Uncloneable Encryption (UE)
- Uncloneable Encryption is a quantum encryption technique for classical messages that uses the no-cloning theorem to prevent dual decryption.
- It safeguards encrypted data by ensuring that intercepted ciphertexts cannot be split into two viable copies for independent decryption.
- UE constructions leverage quantum states, pseudorandom functions, and oracle models to achieve both one-time and reusable security guarantees.
Uncloneable Encryption (UE) is a quantum encryption primitive for classical messages with quantum ciphertexts whose defining guarantee is stronger than ordinary confidentiality: there should be no way for an eavesdropper to intercept a ciphertext, manipulate it, and distribute outputs to two isolated parties such that both can later decrypt successfully once the secret key is revealed. In this sense, UE turns the no-cloning theorem from a physical limitation into a cryptographic resource. The literature contains both spellings, “uncloneable” and “unclonable,” and treats UE as one branch of the broader program of uncloneable cryptography that also includes quantum money, copy protection, uncloneable signatures, and related primitives (Sattath, 2022).
1. Core model and operational meaning
The modern formalization of UE is usually given as a quantum encryption of classical messages (QECM). In one common syntax, a scheme is a triple $(\Gen,\Enc,\Dec)$, where $\Gen(1^\lambda)$ outputs a classical secret key , $\Enc(m,k)$ maps a classical bit or string to a quantum ciphertext , and $\Dec(\rho,k)$ recovers a classical message. What distinguishes UE is the no-cloning game: Alice samples and , prepares , a pirate applies a CPTP map $\Gen(1^\lambda)$0, and only after this splitting step do Bob and Charlie receive $\Gen(1^\lambda)$1. They win if both output the original message, for example in the one-bit case if $\Gen(1^\lambda)$2 (Botteron et al., 2024).
A more general QECM formalism writes a scheme as
$\Gen(1^\lambda)$3
where $\Gen(1^\lambda)$4 is the key space, $\Gen(1^\lambda)$5 the message space, $\Gen(1^\lambda)$6 the quantum ciphertext register, $\Gen(1^\lambda)$7 the key distribution, and $\Gen(1^\lambda)$8 the ciphertext for message $\Gen(1^\lambda)$9 under key 0. Against a cloning attack 1, the success probability is
2
and 3-uncloneable security means 4. For a single-bit message, the ideal benchmark is therefore 5: no coordinated strategy should beat random guessing by more than a negligible or vanishing amount (Bhattacharyya et al., 9 Mar 2026).
This operational viewpoint matters. UE is not merely “difficulty of copying a quantum state exactly.” It is a cryptographic usability notion: a single intercepted ciphertext should not be transformable into two separated systems that remain simultaneously useful for decryption after key release.
2. Security notions and formal distinctions
The UE literature distinguishes sharply between search-style and indistinguishability-style security. Earlier formulations asked that two non-communicating adversaries should not both recover the entire message 6. Later work emphasized that this is weaker than the natural decision problem: given an encryption of one of two chosen messages 7, both adversaries should not be able to determine which one was encrypted. In the corresponding unclonable IND-CPA game, a non-local adversary chooses 8, receives 9, splits it into $\Enc(m,k)$0, and after both branches receive $\Enc(m,k)$1, wins iff $\Enc(m,k)$2. The target upper bound is the standard $\Enc(m,k)$3 (Ananth et al., 2022).
For one-bit messages, the distinction collapses: if $\Enc(m,k)$4, then uncloneable security and uncloneable-indistinguishable security are equivalent. This equivalence is important because several recent breakthroughs prove existence only for the uncloneable bit, then appeal to prior transformations or surrounding theory to motivate longer-message UE (Bhattacharyya et al., 9 Mar 2026).
The literature also distinguishes standard UE from nearby notions. The survey identifies tamper-evident quantum encryption as a weaker precursor, describes quantum encryption with certified deletion and revocable quantum timed-release encryption as functionally different primitives, and notes the dual notion of uncloneable decryptors, where the protected object is the decryption capability rather than the ciphertext (Sattath, 2022).
3. Foundational constructions and oracle-based UE
The first major formal construction of UE appears in “Uncloneable Quantum Encryption via Oracles,” which introduced QECM syntax, defined $\Enc(m,k)$5-uncloneable security, and gave a concrete scheme based on Wiesner’s conjugate coding plus a quantum-secure pseudorandom function. In its main construction, a message is encrypted as
$\Enc(m,k)$6
with key $\Enc(m,k)$7. In the oracle analysis, the resulting success probability for general adversaries is bounded by $\Enc(m,k)$8, and by $\Enc(m,k)$9 against adversaries without shared entanglement (Broadbent et al., 2019).
