Quantum-Secure-By-Construction (QSC)

• Quantum-Secure-By-Construction is a design paradigm that embeds quantum security into cryptographic primitives and system architectures from inception, ensuring resilience against quantum adversaries.
• QSC employs both primitive-centric and system-centric approaches, leveraging algebraic structures, quantum reductions, and modular orchestration to secure communications and computation.
• QSC guides the integration of advanced techniques like quantum randomness, post-quantum cryptography, and stateful protocols to meet stringent quantum security models.

Searching arXiv for the provided QSC-related papers and recent context. arXiv search query: "Quantum-Secure-By-Construction OR qIND qCPA quantum-secure PRP QEnclave" Using the arXiv search tool now. Quantum-Secure-By-Construction (QSC) denotes a design orientation in which quantum security is treated as an intrinsic architectural property of a cryptographic primitive, protocol, or system rather than as a retrofit added after deployment. Across the literature, the term is used both narrowly, to describe information-theoretically or computationally secure primitives whose security definitions and proofs already quantify over quantum adversaries, and broadly, to describe system architectures in which post-quantum cryptography (PQC), quantum random number generation (QRNG), quantum key distribution (QKD), or stateful quantum mechanisms are integrated into the control plane and data plane from the outset [(Kasher et al., 2010); (Bishwas et al., 12 Mar 2026)]. In this sense, QSC is less a single construction than a family of design patterns: classical algebraic extractors proved secure against entangled quantum storage (Kasher et al., 2010), quantum public-key encryption from quantum-secure one-way functions (Barooti et al., 2023), superposition-secure pseudorandom permutations from minimal assumptions (Zhandry, 2016), composable blind delegated computation via a minimal trusted quantum functionality (Ma et al., 2021), and execution-continuity mechanisms grounded in stateful quantum evolution (Ünsal, 30 Dec 2025).

1. Conceptual scope and formal orientations

The term “Quantum-Secure-By-Construction” is used explicitly in recent systems work as “a design paradigm that treats quantum secure communication as a core architectural property of agentic AI systems rather than an upgrade added later” (Bishwas et al., 12 Mar 2026). A closely aligned, earlier cryptographic usage appears in work on two-source extractors secure against quantum adversaries, where a seedless extractor with information-theoretic guarantees against bounded quantum storage is presented as a natural “by-construction” quantum-secure primitive (Kasher et al., 2010). This suggests that QSC has two distinct but connected meanings.

The first meaning is primitive-centric. A primitive is QSC when its security claim is stated directly against quantum adversaries, quantum side information, or superposition access, and when the proof relies on structural properties rather than on an argument that a classical proof “should still work.” This includes, for example, two-source extractors secure against entangled bounded storage (Kasher et al., 2010), quantum-secure pseudorandom permutations secure against superposition queries to both permutation and inverse (Zhandry, 2016), and encryption notions for quantum data defined natively with QPT adversaries and CPTP maps (Alagic et al., 2016).

The second meaning is system-centric. A system is QSC when security posture is embedded into orchestration, identity, session bootstrap, memory access, audit, and inter-component communication. In that broader sense, QSC is realized as a runtime-adaptive and policy-guided cryptographic stack that composes PQC, QRNG, and QKD across a distributed system graph (Bishwas et al., 12 Mar 2026). A plausible implication is that the system-level meaning generalizes the primitive-level meaning: primitives are selected or composed so that the resulting architecture preserves quantum security properties under deployment constraints.

A further conceptual distinction concerns the security domain. A systematic classification of “quantum security” separates scenarios into QS1, where schemes are classical but must resist QPT adversaries; QS2, where classical primitives must also withstand superposition oracle access; and QS3, where schemes operate natively on quantum data and quantum infrastructure (Gagliardoni, 2017). QSC appears across all three domains. In QS1, it requires quantum-sound reductions and quantum-hard assumptions. In QS2, it requires security under superposition access, as in qPRF/qPRP-based constructions (Zhandry, 2016, Gagliardoni et al., 2015). In QS3, it requires quantum-native definitions and constructions, such as QIND-secure encryption of quantum data (Alagic et al., 2016).

