---
title: Uncloneable Encryption (UE)
url: https://www.emergentmind.com/topics/uncloneable-encryption-ue
type: topic
---

# Uncloneable Encryption (UE)

Uncloneable Encryption (UE) is a quantum encryption primitive for **classical messages with quantum ciphertexts** whose defining guarantee is stronger than ordinary confidentiality: there should be no way for an eavesdropper to intercept a ciphertext, manipulate it, and distribute outputs to **two isolated parties** such that both can later decrypt successfully once the secret key is revealed. In this sense, UE turns the no-cloning theorem from a physical limitation into a cryptographic resource. The literature contains both spellings, **“uncloneable”** and **“unclonable,”** and treats UE as one branch of the broader program of uncloneable cryptography that also includes quantum money, copy protection, uncloneable signatures, and related primitives [2210.14265].

## 1. Core model and operational meaning

The modern formalization of UE is usually given as a **quantum encryption of classical messages (QECM)**. In one common syntax, a scheme is a triple \((\Gen,\Enc,\Dec)\), where \(\Gen(1^\lambda)\) outputs a classical secret key \(k\), \(\Enc(m,k)\) maps a classical bit or string \(m\) to a quantum ciphertext \(\rho\), and \(\Dec(\rho,k)\) recovers a classical message. What distinguishes UE is the **no-cloning game**: Alice samples \(m\) and \(k\), prepares \(\rho_{m,k}\), a pirate applies a CPTP map \(\Phi:\mathcal B(\mathcal H_A)\to\mathcal B(\mathcal H_B\otimes\mathcal H_C)\), and only after this splitting step do Bob and Charlie receive \(k\). They win if both output the original message, for example in the one-bit case if \(m=m_B=m_C\) [2410.23064].

A more general QECM formalism writes a scheme as
\[
Q=(K,X,A,\mu,\{\sigma_x^k\}_{k\in K,x\in X}),
\]
where \(K\) is the key space, \(X\) the message space, \(A\) the quantum ciphertext register, \(\mu\) the key distribution, and \(\sigma_x^k\) the ciphertext for message \(x\) under key \(k\). Against a cloning attack \(A\), the success probability is
\[
\mathfrak c(Q,A)=\int \frac1{|X|}\sum_{x\in X}\operatorname{Tr}\!\left[(B_x^k\otimes C_x^k)\Phi(\sigma_x^k)\right]\,d\mu(k),
\]
and \(\delta\)-uncloneable security means \(\mathfrak c(Q)\le \frac1{|X|}+\delta\). For a single-bit message, the ideal benchmark is therefore \(1/2\): no coordinated strategy should beat random guessing by more than a negligible or vanishing amount [2603.08916].

This operational viewpoint matters. UE is not merely “difficulty of copying a quantum state exactly.” It is a **cryptographic usability notion**: a single intercepted ciphertext should not be transformable into two separated systems that remain simultaneously useful for decryption after key release.

## 2. Security notions and formal distinctions

The UE literature distinguishes sharply between **search-style** and **indistinguishability-style** security. Earlier formulations asked that two non-communicating adversaries should not both recover the entire message \(m\). Later work emphasized that this is weaker than the natural decision problem: given an encryption of one of two chosen messages \(m_0,m_1\), both adversaries should not be able to determine which one was encrypted. In the corresponding unclonable IND-CPA game, a non-local adversary chooses \(m_0,m_1\), receives \(\Enc(k,m_b)\), splits it into \(\rho_{BC}\), and after both branches receive \(k\), wins iff \(b_B=b_C=b\). The target upper bound is the standard \(1/2+\negl(\lambda)\) [2207.06589].

For one-bit messages, the distinction collapses: if \(X=\{0,1\}\), then uncloneable security and uncloneable-indistinguishable security are equivalent. This equivalence is important because several recent breakthroughs prove existence only for the **uncloneable bit**, then appeal to prior transformations or surrounding theory to motivate longer-message UE [2603.08916].

