---
title: Quantum-Secure-By-Construction (QSC)
url: https://www.emergentmind.com/topics/quantum-secure-by-construction-qsc
type: topic
---

# Quantum-Secure-By-Construction (QSC)

Searching arXiv for the provided QSC-related papers and recent context.
arXiv search query: "Quantum-Secure-By-Construction OR qIND qCPA quantum-secure PRP QEnclave"
Using the arXiv search tool now.
Quantum-Secure-By-Construction (QSC) denotes a design orientation in which quantum security is treated as an intrinsic architectural property of a cryptographic primitive, protocol, or system rather than as a retrofit added after deployment. Across the literature, the term is used both narrowly, to describe information-theoretically or computationally secure primitives whose security definitions and proofs already quantify over quantum adversaries, and broadly, to describe system architectures in which post-quantum cryptography (PQC), quantum random number generation (QRNG), quantum key distribution (QKD), or stateful quantum mechanisms are integrated into the control plane and data plane from the outset [1005.0512; 2603.15668]. In this sense, QSC is less a single construction than a family of design patterns: classical algebraic extractors proved secure against entangled quantum storage [1005.0512], quantum public-key encryption from quantum-secure one-way functions [2303.01143], superposition-secure pseudorandom permutations from minimal assumptions [1611.05564], composable blind delegated computation via a minimal trusted quantum functionality [2109.02952], and execution-continuity mechanisms grounded in stateful quantum evolution [2601.00870].

## 1. Conceptual scope and formal orientations

The term “Quantum-Secure-By-Construction” is used explicitly in recent systems work as “a design paradigm that treats quantum secure communication as a core architectural property of agentic AI systems rather than an upgrade added later” [2603.15668]. A closely aligned, earlier cryptographic usage appears in work on two-source extractors secure against quantum adversaries, where a seedless extractor with information-theoretic guarantees against bounded quantum storage is presented as a natural “by-construction” quantum-secure primitive [1005.0512]. This suggests that QSC has two distinct but connected meanings.

The first meaning is primitive-centric. A primitive is QSC when its security claim is stated directly against quantum adversaries, quantum side information, or superposition access, and when the proof relies on structural properties rather than on an argument that a classical proof “should still work.” This includes, for example, two-source extractors secure against entangled bounded storage [1005.0512], quantum-secure pseudorandom permutations secure against superposition queries to both permutation and inverse [1611.05564], and encryption notions for quantum data defined natively with QPT adversaries and CPTP maps [1602.01441].

The second meaning is system-centric. A system is QSC when security posture is embedded into orchestration, identity, session bootstrap, memory access, audit, and inter-component communication. In that broader sense, QSC is realized as a runtime-adaptive and policy-guided cryptographic stack that composes PQC, QRNG, and QKD across a distributed system graph [2603.15668]. A plausible implication is that the system-level meaning generalizes the primitive-level meaning: primitives are selected or composed so that the resulting architecture preserves quantum security properties under deployment constraints.

A further conceptual distinction concerns the security domain. A systematic classification of “quantum security” separates scenarios into QS1, where schemes are classical but must resist QPT adversaries; QS2, where classical primitives must also withstand superposition oracle access; and QS3, where schemes operate natively on quantum data and quantum infrastructure [1705.02417]. QSC appears across all three domains. In QS1, it requires quantum-sound reductions and quantum-hard assumptions. In QS2, it requires security under superposition access, as in qPRF/qPRP-based constructions [1611.05564; 1504.05255]. In QS3, it requires quantum-native definitions and constructions, such as QIND-secure encryption of quantum data [1602.01441].

## 2. Primitive-level QSC: extractors, encryption, and permutations

A recurring QSC pattern is the reuse of a simple classical construction together with a proof that it remains secure in the presence of quantum side information. The clearest example is the inner-product-based two-source extractor of Chor and Goldreich and its DEOR multi-bit variant. In the bounded-quantum-storage setting, the extractor is required to satisfy
\[
\big\|\rho_{\mathrm{Ext}(X,Y)E_1E_2} - U_m \otimes \rho_{E_1E_2}\big\|_{\mathrm{tr} \le \varepsilon,
\]
even when the adversaries share prior entanglement [1005.0512]. The paper proves that the DEOR extractor is secure against both non-entangled and entangled bounded storage with parameters close to the classical case, while the one-bit inner-product threshold is tight up to additive constants [1005.0512]. The central QSC feature is not merely quantum robustness, but robustness derived from the algebraic form of the extractor and from communication-complexity lower bounds, rather than from computational assumptions.