2. Primitive-level QSC: extractors, encryption, and permutations

A recurring QSC pattern is the reuse of a simple classical construction together with a proof that it remains secure in the presence of quantum side information. The clearest example is the inner-product-based two-source extractor of Chor and Goldreich and its DEOR multi-bit variant. In the bounded-quantum-storage setting, the extractor is required to satisfy

$\big\|\rho_{\mathrm{Ext}(X,Y)E_1E_2} - U_m \otimes \rho_{E_1E_2}\big\|_{\mathrm{tr} \le \varepsilon,$

even when the adversaries share prior entanglement (Kasher et al., 2010). The paper proves that the DEOR extractor is secure against both non-entangled and entangled bounded storage with parameters close to the classical case, while the one-bit inner-product threshold is tight up to additive constants (Kasher et al., 2010). The central QSC feature is not merely quantum robustness, but robustness derived from the algebraic form of the extractor and from communication-complexity lower bounds, rather than from computational assumptions.

A second primitive-level pattern is minimal-assumption public-key encryption in the quantum setting. A construction of quantum public-key encryption with classical ciphertexts is shown from quantum-secure one-way functions via quantum-secure PRFs (Barooti et al., 2023). The public key is a pure quantum state

$\ket{pk} = \ket{pk_0}\otimes \ket{pk_1},$

where each component is a superposition over a PRF graph; encryption measures one branch in the computational basis, and decryption is purely classical (Barooti et al., 2023). The scheme satisfies a quantum CCA security notion in which the adversary is QPT, receives polynomially many copies of the quantum public key, and has classical access to the decryption oracle (Barooti et al., 2023). Here the QSC claim is explicit: strong public-key functionality follows from the sole assumption that quantum-secure one-way functions exist.

A third pattern is the reduction of strong quantum-query symmetric primitives to weak assumptions. Quantum-secure PRPs are defined against adversaries that can query the permutation and its inverse on quantum superpositions (Zhandry, 2016). The construction factors the problem into a quantum-secure PRF and a function-to-permutation converter. Combined with Zhandry’s result that qPRFs exist from quantum-secure one-way functions, this yields $(\mathsf{Q},\mathsf{Q},\mathsf{S})$-PRPs from quantum-secure one-way functions (Zhandry, 2016). This is significant for QSC because it provides a block-cipher-like primitive secure in the strongest standard superposition-query model while keeping the assumption base minimal.

A related but more restrictive lesson comes from superposition-secure indistinguishability for classical encryption. Strong notions such as qIND-qCPA are achievable, but not by quasi-length-preserving schemes: the paper proves that quasi-length-preserving secret-key encryption cannot be qIND secure (Gagliardoni et al., 2015). It then gives a positive construction based on a quantum-secure PRP applied to message-plus-randomness blocks, yielding qIND-qCPA security and the corresponding semantic notion (Gagliardoni et al., 2015). This suggests that QSC may require structural redesign even when a scheme is already secure in weaker post-quantum senses.

The same structural theme appears in encryption of quantum data. Computational security notions for quantum plaintexts are developed with QPT adversaries and CPTP encryption and decryption maps, and semantic security is shown equivalent to indistinguishability in direct analogy with Goldwasser–Micali (Alagic et al., 2016). From quantum-secure one-way functions one obtains IND-CCA1-secure symmetric-key quantum encryption, and from quantum-secure trapdoor one-way permutations one obtains semantically secure public-key quantum encryption (Alagic et al., 2016). In QSC terms, the point is not only that the primitives are quantum-safe, but that the definitions, the adversary model, and the reductions are all quantum-native.

3. Security models that make QSC meaningful

QSC claims depend on the choice of adversarial interface. Several of the cited works show that changing the interface from classical to quantum can radically change what is achievable.

