanical equivalent of either a classical digital signature or, more generally, a handwritten signature on a paper document. Like a handwritten signature, a digital signature is used to protect a document, such as a digital contract, against forgery by another party or by one of the participating parties. As e-commerce has become more important in society, the need to certify the origin of exchanged information has arisen. Modern digital signatures enhance security based on the difficulty of solving a mathematical problem, such as finding short vectors in lattices (SIS) as for ML-DSA and Falcon. Fortunately, the task of solving these problems remains infeasible when a quantum computer is available (see Shor's algorithm). Independently, new quantum digital signature schemes have been proposed to provide protection against tampering. In comparison with ML-DSA and Falcon, quantum signatures require all participants to possess and operate a quantum computer.
Classical public-key method The public-key method of cryptography allows a sender to sign a message with a signing key in such a way that any recipient can, using the corresponding public key, check the authenticity of the message. To allow this, the public key is made broadly available to all potential recipients. To make sure only the legal author of the message can validly sign the message, the public key is created from a random, private signing key, using a one-way function. This is a function that is designed such that computing the result given the input is very easy, but computing the input given the result is very difficult. A classic example is the multiplication of two very large primes: The multiplication is easy, but factoring the product without knowing the primes is normally considered infeasible.
x ↦ f ( x ) {\displaystyle x\mapsto f(x)} easy
f ( x ) ↦ x {\displaystyle f(x)\mapsto x} very difficult
Quantum Digital Signature Like classical digital signatures, quantum digital signatures make use of asymmetric keys. Thus, a person who wants to sign a message creates one or more pairs of sign and corresponding public keys. In general we can divide quantum digital signature schemes into two groups:
A scheme that creates a public quantum-bit key out of a private classical bit string: k ↦ | f k ⟩ {\displaystyle k\mapsto |f_{k}\rangle }
A scheme that creates a public quantum-bit key out of a private quantum bit string: | k ⟩ ↦ | f k ⟩ {\displaystyle |k\rangle \mapsto |f_{k}\rangle }
In both cases f is a one-way quantum function that has the same properties as a classical one-way function. That is, the result is easy to compute, but, in contrast to the classical scheme, the function is impossible to invert, even if one uses powerful quantum cheating strategies. The most famous scheme for the first method above is provided by Gottesman and Chuang
Requirements for a good and usable signature scheme Most of the requirements for a classical digital signature scheme also apply to the quantum digital signature scheme. In detail
The scheme has to provide security against tampering by The sender after the message was signed (see bit commitment) The receiver A third party Creating a signed message has to be easy Every recipient has to get the same answer, when testing the message for validity (Valid, Non-Valid)
Differences between classical and quantum one-way functions
Nature of the one-way function A classical one-way function as said above is based on a classical infeasible mathematical task, whereas a quantum one-way function exploits the uncertainty principle which makes it impossible even for a quantum computer to compute the inverse. This is done by providing a quantum output state, with whom one cannot learn enough about the input string to reproduce it. In case of the first group of schemes this is shown by Holevo's theorem, which says, that from a given n-qubit quantum state one cannot extract more than n classical bits of information. One possibility to ensure that the scheme uses less qubits for a bit string of a certain length is by using nearly orthogonal states
| ⟨ f k | f k ′ ⟩ | < δ for k ≠ k ′ ∧ 0 ≤ δ ≤ 1 {\displaystyle |\langle f_{k}|f_{k}'\rangle |<\delta \qquad {\text{ for }}k\neq k'\land 0\leq \delta \leq 1}
That gives us the possibility to induce a basis with more than two states. So to describe an information of 2 n {\displaystyle 2^{n}} bits, we can use less than n qubits. An example with a 3 qubit basis
| 0 ⟩ {\displaystyle |0\rangle }
| 1 ⟩ {\displaystyle |1\rangle }
1 2 ( | 0 ⟩ + | 1 ⟩ ) {\displaystyle {\frac {1}{\sqrt {2}}}(|0\rangle +|1\rangle )}
… excerpt ends here. Continue reading the full article.
