Security Models

Security Models in
Quantum Cryptography

A quantum protocol can be built perfectly and still be unsafe — if the rules used to judge it never imagined the attack that actually happens. Every claim that a system is “proven secure” comes with fine print: what the attacker was assumed to be able to do, what counts as breaking the system, and whether the guarantee survives once the system is plugged into something bigger. This page walks through that fine print: how attackers are classified, how “secure” is defined by comparing the real system against an imaginary perfect one, and why a protocol that is safe on its own can fail the moment it is used for real work.

Security Proofs Real/Ideal Paradigm UC Framework QROM Trace Distance Composability Adversary Models

What a Security Proof Actually Promises

A Proof Is a Trade, Not a Guarantee

A security proof does not show that a system cannot be broken. It shows that breaking the system would require solving a maths problem that nobody currently knows how to solve. The proof moves the risk rather than removing it: if someone later cracks that maths problem, every proof resting on it becomes worthless overnight. That is exactly what quantum computers threaten to do to the number-theory problems behind today's internet encryption.

Every proof has three moving parts. First, a description of what the attacker is allowed to do — the security model. Second, a description of what counts as winning — the security definition. Third, a recipe that turns any successful attacker into a solution to the hard maths problem — the reduction. Change any one of the three and the promise changes with it. Two papers can both say “provably secure” and mean very different things.

Quantum attackers break the old toolkit. Classical proofs lean on tricks that quietly assume the attacker is a piece of software you can inspect, pause and re-run. A quantum attacker cannot be handled that way: measuring a quantum system disturbs it, quantum states cannot be copied (the no-cloning theorem), and a quantum machine can ask a hash function about astronomically many inputs at once (a superposition query). Each of these knocks out a standard proof technique, so large parts of the theory had to be rebuilt from scratch.

Measuring Secrecy: Why “How Much Does Eve Know?” Is the Wrong Question

The obvious way to judge a key is to ask how much information the eavesdropper — conventionally called Eve — has about it. For quantum systems that question is badly posed, because Eve does not have to decide what she knows yet. She can hold onto a quantum system that is linked to the key (entangled with it), wait until the key has been used for something, and only then choose what to measure. Information she does not yet possess is not information she cannot get.

The measure that actually works asks a different question: how far is the real key from a perfect one? Line up two situations side by side — the real one, where Eve holds her quantum system, and an ideal one, where the key is perfectly random and Eve holds nothing related to it. The trace distance is the largest probability, over every possible test, of telling those two situations apart.

½ ‖ ρKE − τK ⊗ ρE ‖1 ≤ ε

Read the formula as: real situation (ρKE, key plus Eve) versus ideal situation (τK ⊗ ρE, perfect key with an unrelated Eve), and the gap between them is at most ε. The practical payoff is that a single number covers every future use of the key, including uses Eve has not thought of yet, and including measurements she delays until much later.

One caveat worth knowing: a small ε does not automatically mean “composably secure”. That step has to be proven inside a specific mathematical framework describing how systems plug together (usually Abstract Cryptography), and recent work on certifying real hardware has shown the argument needs re-checking whenever the setup changes.

The Rewinding Problem

Classical proofs routinely use a move called rewinding: save a snapshot of the attacker, let it run, then rewind it to the snapshot and run it again along a different branch to extract the secret it must have known. It is the proof equivalent of reloading a saved game.

Against a quantum attacker this is simply not allowed, because taking the snapshot means copying a quantum state and no-cloning forbids it. Quantum proofs therefore need straight-line simulators — arguments that only ever go forwards and must extract what they need on the first pass. Some protocols admit such an argument; others are not known to. This restriction is one of the main reasons quantum security theory has more open questions than its classical counterpart.

The Adversary Hierarchy — What Eve Is Allowed to Do

Before anything can be proven, someone has to write down what the attacker may do. Quantum cryptography uses three standard settings, each strictly more powerful than the last. The differences come down to two things: whether Eve can store quantum systems until later, and whether she can treat the whole transmission as one object instead of a series of unrelated signals.