For weak randomness extraction, the relevant interface is quantum side information. In the bounded-storage model, each adversary receives one source, may share prior entanglement, applies an arbitrary CPTP map conditioned on the observed source value, and keeps only $b_1$ or $b_2$ qubits (Kasher et al., 2010). The key subtlety is that classical independence of $X$ and $Y$ does not imply a product structure for the adversaries’ joint state after entangled preprocessing. QSC is meaningful here precisely because the model explicitly includes entanglement and bounded final quantum memory.

For symmetric primitives, the distinction between post-quantum and superposition security is essential. In QS1, a classical scheme is secure against QPT adversaries with classical oracle access. In QS2, any adversary-visible oracle is modeled as a quantum oracle, so superposition access becomes part of the definition (Gagliardoni, 2017). The qIND framework for symmetric encryption and the qPRP framework for permutations both belong to this stronger domain (Gagliardoni et al., 2015, Zhandry, 2016). A plausible implication is that many “post-quantum secure” schemes are not QSC in the stronger QS2 sense unless they were designed for superposition access.

For public-key encryption with quantum public keys, the interface includes polynomially many copies of a pure quantum public key and a classical decryption oracle (Barooti et al., 2023). The restriction to pure public keys is deliberate and rules out trivial encodings of secret-key functionality as mixed-state public keys (Barooti et al., 2023). Here QSC requires that both the syntactic object and the security game be native to the quantum model.

For quantum cloud computation, the interface is captured compositionally as an ideal resource. QEnclave is modeled through Remote State Rotation, a functionality that rotates a server-provided qubit by $Z(\theta)$ for uniformly random $\theta\in \mathcal{Z}_\pi$, outputs the rotated state to the server, and the angle to the client (Ma et al., 2021). The paper proves in the Abstract Cryptography framework that this suffices to construct measurement-based remote state preparation and then blind delegated quantum computation with perfect blindness (Ma et al., 2021). In this case QSC means that the final security guarantee is inherited compositionally from a small trusted functionality rather than argued monolithically at the application level.

For execution continuity, the interface is neither encryption nor key exchange but temporal evidence. The Quantum State Continuity Problem asks whether a system can produce evidence that binds present behavior to a single past execution history (Ünsal, 30 Dec 2025). The QSCP security game declares an adversary successful if two forked branches from a common past both pass all $W$ audited rounds (Ünsal, 30 Dec 2025). The associated QSCW primitive is stateful, challenge-dependent, and cumulative; valid evidence at time $\ket{pk} = \ket{pk_0}\otimes \ket{pk_1},$0 depends on the prior internal state (Ünsal, 30 Dec 2025). This broadens QSC beyond confidentiality and authenticity toward temporal integrity.

4. Structural techniques underlying QSC constructions

Although the cited papers span extractors, encryption, cloud delegation, and execution continuity, several proof patterns recur.

One pattern is reduction to fundamental information-theoretic or communication-theoretic limits. In the extractor setting, attacks on the inner product can be modeled as simultaneous-message-passing protocols, so lower bounds on quantum communication complexity imply limits on adversarial prediction bias (Kasher et al., 2010). In the continuity setting, no-cloning and measurement disturbance are turned into a temporal audit mechanism: after a fork, two branches cannot both preserve the required state trajectory except with rapidly decreasing probability (Ünsal, 30 Dec 2025). In both cases QSC arises because the security argument leverages constraints imposed by quantum mechanics itself.

A second pattern is modularity through strong intermediate resources. The DEOR extractor is first shown X-strong or Y-strong via a quantum XOR lemma and then composed with a seeded extractor secure against quantum side information to increase output length (Kasher et al., 2010). QEnclave follows the same architectural logic at the systems level: Remote State Rotation constructs measurement-based remote state preparation, which in turn constructs blind delegated quantum computation (Ma et al., 2021). The recent agentic-systems formulation of QSC makes this modularity explicit through link-specific posture selection among $\ket{pk} = \ket{pk_0}\otimes \ket{pk_1},$1, $\ket{pk} = \ket{pk_0}\otimes \ket{pk_1},$2, and $\ket{pk} = \ket{pk_0}\otimes \ket{pk_1},$3 (Bishwas et al., 12 Mar 2026).