The literature also distinguishes **standard** UE from nearby notions. The survey identifies **tamper-evident quantum encryption** as a weaker precursor, describes **quantum encryption with certified deletion** and **revocable quantum timed-release encryption** as functionally different primitives, and notes the dual notion of **uncloneable decryptors**, where the protected object is the decryption capability rather than the ciphertext [2210.14265].

## 3. Foundational constructions and oracle-based UE

The first major formal construction of UE appears in “Uncloneable Quantum Encryption via Oracles,” which introduced QECM syntax, defined \(t\)-uncloneable security, and gave a concrete scheme based on **Wiesner’s conjugate coding** plus a **quantum-secure pseudorandom function**. In its main construction, a message is encrypted as
\[
\ketbra{c}\otimes \ketbra{x^\theta},\qquad c=m\oplus f_\lambda(s,x),
\]
with key \((s,\theta)\). In the oracle analysis, the resulting success probability for general adversaries is bounded by \(9\cdot 2^{-n}+\mathrm{negl}(\lambda)\), and by \(2^{-n}+\mathrm{negl}(\lambda)\) against adversaries without shared entanglement [1903.00130].

A later advance established **unclonable indistinguishability** in the **quantum random oracle model**. That work used **coset states**, strengthened monogamy-style games in the QROM, and proved that the stronger indistinguishability notion is feasible there. It also proved a negative result for a broad class of reversible, deterministic schemes: any deterministic encryption scheme of the specified type admits a universal information-theoretic attack with success approaching \(0.568\), showing that unclonable indistinguishability cannot be obtained by a large class of too-simple pure-state encodings [2207.06589].

The most recent oracle-model development pushes beyond one-time UE. “Unclonable Encryption in the Haar Random Oracle Model” constructs a **private-key, reusable** UE scheme with **arbitrary polynomial message length** in the model where all parties can query \(U,U^\dagger,U^*,U^T\) for a Haar-random unitary \(U\). The paper positions this as the first evidence that reusable UE may exist in **microcrypt**, not only in settings suggestive of one-way functions, and identifies a new **unitary reprogramming lemma** as one of its central technical contributions [2603.11437].

## 4. Plain-model and unconditional developments

Progress in the plain model has followed several distinct routes. One route is computational and modular. “A Modular Approach to Unclonable Cryptography” proposes **unclonable puncturable obfuscation (UPO)** and derives, from generalized UPO, a **one-time unclonable bit-encryption scheme in the plain model**; via public-key single-decryptor encryption with the right challenge distribution and prior implications, it also gives a route to one-time UE more generally. The paper stresses that this is the first plain-model construction of UE in that line, but also that its candidate instantiation of UPO relies on strong assumptions, including post-quantum iO, post-quantum one-way functions, quantum hardness of LWE, and a new simultaneous inner product conjecture [2311.11890].

A second route is more explicitly conditional. “Towards Unclonable Cryptography in the Plain Model” proves a new **identical-basis monogamy-of-entanglement theorem** for subspace coset states and shows how it would feed into plain-model UE with unclonable indistinguishability. But the paper is explicit that this MoE ingredient is not sufficient on its own: it formulates conjectures about simultaneous compute-and-compare obfuscation in a non-local correlated setting, and the resulting plain-model UE theorems are conditional on those conjectures [2311.16663].

A third route relaxes the syntax of decryption. “Simultaneous Haar Indistinguishability with Applications to Unclonable Cryptography” gives the first **plain-model construction of unclonable encryption satisfying indistinguishability security, with quantum decryption keys**. The construction is one-time and for **1-bit messages**. Its key technical input is a theorem on **simultaneous Haar indistinguishability**, showing that non-communicating but entangled players cannot well distinguish the case where they receive the same Haar-random state from the case where they receive independent Haar-random states. The paper then combines this with a proved correlated simultaneous quantum Goldreich–Levin lemma and an underlying weak UE primitive [2405.10274].