EVE'S ADVERSARIAL POWER — THREE ATTACK CLASSES STRICTLY MORE POWERFUL — each class contains the one to its left — Individual Attacks (weakest adversary model) ✓ Probes each photon independently attaches a separate ancilla to each signal ✗ No quantum memory must measure each ancilla before next signal ✗ No inter-round correlations rounds are independent Security proofs: Simplest to construct; informative but insufficient for practical deployment. Physically unrealistic today — weak quantum memories exist. Collective Attacks (standard security target) ✓ Independent interaction per round same Stinespring isometry each round ✓ Quantum memory stores all ancillas for collective measurement ✗ Each round's channel is identical no adaptive variation between rounds Security proofs: Tractable with entropic tools. Most QKD proofs achieve this level. Upgraded to coherent via de Finetti or post-selection technique. Coherent Attacks (most general — gold standard) ✓ Arbitrary interaction, all rounds arbitrary joint unitary over all signals ✓ Quantum memory + correlation stores entangled ancillae across all rounds ✓ Adapts to classical information uses error-correction leakage to improve attack Security proofs: Most difficult to prove. Required for composable security guarantees. BB84 (Renner 2005); Rényi methods (2024–25). The de Finetti theorem and post-selection technique allow reducing coherent attack proofs to collective attack proofs under permutation symmetry
Three standard attacker settings, each containing the one before it. Individual attacks assume Eve must measure immediately — an assumption that stopped being realistic once usable quantum memories appeared. Collective attacks let her store everything and measure at the end, but treat each round identically. Coherent attacks put no restriction on her at all. Only the last of these supports a guarantee that survives being used in a real system.
Why the weakest model still gets used: proofs against individual attacks are far easier to write, and they often reveal the structure of a protocol clearly. The danger is quoting their numbers as if they applied to a deployed system. Techniques exist to promote a collective-attack proof to a coherent-attack one when the protocol treats its rounds symmetrically (de Finetti reductions and the post-selection technique), usually at the cost of a worse key rate.

The Real/Ideal World Paradigm

Comparison of real and ideal quantum cryptographic worlds showing Alice, Bob, and Eve with key distribution
In the real world (right), Alice and Bob exchange quantum states and classical messages while Eve holds a system correlated with theirs. In the ideal world (left), a trusted box simply hands them a perfect random key and Eve gets nothing. Security means no outside observer can tell which of the two they are watching — no matter what that observer does afterwards. Source: ResearchGate — CC-BY 4.0 — A Simple Security Proof for Entanglement-Based QKD

Defining Security by Comparison

Instead of listing properties a protocol must have — which invites the question of what got left off the list — modern proofs define security by comparison. Imagine a perfect version of the task, run by a trustworthy referee who cannot be corrupted. Then ask whether anyone watching from outside could tell the difference between that fantasy and the real thing. If not, the real protocol is as good as the fantasy, and nothing was left off the list.

The fantasy version (the ideal functionality, written F) is the definition of the task. For key distribution, F hands Alice and Bob the same perfectly random secret and gives Eve nothing. For a commitment scheme, F guarantees at once that the committed value stays hidden until it is opened and that it cannot be changed afterwards.

The real version (the protocol, written π) has no referee. An attacker A interferes with it: delaying messages, corrupting participants, watching how long operations take. The proof's job is to build a simulator S that sits in the fantasy world and produces a fake transcript that A's real-world experience cannot be distinguished from. If such a simulator exists, everything A achieved in reality was already achievable against the perfect version — so A gained nothing.

The Model Landscape — ROM, QROM and UC

SECURITY MODEL COMPARISON — QUANTUM CRYPTOGRAPHY MODEL ADVERSARY'S HASH ACCESS COMPOSABILITY STRENGTH MAIN WEAKNESS Standard Model No idealised primitives N/A — hash functions modelled as concrete algorithms Standalone only ✓ Most rigorous no hash idealisation Few schemes provable; proofs often unavailable ROM Random Oracle Model Classical queries only one input → one output per query Standalone, limited composition Widely deployed; enables many practical proofs Insecure against quantum adversaries with superposition QROM Quantum Random Oracle Model Quantum superposition queries adversary queries |ψ⟩ over many inputs Standalone; not inherently composable Post-quantum security; used in NIST PQC proofs New proof techniques needed; ROM proofs don't auto-lift Standalone Security Single isolated execution Model-dependent ✗ Not composable Simpler proofs; useful for analysis No security guarantee when used in larger protocols UC Framework Universal Composability Arbitrary — model-independent ✓ Fully composable security preserved in any context Gold standard; security holds under arbitrary concurrent execution Some tasks impossible (e.g. bit commitment in plain model)
The main settings used in quantum cryptographic proofs. Moving down the table trades realism about hash functions and composition for the ability to actually complete a proof. The UC framework at the bottom gives the strongest guarantee, at the cost of the heaviest machinery — and it puts some tasks permanently out of reach without extra setup assumptions.