A second primitive-level pattern is minimal-assumption public-key encryption in the quantum setting. A construction of quantum public-key encryption with classical ciphertexts is shown from quantum-secure one-way functions via quantum-secure PRFs [2303.01143]. The public key is a pure quantum state
\[
\ket{pk} = \ket{pk_0}\otimes \ket{pk_1},
\]
where each component is a superposition over a PRF graph; encryption measures one branch in the computational basis, and decryption is purely classical [2303.01143]. The scheme satisfies a quantum CCA security notion in which the adversary is QPT, receives polynomially many copies of the quantum public key, and has classical access to the decryption oracle [2303.01143]. Here the QSC claim is explicit: strong public-key functionality follows from the sole assumption that quantum-secure one-way functions exist.

A third pattern is the reduction of strong quantum-query symmetric primitives to weak assumptions. Quantum-secure PRPs are defined against adversaries that can query the permutation and its inverse on quantum superpositions [1611.05564]. The construction factors the problem into a quantum-secure PRF and a function-to-permutation converter. Combined with Zhandry’s result that qPRFs exist from quantum-secure one-way functions, this yields \((\mathsf{Q},\mathsf{Q},\mathsf{S})\)-PRPs from quantum-secure one-way functions [1611.05564]. This is significant for QSC because it provides a block-cipher-like primitive secure in the strongest standard superposition-query model while keeping the assumption base minimal.

A related but more restrictive lesson comes from superposition-secure indistinguishability for classical encryption. Strong notions such as qIND-qCPA are achievable, but not by quasi-length-preserving schemes: the paper proves that quasi-length-preserving secret-key encryption cannot be qIND secure [1504.05255]. It then gives a positive construction based on a quantum-secure PRP applied to message-plus-randomness blocks, yielding qIND-qCPA security and the corresponding semantic notion [1504.05255]. This suggests that QSC may require structural redesign even when a scheme is already secure in weaker post-quantum senses.

The same structural theme appears in encryption of quantum data. Computational security notions for quantum plaintexts are developed with QPT adversaries and CPTP encryption and decryption maps, and semantic security is shown equivalent to indistinguishability in direct analogy with Goldwasser–Micali [1602.01441]. From quantum-secure one-way functions one obtains IND-CCA1-secure symmetric-key quantum encryption, and from quantum-secure trapdoor one-way permutations one obtains semantically secure public-key quantum encryption [1602.01441]. In QSC terms, the point is not only that the primitives are quantum-safe, but that the definitions, the adversary model, and the reductions are all quantum-native.

## 3. Security models that make QSC meaningful

QSC claims depend on the choice of adversarial interface. Several of the cited works show that changing the interface from classical to quantum can radically change what is achievable.

For weak randomness extraction, the relevant interface is quantum side information. In the bounded-storage model, each adversary receives one source, may share prior entanglement, applies an arbitrary CPTP map conditioned on the observed source value, and keeps only \(b_1\) or \(b_2\) qubits [1005.0512]. The key subtlety is that classical independence of \(X\) and \(Y\) does not imply a product structure for the adversaries’ joint state after entangled preprocessing. QSC is meaningful here precisely because the model explicitly includes entanglement and bounded final quantum memory.

For symmetric primitives, the distinction between post-quantum and superposition security is essential. In QS1, a classical scheme is secure against QPT adversaries with classical oracle access. In QS2, any adversary-visible oracle is modeled as a quantum oracle, so superposition access becomes part of the definition [1705.02417]. The qIND framework for symmetric encryption and the qPRP framework for permutations both belong to this stronger domain [1504.05255; 1611.05564]. A plausible implication is that many “post-quantum secure” schemes are not QSC in the stronger QS2 sense unless they were designed for superposition access.

For public-key encryption with quantum public keys, the interface includes polynomially many copies of a pure quantum public key and a classical decryption oracle [2303.01143]. The restriction to pure public keys is deliberate and rules out trivial encodings of secret-key functionality as mixed-state public keys [2303.01143]. Here QSC requires that both the syntactic object and the security game be native to the quantum model.

For quantum cloud computation, the interface is captured compositionally as an ideal resource. QEnclave is modeled through Remote State Rotation, a functionality that rotates a server-provided qubit by \(Z(\theta)\) for uniformly random \(\theta\in \mathcal{Z}_\pi\), outputs the rotated state to the server, and the angle to the client [2109.02952]. The paper proves in the Abstract Cryptography framework that this suffices to construct measurement-based remote state preparation and then blind delegated quantum computation with perfect blindness [2109.02952]. In this case QSC means that the final security guarantee is inherited compositionally from a small trusted functionality rather than argued monolithically at the application level.

