Error-tolerant secure key leasing for quantum decryption keys in public-key encryption

Abstract: We propose the first error-tolerant secure key leasing (SKL) for public-key encryption. As with SKL in prior works, our protocol consists of a lessor and lessee. In the protocol, the lessor encodes its secret key into quantum states and leases the key to the lessee. Then, the lessor can ask the lessee to return the secret key at a later point. The lessor is able to check whether the lessee has returned its key honestly. However, our protocol works even when the leased secret key is subject to noise. The lessee decrypts the ciphertext correctly, and the lessor verifies the return of the secret key correctly when the amount of error is below a certain threshold. Our improved protocol does not change the encoding of the secret key, and thus adds no overhead to the quantum information processing. Our most significant result is a framework to analyze the trade-off between robustness against error and security. We bridge the security of the error-tolerant SKL and that of the error-tolerant certified deletion with shortened codes, which is a relatively less explored concept in coding theory.

• The paper presents an error-tolerant SKL protocol for quantum PKE that leverages classical error-correcting codes to maintain decryption correctness and secure deletion under noise.
• The protocol employs shortened codes and certified deletion techniques to achieve robustness, tolerating an error rate of approximately 2% without quantum error correction overhead.
• Rigorous security analysis shows that the protocol reduces adversarial success to negligible levels, establishing a practical tradeoff between noise robustness and cryptographic security.

Error-Tolerant Secure Key Leasing for Quantum Decryption Keys in Public-Key Encryption

Background and Motivation

The paper addresses the limitations of Secure Key Leasing (SKL) protocols for public-key encryption (PKE) in the quantum setting. SKL is a quantum primitive enabling a lessor to lease their secret key, encoded in a quantum state, to a lessee, with subsequent verifiable deletion or return. Classical solutions are fundamentally inadequate because bit-strings can always be copied undetectably, but quantum encodings enable checkable unclonability. Prior SKL work achieved classical communication (classical lessor) [CGJL23, PWY+25], extended applicability to primitives like PRFs and signatures [KMY24], and handled collusion [KNP25b]. However, all protocols were vulnerable to errors in the quantum states during preparation, transmission, or storage, making them impractical for noisy quantum hardware.

This paper proposes the first error-tolerant SKL protocol for PKE, offering resilience to realistic noise — both in quantum state preparation and in subsequent operations — while maintaining robust security guarantees. The authors' main innovation is the formulation of an error-security tradeoff framework, leveraging classical error-correcting codes (ECCs) and the concept of shortened codes. By adapting certified deletion protocols and classical coding theory, the protocol attains robustness without quantum overhead and offers strong security proofs.

Protocol Construction and Technical Overview

The core construction employs a lessor encoding a secret key into a tensor product of quantum states, each randomly in computational or Hadamard basis. The message to be decrypted is encoded using a pre-shared classical ECC. The sender encrypts each ECC codeword bit under dedicated public keys, generating ciphertexts for both bit values.

Decryption correctness is achieved via coherent execution of the classical decryption algorithm, extracting the ECC codeword and decoding the original message even in the presence of noise. Noise tolerance, i.e., accepting corrupted key states and deletion certificates up to a threshold, is mapped directly to the ECC parameters and adjusted deletion verification thresholds.

Deletion verification correctness is ensured by measuring all qubits in the Hadamard basis, sending the outcome as a deletion certificate. The lessor, with knowledge of secret encoding parameters, checks if the certificate passes verification — accepting up to a fraction $\delta$ of incorrect bits, determined by the ECC and the desired robustness.

Security (OW-VRA and IND-VRA) is established by reduction to error-tolerant certified deletion — a game where an adversary must try to recover information encoded in both bases, but can only succeed with negligible probability due to the uncertainty principle. The protocol employs shortened codes as subcodes of ECCs, restricted to computational basis indices determined by the secret basis string, to bridge the gap between the deletion game and SKL. The number of allowed syndromes is bounded by coding theory, and classical ECCs are shown sufficient — quantum error correction is unnecessary.

Figure 1: Outline of the PKE-SKL protocol: the lessor encodes the secret key into a quantum state $\ket{dk}$, sends it to the lessee, who can decrypt and later return a deletion certificate for verification.

Security Analysis and Error Robustness

The paper rigorously derives the tradeoff between robustness and security via analysis of ECCs, threshold $\delta$, and code parameters. Certified deletion bounds are adapted (see Theorem CDP-BI20) to account for the number of syndromes and ECC rate, leading to explicit quantitative conditions under which adversarial success probability is negligible.

The protocol accommodates error-tolerance by setting the certificate mismatch threshold $\delta$ according to ECC distance and rate, ensuring that even with noise, decryption and deletion verification remain both correct and secure.

An explicit protocol instantiation with concatenated Hamming codes is presented: a $(7n, 4n, 3)$ code enables correction of one corrupted quantum key per block, with a critical threshold for $\delta$ roughly $0.0203$. This means the protocol tolerates up to $\sim 2\%$ of the keys corrupted without false rejection, balancing noise robustness and security.

Figure 2: Illustration of the certified deletion property, which underpins deletion verification in error-tolerant SKL.

Figure 3: Structure of the leased quantum key $\ket{dk}$, enabling coherent decryption and robust error correction.

Figure 4: Adversarial strategy that attempts to break certified deletion via a cheating lessee; analysis demonstrates negligible success for bounded adversaries.

Implications and Future Prospects

Practical implications are substantial: the protocol reduces quantum overhead for SKL, utilizing only classical ECCs for robust error correction. This enhances feasibility for quantum cryptography in noisy environments and relaxes requirements on lessor-side quantum computations.

Theoretical implications include a novel connection between certified deletion, shortened codes, and quantum SKL security. The framework permits tight security-error tradeoff analysis, suggesting new coding-theoretic directions (e.g., syndrome counting for shortened codes, pseudorandom codes for PRFs).

Further developments may focus on:

• Tightening syndrome number bounds for shortened codes (improving $\delta$ threshold).
• Direct construction of IND-VRA secure SKL for multi-bit messages with shorter keys, possibly via indistinguishable certified deletion.
• Extending error-tolerant SKL schemes beyond PKE to PRFs and signatures, addressing the difficulty of ECC encoding in pseudorandom outputs.

Conclusion

The paper introduces a rigorous, error-tolerant SKL protocol for quantum PKE, leveraging classical ECCs and shortened codes for noise robustness, and reduces security to certified deletion with negligible adversarial advantage. The explicit tradeoff framework between security and error tolerance advances both theoretical quantum cryptography and practical deployment prospects. Future work will address tighter analyses in coding theory, efficient multi-bit SKL key protocols, and expansion to broader cryptographic primitives.

(2607.02989)