A third pattern is black-box use of a quantum-secure primitive as a key generator or control layer. The quantum-secure non-malleable randomness encoder is a representative example. A 2-split rate-$\ket{pk} = \ket{pk_0}\otimes \ket{pk_1},$4 quantum-secure NMRE is built from a quantum-secure two-source non-malleable extractor and then used in a black-box manner to obtain a rate $\ket{pk} = \ket{pk_0}\otimes \ket{pk_1},$5, 3-split quantum non-malleable code, a rate $\ket{pk} = \ket{pk_0}\otimes \ket{pk_1},$6, 3-split quantum secure non-malleable code, and a rate $\ket{pk} = \ket{pk_0}\otimes \ket{pk_1},$7, 2-split average-case quantum secure non-malleable code (Batra et al., 2023). The same paper explicitly frames this as an instance of a modular “quantum-secure-by-construction” methodology (Batra et al., 2023). This suggests that QSC often relies on a protected randomness or control sublayer whose guarantee is then lifted through composition.

A fourth pattern is explicit treatment of otherwise hidden assumptions. The finite-key HOQS+ system treats the instruction sequence as information-theoretically protected by a pre-shared key and separates its secrecy from the secrecy of QKD and PQC-derived keys (Gupta et al., 4 Dec 2025). Even if QKD and PQC keys are compromised via side channels, confidentiality is argued to persist because the attacker still lacks the protected control sequence that determines the hybrid-encryption configuration (Gupta et al., 4 Dec 2025). This suggests that QSC system design often depends on identifying a small, high-assurance root of trust and making it structurally independent of the rest of the stack.

5. System-level QSC: orchestration, lifecycle security, and composability

The most explicit system formulation of QSC models an agentic AI deployment as a directed graph

$\ket{pk} = \ket{pk_0}\otimes \ket{pk_1},$8

with client $\ket{pk} = \ket{pk_0}\otimes \ket{pk_1},$9, orchestrator $(\mathsf{Q},\mathsf{Q},\mathsf{S})$0, and agents $(\mathsf{Q},\mathsf{Q},\mathsf{S})$1 (Bishwas et al., 12 Mar 2026). For each link $(\mathsf{Q},\mathsf{Q},\mathsf{S})$2, the system selects a cryptographic posture

$(\mathsf{Q},\mathsf{Q},\mathsf{S})$3

by optimizing a weighted combination of security, latency, and cost subject to compliance constraints (Bishwas et al., 12 Mar 2026). Session keys are derived from whichever of QKD, PQC, and QRNG are available: $(\mathsf{Q},\mathsf{Q},\mathsf{S})$4 (Bishwas et al., 12 Mar 2026). The defining QSC move is that the cryptographic choice is elevated to an orchestration problem spanning bootstrap, task execution, inter-agent communication, memory access, and audit.

A closely related systems pattern appears in HOQS+, where a hybrid QKD–PQC architecture is controlled by an information-theoretically secure instruction sequence distributed under a pre-shared key (Gupta et al., 4 Dec 2025). The system combines BBM92 with tight finite-key security, Kyber KEM, and Ascon-based hybrid encryption, while the instruction sequence determines the actual encryption configuration (Gupta et al., 4 Dec 2025). The novelty in QSC terms is that confidentiality is not attached to any single primitive. Rather, the architecture is arranged so that even when QKD and PQC keys leak via side channels, the message remains protected because the small control sequence remains information-theoretically hidden (Gupta et al., 4 Dec 2025).