A later advance established unclonable indistinguishability in the quantum random oracle model. That work used coset states, strengthened monogamy-style games in the QROM, and proved that the stronger indistinguishability notion is feasible there. It also proved a negative result for a broad class of reversible, deterministic schemes: any deterministic encryption scheme of the specified type admits a universal information-theoretic attack with success approaching 0, showing that unclonable indistinguishability cannot be obtained by a large class of too-simple pure-state encodings (Ananth et al., 2022).
The most recent oracle-model development pushes beyond one-time UE. “Unclonable Encryption in the Haar Random Oracle Model” constructs a private-key, reusable UE scheme with arbitrary polynomial message length in the model where all parties can query 1 for a Haar-random unitary 2. The paper positions this as the first evidence that reusable UE may exist in microcrypt, not only in settings suggestive of one-way functions, and identifies a new unitary reprogramming lemma as one of its central technical contributions (Bartusek et al., 12 Mar 2026).
4. Plain-model and unconditional developments
Progress in the plain model has followed several distinct routes. One route is computational and modular. “A Modular Approach to Unclonable Cryptography” proposes unclonable puncturable obfuscation (UPO) and derives, from generalized UPO, a one-time unclonable bit-encryption scheme in the plain model; via public-key single-decryptor encryption with the right challenge distribution and prior implications, it also gives a route to one-time UE more generally. The paper stresses that this is the first plain-model construction of UE in that line, but also that its candidate instantiation of UPO relies on strong assumptions, including post-quantum iO, post-quantum one-way functions, quantum hardness of LWE, and a new simultaneous inner product conjecture (Ananth et al., 2023).
A second route is more explicitly conditional. “Towards Unclonable Cryptography in the Plain Model” proves a new identical-basis monogamy-of-entanglement theorem for subspace coset states and shows how it would feed into plain-model UE with unclonable indistinguishability. But the paper is explicit that this MoE ingredient is not sufficient on its own: it formulates conjectures about simultaneous compute-and-compare obfuscation in a non-local correlated setting, and the resulting plain-model UE theorems are conditional on those conjectures (Chevalier et al., 2023).
A third route relaxes the syntax of decryption. “Simultaneous Haar Indistinguishability with Applications to Unclonable Cryptography” gives the first plain-model construction of unclonable encryption satisfying indistinguishability security, with quantum decryption keys. The construction is one-time and for 1-bit messages. Its key technical input is a theorem on simultaneous Haar indistinguishability, showing that non-communicating but entangled players cannot well distinguish the case where they receive the same Haar-random state from the case where they receive independent Haar-random states. The paper then combines this with a proved correlated simultaneous quantum Goldreich–Levin lemma and an underlying weak UE primitive (Ananth et al., 2024).
The unconditional line focused first on the one-bit case. “Towards Unconditional Uncloneable Encryption” proposed a candidate uncloneable bit scheme based on pairwise anti-commuting Hermitian unitaries 3, with ciphertexts
4
It conjectured the optimal cheating probability
5
proved this value for 6, matched it numerically up to 7 using level-2 NPA, and reported a level-2 upper bound of approximately 8 at 9, described there as the best-known unconditional upper bound in the plain model at that time (Botteron et al., 2024).
That conjectural phase was followed by a full existence result. “The uncloneable bit exists” proves unconditional one-bit UE with negligible error using a Clifford 0-design construction. The scheme encrypts 1 as 2, where
3
and 4 is sampled from the 5-qubit Clifford 6-design. Its main theorem gives cloning probability
7
establishing unconditional, exponentially small error for the uncloneable bit. The paper is explicit that this is a single-bit existential result rather than a full reusable arbitrary-length UE system (Bhattacharyya et al., 9 Mar 2026).
5. Variants, dual notions, and functionality extensions
UE has developed into several distinct syntactic variants. The survey records that Broadbent–Lord gave symmetric-key definitions and constructions, while Ananth–Kaleoglu extended the notion to the asymmetric/public-key setting and showed that a strong UE variant implies a weak copy-protection form for point functions (Sattath, 2022).
One important variant is interactive UE. “Uncloneable Cryptographic Primitives with Interaction” defines a QECM with interactive decryption (QECM-ID), where Alice and Bob engage in a one-round decryption interaction and Eve may eavesdrop on the entire transcript. The security condition is
8
The construction uses subspace coset states, a quantum-proof strong extractor, and a new leaky monogamy-of-entanglement theorem in which Charlie may see Bob’s answer before guessing. The resulting scheme is information-theoretically secure under a no-direct-communication assumption between Bob and Eve during decryption (Broadbent et al., 2023).