The unconditional line focused first on the one-bit case. “Towards Unconditional Uncloneable Encryption” proposed a candidate **uncloneable bit** scheme based on pairwise anti-commuting Hermitian unitaries \(\Gamma_1,\dots,\Gamma_K\), with ciphertexts
\[
\rho_{m,k}=\frac{2}{d}\,\frac{I_d+(-1)^m\Gamma_k}{2}.
\]
It conjectured the optimal cheating probability
\[
\frac12+\frac{1}{2\sqrt K},
\]
proved this value for \(K=2,\dots,7\), matched it numerically up to \(K=17\) using level-2 NPA, and reported a level-2 upper bound of approximately \(0.5980\) at \(K=35\), described there as the best-known unconditional upper bound in the plain model at that time [2410.23064].

That conjectural phase was followed by a full existence result. “The uncloneable bit exists” proves unconditional one-bit UE with negligible error using a **Clifford \(2\)-design** construction. The scheme encrypts \(x\in\{0,1\}\) as \(U\sigma_xU^\dagger\), where
\[
\sigma_x=\frac{1}{2^{n-1}}\;|x\rangle\!\langle x|\otimes I
\]
and \(U\) is sampled from the \(n\)-qubit Clifford \(2\)-design. Its main theorem gives cloning probability
\[
\frac12+n^{16}\cdot 2^{-\,\frac n{120000}-8},
\]
establishing unconditional, exponentially small error for the uncloneable bit. The paper is explicit that this is a **single-bit** existential result rather than a full reusable arbitrary-length UE system [2603.08916].

## 5. Variants, dual notions, and functionality extensions

UE has developed into several distinct syntactic variants. The survey records that Broadbent–Lord gave symmetric-key definitions and constructions, while Ananth–Kaleoglu extended the notion to the **asymmetric/public-key setting** and showed that a strong UE variant implies a weak copy-protection form for point functions [2210.14265].

One important variant is **interactive UE**. “Uncloneable Cryptographic Primitives with Interaction” defines a **QECM with interactive decryption (QECM-ID)**, where Alice and Bob engage in a one-round decryption interaction and Eve may eavesdrop on the entire transcript. The security condition is
\[
\Pr[M=\check M\land F=1]_\rho \le \frac1{|M|}\Pr[F=1]_\rho+\varepsilon_2.
\]
The construction uses **subspace coset states**, a quantum-proof strong extractor, and a new **leaky monogamy-of-entanglement theorem** in which Charlie may see Bob’s answer before guessing. The resulting scheme is information-theoretically secure under a no-direct-communication assumption between Bob and Eve during decryption [2303.00048].

Another variant is **device-independent** UE with **variable decryption keys**. “Device-independent uncloneable encryption” introduces **VKECM**, where \(\mathsf{KeyRel}(\mathsf{priv})\) may output many different valid decryption keys for the same encryption, and Bob and Charlie receive independently generated keys. The construction is fully device-independent, information-theoretic, tolerates constant noise, and yields \((t(\lambda),g(\lambda))\)-style uncloneable security for this variant. The paper also shows that VKECM is sufficient for constructing private-key quantum money and that a simple modification yields device-independent single-decryptor encryption [2210.01058].

UE has also become entangled with richer functionality. “Unclonable Functional Encryption” defines **unclonable functional encryption (UFE)** and proves that a single-query QFE scheme for quantum messages and universal circuits, together with a one-bit UE primitive with quantum decryption keys, yields UFE. By taking the function to be the identity, the paper derives the **first public-key UE with variable decryption keys**, rather than standard fixed-key public-key UE [2410.06029].