For execution continuity, the interface is neither encryption nor key exchange but temporal evidence. The Quantum State Continuity Problem asks whether a system can produce evidence that binds present behavior to a single past execution history [2601.00870]. The QSCP security game declares an adversary successful if two forked branches from a common past both pass all \(W\) audited rounds [2601.00870]. The associated QSCW primitive is stateful, challenge-dependent, and cumulative; valid evidence at time \(t\) depends on the prior internal state [2601.00870]. This broadens QSC beyond confidentiality and authenticity toward temporal integrity.

## 4. Structural techniques underlying QSC constructions

Although the cited papers span extractors, encryption, cloud delegation, and execution continuity, several proof patterns recur.

One pattern is reduction to fundamental information-theoretic or communication-theoretic limits. In the extractor setting, attacks on the inner product can be modeled as simultaneous-message-passing protocols, so lower bounds on quantum communication complexity imply limits on adversarial prediction bias [1005.0512]. In the continuity setting, no-cloning and measurement disturbance are turned into a temporal audit mechanism: after a fork, two branches cannot both preserve the required state trajectory except with rapidly decreasing probability [2601.00870]. In both cases QSC arises because the security argument leverages constraints imposed by quantum mechanics itself.

A second pattern is modularity through strong intermediate resources. The DEOR extractor is first shown X-strong or Y-strong via a quantum XOR lemma and then composed with a seeded extractor secure against quantum side information to increase output length [1005.0512]. QEnclave follows the same architectural logic at the systems level: Remote State Rotation constructs measurement-based remote state preparation, which in turn constructs blind delegated quantum computation [2109.02952]. The recent agentic-systems formulation of QSC makes this modularity explicit through link-specific posture selection among \(\textsf{PQC}\), \(\textsf{PQC+QRNG}\), and \(\textsf{QKD+PQC+QRNG}\) [2603.15668].

A third pattern is black-box use of a quantum-secure primitive as a key generator or control layer. The quantum-secure non-malleable randomness encoder is a representative example. A 2-split rate-\(1/2\) quantum-secure NMRE is built from a quantum-secure two-source non-malleable extractor and then used in a black-box manner to obtain a rate \(1/11\), 3-split quantum non-malleable code, a rate \(1/3\), 3-split quantum secure non-malleable code, and a rate \(1/5\), 2-split average-case quantum secure non-malleable code [2308.07340]. The same paper explicitly frames this as an instance of a modular “quantum-secure-by-construction” methodology [2308.07340]. This suggests that QSC often relies on a protected randomness or control sublayer whose guarantee is then lifted through composition.

A fourth pattern is explicit treatment of otherwise hidden assumptions. The finite-key HOQS+ system treats the instruction sequence as information-theoretically protected by a pre-shared key and separates its secrecy from the secrecy of QKD and PQC-derived keys [2512.04429]. Even if QKD and PQC keys are compromised via side channels, confidentiality is argued to persist because the attacker still lacks the protected control sequence that determines the hybrid-encryption configuration [2512.04429]. This suggests that QSC system design often depends on identifying a small, high-assurance root of trust and making it structurally independent of the rest of the stack.

## 5. System-level QSC: orchestration, lifecycle security, and composability

The most explicit system formulation of QSC models an agentic AI deployment as a directed graph
\[
\mathcal{S} = (\mathcal{V}, \mathcal{E}),
\]
with client \(C\), orchestrator \(O\), and agents \(\mathcal{A}=\{A_1,\dots,A_n\}\) [2603.15668]. For each link \((u,v)\in\mathcal{E}\), the system selects a cryptographic posture
\[
\Pi = \{\textsf{PQC},\ \textsf{PQC{+}QRNG},\ \textsf{QKD{+}PQC{+}QRNG}\}
\]
by optimizing a weighted combination of security, latency, and cost subject to compliance constraints [2603.15668]. Session keys are derived from whichever of QKD, PQC, and QRNG are available:
\[
K_{u,v} = \textsf{HKDF}\Big( \mathbf{1}[K^{\mathrm{qkd}}_{u,v} \neq \bot]\cdot K^{\mathrm{qkd}}_{u,v} \ \Vert\ K^{\mathrm{pqc}}_{u,v} \ \Vert\ r_{u,v} \Big)
\]
[2603.15668]. The defining QSC move is that the cryptographic choice is elevated to an orchestration problem spanning bootstrap, task execution, inter-agent communication, memory access, and audit.