Pretending a Hash Function Is Perfect — and Why Quantum Breaks the Pretence

Many proofs would be impossible if they had to reason about a real hash function such as SHA-3. So they cheat, in a controlled way: they pretend the hash is a magic box that returns a fresh random answer for every new question and remembers its answers. This is the random oracle model (ROM), introduced by Bellare and Rogaway in 1993, and it is remarkably productive — several widely deployed schemes have a clean proof in it and no proof at all without it.

The quantum problem. The pretence assumes the attacker asks one question at a time. A quantum attacker can ask about a huge number of inputs in a single query. That wrecks a key proof move called programming the oracle, where the prover secretly plants a chosen answer at the exact input the attacker is about to ask about — you cannot identify that input without measuring, and measuring destroys the very state you were trying to exploit.

The fix, and its limits. The quantum random oracle model (QROM), introduced by Boneh and co-authors in 2011, gives the attacker the realistic superposition access. Passing the old test does not mean passing the new one: schemes exist that are provably secure in the ROM and provably broken in the QROM. NIST's post-quantum standardisation therefore expects QROM analysis for schemes whose security leans on a hash function — which is why re-proving old results in the QROM has been a research industry of its own for a decade.

UC framework showing real world with protocol and adversary versus ideal world with ideal functionality and simulator
The UC framework (Canetti, 2001). Left: the real world, where the parties run protocol π and adversary A controls the network. Right: the ideal world, where stand-in parties talk to the ideal functionality F alongside simulator S. UC-security means the environment Z cannot tell the two apart — whatever else Z happens to be running at the same time. Source: ResearchGate — The Real World/Ideal World Paradigm in the UC Framework

Composability — Why Security in Isolation Is Not Enough

The Gap Between “Secure” and “Safe to Use”

A standalone proof covers one run of one protocol, by itself, with nothing else happening. Real systems never look like that. A key from quantum key distribution feeds an encryption layer, which runs beside an authentication protocol, on a network carrying hundreds of other conversations. A proof about the isolated case says nothing about any of that.

A concrete way it goes wrong. Suppose a QKD protocol is proven secure by showing Eve has almost no information about the key at the moment the protocol ends. Alice and Bob then use that key to encrypt a message with a one-time pad. Eve has kept a quantum system correlated with the key and has still not measured it. Now she measures it while looking at the ciphertext — using the encrypted message itself as a hint about which measurement to make. The original proof was correct; it simply answered a question asked at the wrong moment. The trace-distance criterion closes this gap because it bounds Eve's success at anything she does with the key, whenever she does it.

Stringing runs together. Generating a long key means running the protocol repeatedly and joining the pieces. That is only legitimate because a composition theorem says the security gaps add up rather than blowing up: run the protocol n times with gap ε each and the combined key has gap at most nε. Without a theorem of that shape, concatenating keys is an unjustified leap.

THE COMPOSABILITY CHAIN — WHY IT MATTERS FOR QKD 1. Quantum Channel BB84 / E91 states transmitted & measured. Eve holds quantum state correlated with raw bits. Coherent attack model required. 2. Error Correction Public reconciliation; leakage = leak bits. Eve now has leaked classical info AND her quantum state. Key rate reduced by leak bits. 3. Privacy Amplification Hash raw key to shorter secure key. Leftover hash lemma: min-entropy → trace distance bound. Composable security established here. 4. Composable Key K Trace distance ε from ideal uniform key. Security holds for any application, any concurrent protocol. One-time pad now provably secure. 5. Application Encryption, authentication, MPC subroutine… Composition theorem: security of K is inherited by application. Non-composable proofs break at Step 4: they bound mutual information I(K;E) which fails to account for Eve's quantum memory when she delays measurement until after Step 5. Trace distance composable proofs bound Eve's advantage in Step 5 directly.
Each stage of QKD has to be accounted for. Error correction is done over a public channel, so it hands Eve extra classical information that she combines with what she already holds. Privacy amplification then compresses the raw bits into a shorter key, converting a guaranteed amount of unpredictability into a trace-distance bound. Only after that step is the key safe to hand to an application.