Another variant is device-independent UE with variable decryption keys. “Device-independent uncloneable encryption” introduces VKECM, where 9 may output many different valid decryption keys for the same encryption, and Bob and Charlie receive independently generated keys. The construction is fully device-independent, information-theoretic, tolerates constant noise, and yields $\Dec(\rho,k)$0-style uncloneable security for this variant. The paper also shows that VKECM is sufficient for constructing private-key quantum money and that a simple modification yields device-independent single-decryptor encryption (Kundu et al., 2022).
UE has also become entangled with richer functionality. “Unclonable Functional Encryption” defines unclonable functional encryption (UFE) and proves that a single-query QFE scheme for quantum messages and universal circuits, together with a one-bit UE primitive with quantum decryption keys, yields UFE. By taking the function to be the identity, the paper derives the first public-key UE with variable decryption keys, rather than standard fixed-key public-key UE (Mehta et al., 2024).
6. Multi-copy, continuous-variable, and relaxed models
Most early work studied single-copy security, but recent work strengthens this considerably. “Multi-Copy Security in Unclonable Cryptography” introduces multi-challenge and multi-copy search-based UE. In the multi-challenge game, the adversary receives $\Dec(\rho,k)$1 independently generated ciphertexts of the same random message and must create $\Dec(\rho,k)$2 separated decryptors; in the multi-copy game it receives $\Dec(\rho,k)$3 exact copies of the same ciphertext state. The paper gives the first multi-challenge secure UE under any assumption, then the first standard unbounded multi-copy secure UE in the plain model, assuming polynomially secure iO and OWFs (Çakan et al., 14 Oct 2025).
Continuous-variable realizations have also emerged. “Unclonable Encryption with Continuous Variables” gives the first CV UE scheme in the Broadbent–Lord cloning-game framework. The construction classically encrypts a message, encodes it with an error-correcting code, and maps each codeword bit to a squeezed coherent state whose displacement sign encodes the bit and whose $\Dec(\rho,k)$4 squeezing direction is part of the key. Correctness is analyzed via the bit error probability
$\Dec(\rho,k)$5
and unclonability is proved by reducing the cloning game to a CV monogamy-of-entanglement game (Ray et al., 4 Mar 2025).
A more recent CV-inspired result targets the stronger indistinguishability notion. “Continuous-variable approximate unitary 2-design, with applications to unclonable encryption” constructs an $\Dec(\rho,k)$6-approximate unitary 2-design on a finite-dimensional discretization of a CV mode, with
$\Dec(\rho,k)$7
and uses it in a one-bit QECM template. The resulting security bound is
$\Dec(\rho,k)$8
which the paper presents as the first CV encryption construction with unclonable-indistinguishable security, albeit in a discretized/truncated model (Ray et al., 6 Mar 2026).
A different relaxation is untelegraphable encryption (UTE), where the pirate is restricted to producing classical information rather than arbitrary quantum outputs. UTE is formally a special case of UE because measurement channels are a subclass of CPTP maps, but it is weaker at fixed receiver number. “Optimal Untelegraphable Encryption and Implications for Uncloneable Encryption” proves strong UTE constructions, shows that UTE and UE become asymptotically equivalent in a many-receiver regime, and derives stronger lower bounds for UE. In particular, it improves the general indistinguishability lower bound for UE from $\Dec(\rho,k)$9 to
0
This suggests that UTE may be a useful intermediate theory for understanding plain-model indistinguishability of UE (Broadbent et al., 1 Oct 2025).
7. Scope, limitations, and open questions
The UE literature is now broad, but its results live in sharply different regimes. Some constructions are one-time, some are reusable only in oracle models, some are search-based rather than indistinguishability-based, some require quantum decryption keys or interactive decryption, and some prove only the one-bit case. The survey also notes that practical deployment of uncloneable cryptography generally presupposes quantum ciphertexts and, in many settings, long-term quantum memory or coherence, which remains a substantial implementation barrier (Sattath, 2022).
Several major questions remain open. One is the status of standard plain-model indistinguishability UE in the most classical syntax, especially beyond one-bit or quantum-key relaxations. UTE work explicitly continues to describe plain-model indistinguishability for full UE as open, even while offering asymptotic bridges and lower bounds (Broadbent et al., 1 Oct 2025). Another is whether the microcrypt evidence from the Haar random oracle model can be translated into standard assumptions or plain-model constructions; the Haar-oracle result is compelling but remains an oracle-world feasibility statement (Bartusek et al., 12 Mar 2026).
At the same time, the frontier has shifted. Unconditional one-bit UE with exponentially small error is now known to exist (Bhattacharyya et al., 9 Mar 2026). This suggests that the remaining difficulty is no longer the bare possibility of uncloneability, but the synthesis of several stronger desiderata at once: arbitrary-length messages, reusable keys, standard classical-key syntax, composability, and plain-model indistinguishability security.