A closely related systems pattern appears in HOQS+, where a hybrid QKD–PQC architecture is controlled by an information-theoretically secure instruction sequence distributed under a pre-shared key [2512.04429]. The system combines BBM92 with tight finite-key security, Kyber KEM, and Ascon-based hybrid encryption, while the instruction sequence determines the actual encryption configuration [2512.04429]. The novelty in QSC terms is that confidentiality is not attached to any single primitive. Rather, the architecture is arranged so that even when QKD and PQC keys leak via side channels, the message remains protected because the small control sequence remains information-theoretically hidden [2512.04429].

QEnclave illustrates a different compositional systems approach. The client is fully classical, the server is untrusted, and the only trusted quantum component is a minimal enclave capable of single-qubit rotations [2109.02952]. By modeling the enclave as the Remote State Rotation resource and proving exact constructions in the Abstract Cryptography framework, the paper obtains blind delegated quantum computation with perfect blindness [2109.02952]. This is a stringent form of QSC: the application-level guarantee is a direct consequence of ideal-resource composition.

These system-level approaches share a common feature: the security property is made persistent across the lifecycle of the system. It is not limited to a handshake or a transport layer. The agentic formulation explicitly secures session bootstrap, task DAG assignment, tool invocation, memory, and audit [2603.15668]. The execution-continuity formulation explicitly distinguishes identity from continuity and enforces the latter across rounds of a stateful interaction [2601.00870]. This suggests that QSC, at system scale, is best understood as lifecycle-integrated cryptographic design.

## 6. Limits, controversies, and open problems

A notable limitation of the QSC label is that it spans several non-equivalent threat models. In bounded-storage extraction, “by construction” means information-theoretic security against entangled bounded storage [1005.0512]. In quantum public-key encryption, it means computational security from qOWFs against QPT adversaries [2303.01143]. In agentic systems, it means runtime orchestration of heterogeneous primitives under policy [2603.15668]. These are compatible uses, but they are not interchangeable. A plausible implication is that QSC should always be read relative to a precise adversarial interface.

Another controversy concerns how strong the model should be. For two-source extraction, the entangled guessing-entropy model is too strong for inner-product-based extractors: the paper shows that no inner-product extractor can be secure there [1005.0512]. For symmetric encryption, fully quantum indistinguishability with unrestricted challenge structure is impossible for large classes of quasi-length-preserving schemes [1504.05255]. For QSCW, the paper explicitly notes that an ideal coherent adversary maintaining perfect quantum coherence across branches may invalidate the continuity construction [2601.00870]. These examples show that “quantum-secure” is not monotone in the obvious sense; overly strong definitions can trivialize the problem.

Efficiency is another limitation. The qPRP construction from qOWFs via qPRFs and function-to-permutation converters is primarily an existence result, not a practical block cipher replacement [1611.05564]. Constant-rate quantum-secure non-malleable codes are achieved, but the rates remain well below the best classical split-state upper bounds [2308.07340]. HOQS+ improves scalability and integrates the tightest finite-key BBM92 analysis in its setting, but its QKD component still depends on realistic key-rate and infrastructure constraints [2512.04429]. QEnclave reduces client requirements dramatically, yet still relies on a trusted enclave and does not provide verifiability, only blindness [2109.02952].

Open problems recur across the literature. For extractors, exact matching of classical multi-bit parameters in the non-entangled quantum setting remains open, as does quantum security of more advanced two-source constructions such as Bourgain’s and Raz’s [1005.0512]. For symmetric encryption, quantum CCA2 remains difficult to define and achieve [1602.01441; 1705.02417]. For quantum public-key primitives, whether qOWFs are truly minimal remains open, since weaker assumptions such as pseudorandom quantum states may suffice for some tasks [2303.01143]. For execution continuity, a full composability theory and integration with remote attestation stacks remain future work [2601.00870]. For system-level QSC, scalable QKD, inter-jurisdiction crypto policy negotiation, and agent self-awareness of cryptographic posture remain active directions [2603.15668].

Taken together, these limitations sharpen rather than weaken the concept. QSC is not the claim that quantum security is automatic. It is the claim that quantum security must be encoded in the construction itself—through the security model, the primitive interface, the proof technique, and, increasingly, the system architecture.

Source: https://www.emergentmind.com/topics/quantum-secure-by-construction-qsc