Universal Composability

Universal Composability (UC), formalised by Canetti in 2001 and carried into the quantum setting by Ben-Or and Mayers (2004) and Unruh (2010), is the strongest available answer to the composition problem. Its extra ingredient is the environment Z: an adversarial outside world that feeds the protocol its inputs, sees its outputs, runs whatever else it likes alongside it, and adapts as it goes. A protocol is UC-secure if Z cannot distinguish the real run from the idealised one.

The payoff is modularity. The composition theorem says that if π securely implements F, then any larger system built assuming a perfect F stays secure when you swap in the real π — even with many copies running concurrently. This is what makes it legitimate to prove components separately and assemble them, rather than re-proving an entire system every time one piece changes.

The bill. Some tasks are provably unachievable in plain UC with no extra setup — bit commitment is the standard example, and no amount of cleverness fixes it without an assumption such as a shared reference string. Quantum UC additionally forbids rewinding, so every simulator must work in a single forward pass. The result is a framework everyone agrees is the right target and comparatively few protocols have actually reached.

Where the Field Stands

Recent Movement (2024–2026)

Finite-key numbers got substantially better. Real protocols exchange a finite number of signals, and the resulting statistical slack used to cost a lot of key. A new generation of accounting tools based on Rényi entropies — the generalised entropy accumulation results of 2024–25 — give tighter bounds and, usefully, reduce the analysis to a convex optimisation that can be solved numerically rather than a hand-crafted construction. Related work extends this to prepare-and-measure and decoy-state protocols, the ones actually deployed.

Experiments caught up with the theory. Composable finite-size keys are no longer only a paper exercise: a 2025 demonstration of four-state discrete-modulated continuous-variable QKD produced composably secure keys against collective attacks over 20 km of fibre using roughly 2.3×10⁹ transmitted states, at about 0.011 bits per symbol.

Attention has shifted to the assumptions. Two strands stand out. A 2025 review of decoy-state BB84 proofs catalogues gaps and unstated assumptions in results that are widely cited as settled. And a 2026 framework tackles a question implementations cannot avoid: a proof depends on device parameters such as detector efficiency and dark-count rate, so what does measuring those parameters on a real box actually entitle you to conclude? The same work notes that the familiar shorthand “trace distance implies composable security” needs proving inside a specific framework rather than being assumed.

Evaluating the Models — Strengths and Weaknesses

📐

Standalone Security

Strengths: Much easier to prove, and often the clearest way to understand what a protocol is doing. Widely used in the theoretical literature.

Weaknesses: The guarantee does not survive being used. A standalone-secure protocol can be entirely insecure inside a larger system, and proofs based on how much Eve knows at the end are especially fragile against an attacker who simply waits.

🔍

ROM / QROM

Strengths: Makes proofs possible for schemes that have none otherwise. QROM analysis underpins the NIST post-quantum standards and is now the expected baseline for hash-dependent constructions.

Weaknesses: Still a pretence — real hash functions are not magic boxes. Passing in the ROM does not imply passing in the QROM, and many older ROM results have no known quantum counterpart.

🧱

UC Framework

Strengths: The gold standard. Security holds under arbitrary concurrent use, components can be proven separately and swapped in freely, and the quantum version captures an attacker who keeps quantum systems around.

Weaknesses: Some tasks are impossible in it without extra setup. The ban on rewinding forces harder simulator constructions. Proofs are considerably more work than the alternatives, so fewer protocols have one.

⚠️

Finite-Key Regime

Strengths: The only regime that describes real hardware. It converts a target security level into a concrete instruction: exchange this many signals. Rényi-based methods have closed much of the old gap to the idealised numbers.

Weaknesses: Key rates stay below the idealised figures and statistical slack accumulates across every estimation step. Composable continuous-variable demonstrations still need on the order of a billion transmitted states.

Still open: classical UC and quantum UC are not the same framework, and the boundary of what quantum UC can and cannot achieve is not fully mapped — particularly for device-independent protocols, where security is supposed to hold even if the hardware was built by the attacker. Unruh's framework covers many cases, but questions about protocols that send quantum states rather than classical messages, and about what device certification legitimately buys you, remain live.