QEnclave illustrates a different compositional systems approach. The client is fully classical, the server is untrusted, and the only trusted quantum component is a minimal enclave capable of single-qubit rotations (Ma et al., 2021). By modeling the enclave as the Remote State Rotation resource and proving exact constructions in the Abstract Cryptography framework, the paper obtains blind delegated quantum computation with perfect blindness (Ma et al., 2021). This is a stringent form of QSC: the application-level guarantee is a direct consequence of ideal-resource composition.

These system-level approaches share a common feature: the security property is made persistent across the lifecycle of the system. It is not limited to a handshake or a transport layer. The agentic formulation explicitly secures session bootstrap, task DAG assignment, tool invocation, memory, and audit (Bishwas et al., 12 Mar 2026). The execution-continuity formulation explicitly distinguishes identity from continuity and enforces the latter across rounds of a stateful interaction (Ünsal, 30 Dec 2025). This suggests that QSC, at system scale, is best understood as lifecycle-integrated cryptographic design.

6. Limits, controversies, and open problems

A notable limitation of the QSC label is that it spans several non-equivalent threat models. In bounded-storage extraction, “by construction” means information-theoretic security against entangled bounded storage (Kasher et al., 2010). In quantum public-key encryption, it means computational security from qOWFs against QPT adversaries (Barooti et al., 2023). In agentic systems, it means runtime orchestration of heterogeneous primitives under policy (Bishwas et al., 12 Mar 2026). These are compatible uses, but they are not interchangeable. A plausible implication is that QSC should always be read relative to a precise adversarial interface.

Another controversy concerns how strong the model should be. For two-source extraction, the entangled guessing-entropy model is too strong for inner-product-based extractors: the paper shows that no inner-product extractor can be secure there (Kasher et al., 2010). For symmetric encryption, fully quantum indistinguishability with unrestricted challenge structure is impossible for large classes of quasi-length-preserving schemes (Gagliardoni et al., 2015). For QSCW, the paper explicitly notes that an ideal coherent adversary maintaining perfect quantum coherence across branches may invalidate the continuity construction (Ünsal, 30 Dec 2025). These examples show that “quantum-secure” is not monotone in the obvious sense; overly strong definitions can trivialize the problem.

Efficiency is another limitation. The qPRP construction from qOWFs via qPRFs and function-to-permutation converters is primarily an existence result, not a practical block cipher replacement (Zhandry, 2016). Constant-rate quantum-secure non-malleable codes are achieved, but the rates remain well below the best classical split-state upper bounds (Batra et al., 2023). HOQS+ improves scalability and integrates the tightest finite-key BBM92 analysis in its setting, but its QKD component still depends on realistic key-rate and infrastructure constraints (Gupta et al., 4 Dec 2025). QEnclave reduces client requirements dramatically, yet still relies on a trusted enclave and does not provide verifiability, only blindness (Ma et al., 2021).

Open problems recur across the literature. For extractors, exact matching of classical multi-bit parameters in the non-entangled quantum setting remains open, as does quantum security of more advanced two-source constructions such as Bourgain’s and Raz’s (Kasher et al., 2010). For symmetric encryption, quantum CCA2 remains difficult to define and achieve (Alagic et al., 2016, Gagliardoni, 2017). For quantum public-key primitives, whether qOWFs are truly minimal remains open, since weaker assumptions such as pseudorandom quantum states may suffice for some tasks (Barooti et al., 2023). For execution continuity, a full composability theory and integration with remote attestation stacks remain future work (Ünsal, 30 Dec 2025). For system-level QSC, scalable QKD, inter-jurisdiction crypto policy negotiation, and agent self-awareness of cryptographic posture remain active directions (Bishwas et al., 12 Mar 2026).

Taken together, these limitations sharpen rather than weaken the concept. QSC is not the claim that quantum security is automatic. It is the claim that quantum security must be encoded in the construction itself—through the security model, the primitive interface, the proof technique, and, increasingly, the system architecture.