## 6. Multi-copy, continuous-variable, and relaxed models

Most early work studied **single-copy** security, but recent work strengthens this considerably. “Multi-Copy Security in Unclonable Cryptography” introduces **multi-challenge** and **multi-copy** search-based UE. In the multi-challenge game, the adversary receives \(q\) independently generated ciphertexts of the same random message and must create \(q+1\) separated decryptors; in the multi-copy game it receives \(q\) exact copies of the same ciphertext state. The paper gives the first multi-challenge secure UE under any assumption, then the first standard **unbounded multi-copy secure UE** in the plain model, assuming polynomially secure iO and OWFs [2510.12626].

Continuous-variable realizations have also emerged. “Unclonable Encryption with Continuous Variables” gives the first **CV UE scheme** in the Broadbent–Lord cloning-game framework. The construction classically encrypts a message, encodes it with an error-correcting code, and maps each codeword bit to a squeezed coherent state whose displacement sign encodes the bit and whose \(q/p\) squeezing direction is part of the key. Correctness is analyzed via the bit error probability
\[
\beta=\frac12\,\mathrm{Erfc}\!\bigl(\alpha\sqrt{\cosh r}\bigr),
\]
and unclonability is proved by reducing the cloning game to a **CV monogamy-of-entanglement game** [2503.02648].

A more recent CV-inspired result targets the stronger indistinguishability notion. “Continuous-variable approximate unitary 2-design, with applications to unclonable encryption” constructs an \(\varepsilon\)-approximate unitary 2-design on a finite-dimensional discretization of a CV mode, with
\[
\varepsilon=\frac{1}{d^\ell},
\]
and uses it in a one-bit QECM template. The resulting security bound is
\[
\eta=\frac{3\log\log d}{2\log d}\sqrt{1+4d^{5-\ell}},
\]
which the paper presents as the first CV encryption construction with **unclonable-indistinguishable security**, albeit in a discretized/truncated model [2603.06393].

A different relaxation is **untelegraphable encryption (UTE)**, where the pirate is restricted to producing **classical information** rather than arbitrary quantum outputs. UTE is formally a special case of UE because measurement channels are a subclass of CPTP maps, but it is weaker at fixed receiver number. “Optimal Untelegraphable Encryption and Implications for Uncloneable Encryption” proves strong UTE constructions, shows that UTE and UE become asymptotically equivalent in a many-receiver regime, and derives stronger lower bounds for UE. In particular, it improves the general indistinguishability lower bound for UE from \(\frac12+\Omega(1/d)\) to
\[
\frac12+\Omega(1/\sqrt d).
\]
This suggests that UTE may be a useful intermediate theory for understanding plain-model indistinguishability of UE [2510.00903].

## 7. Scope, limitations, and open questions

The UE literature is now broad, but its results live in sharply different regimes. Some constructions are **one-time**, some are **reusable** only in oracle models, some are **search-based** rather than indistinguishability-based, some require **quantum decryption keys** or **interactive decryption**, and some prove only the **one-bit** case. The survey also notes that practical deployment of uncloneable cryptography generally presupposes **quantum ciphertexts** and, in many settings, long-term quantum memory or coherence, which remains a substantial implementation barrier [2210.14265].

Several major questions remain open. One is the status of **standard plain-model indistinguishability UE** in the most classical syntax, especially beyond one-bit or quantum-key relaxations. UTE work explicitly continues to describe plain-model indistinguishability for full UE as open, even while offering asymptotic bridges and lower bounds [2510.00903]. Another is whether the **microcrypt** evidence from the Haar random oracle model can be translated into standard assumptions or plain-model constructions; the Haar-oracle result is compelling but remains an oracle-world feasibility statement [2603.11437].

At the same time, the frontier has shifted. Unconditional one-bit UE with exponentially small error is now known to exist [2603.08916]. This suggests that the remaining difficulty is no longer the bare possibility of uncloneability, but the synthesis of several stronger desiderata at once: **arbitrary-length messages, reusable keys, standard classical-key syntax, composability, and plain-model indistinguishability security**.

Source: https://www.emergentmind.com/topics/uncloneable-encryption-ue