---
title: Untelegraphable Encryption (UTE)
url: https://www.emergentmind.com/topics/untelegraphable-encryption-ute
type: topic
---

# Untelegraphable Encryption (UTE)

Searching arXiv for recent and foundational papers on untelegraphable encryption and closely related unclonable encryption.
Untelegraphable encryption (UTE) denotes a quantum cryptographic primitive in which a ciphertext cannot be converted by an adversary into classical information that later suffices for decryption once the secret key is revealed. In its modern form, UTE is a relaxation of unclonable encryption (UE): the adversary still receives a quantum ciphertext, but its first-stage output is restricted to classical information rather than arbitrary quantum side information [2410.24189, 2510.00903]. The term has also had earlier and less stable usage. It appeared informally in the 2010 “Peacock Encryption” proposal as an “anti-search-engine” intermediary-safe exchange idea [1001.1844], and some later UE papers used “untelegraphable encryption” as a synonym or near-synonym for uncloneable encryption [1903.00130]. Current work treats UTE as a distinct no-telegraphing primitive with information-theoretic constructions, multi-ciphertext and collusion-resistant extensions, everlasting variants, and applications to shadow tomography, secret sharing, and functional encryption [2410.24189, 2510.00903].

## 1. Origins, terminology, and conceptual shift

The earliest usage in the supplied literature is the “Peacock Encryption Method,” which presented UTE informally as a preliminary “anti-search-engine” protocol. In that setting, a middleman matches identical one-way transformations of a shared keyword, yet is not supposed to learn the keyword, the plaintext, or ideally even who is communicating with whom. The mechanism is centered on a searchable token \(X = H_k(K)\) and an attached reversible ciphertext \(C = E_K(\text{Eve's name})\), published together as a “feather” \((X,C)\) [1001.1844]. This proposal did not supply a modern security model and explicitly acknowledged that its reliance on “encryption through a one-way function” was controversial.

A different line emerged in quantum cryptography. “Uncloneable Quantum Encryption via Oracles” formalized encryption of classical messages into quantum ciphertexts such that two isolated adversaries cannot both recover the message after the key is revealed, and it explicitly described this functionality as uncloneable encryption, also called untelegraphable encryption [1903.00130]. In that usage, the emphasis was no-cloning rather than no-telegraphing.

The modern distinction was made explicit in “Untelegraphable Encryption and its Applications,” which stated that UTE is a relaxation of UE founded on the no-telegraphing principle and motivated by the computational separation between no-cloning and no-telegraphing due to Nehoran and Zhandry. The central idea is that quantum information should not be “telegraphed” into a classical string that later enables decryption [2410.24189]. “Optimal Untelegraphable Encryption and Implications for Uncloneable Encryption” sharpened this by treating UTE as a special case of UE in which the pirate adversary is restricted to producing purely classical information rather than arbitrary quantum states [2510.00903]. This terminological stabilization matters because older papers sometimes used UTE to mean UE, whereas the contemporary literature typically reserves UTE for the classical-output restriction.

## 2. Formal models and security notions

A standard modern syntax is untelegraphable secret-key encryption, written
\[
\Pi_{\mathrm{UTE}}=(\mathsf{Gen},\mathsf{Enc},\mathsf{Dec}),
\]
with
\[
\mathsf{Gen}(1^\lambda)\to sk,\qquad \mathsf{Enc}(sk,m)\to |ct\rangle,\qquad \mathsf{Dec}(sk,|ct\rangle)\to m.
\]
Correctness is the usual decryption guarantee with negligible error [2410.24189].

The defining asymmetry of UTE appears in the two-stage security games. In the one-way game, the first-stage adversary \(A\) receives the quantum ciphertext and outputs a classical string \(st\); only then does the second-stage adversary \(B\) receive the secret key and attempt to recover the message. Security requires
\[
\Pr[m_g=m]=\mathsf{negl}(\lambda)
\]
for all efficient \((A,B)\). In the indistinguishability game, \(A\) chooses \(m_0,m_1\), receives an encryption of \(m_b\), outputs a classical \(st\), and \(B\), after receiving the key, tries to guess \(b\). The requirement is
\[
\left|\Pr[b'=1\mid b=0]-\Pr[b'=1\mid b=1]\right|=\mathsf{negl}(\lambda).
\]
The same work also defines collusion-resistant UTE, where the first stage may make many adaptive challenge queries but still produces a single classical string, and everlasting security, where the first stage remains efficient but the second stage may be unbounded [2410.24189].

A more representation-theoretic formalism models UTE through a quantum encryption of classical messages
\[
\ttt Q=(M,K,\pi,H,\{\sigma_m^k\}_{k\in K,m\in M}),
\]
where \(M\) is the message set, \(K\) the key space with distribution \(\pi\), \(H\) the ciphertext Hilbert space, and \(\sigma_m^k\) the ciphertext state. Correctness requires a key-dependent measurement \(\{P_m^k\}_{m\in M}\) such that
\[
\int_K \mathrm{Tr}(P_m^k\sigma_m^k)\,d\pi(k)\ge 1-\varepsilon.
\]
Within this framework, a telegraphing attack is a \(1\)-to-\(1\) cloning attack whose channel is quantum-to-classical; equivalently, the attack may be viewed through the class \(\mathscr M\) of measurement channels, and the paper also notes an equivalent entanglement-breaking formulation for the telegraphing setting. The resulting untelegraphable-indistinguishability value is
\[
\mathfrak c^2_{1\to 1}(\ttt Q\mid \mathscr M),
\]
and \(\ttt Q\) is \(\varepsilon\)-untelegraphable-indistinguishable secure if
\[
\mathfrak c^2_{1\to 1}(\ttt Q\mid \mathscr M)\le \frac12+\varepsilon.
\]
This formalism makes precise that UTE does not merely hide a message from immediate measurement; it prevents compression of the relevant quantum information into a classical transcript that remains useful after key exposure [2510.00903].

## 3. Canonical constructions and provable security

A central unconditional construction is the Haar-measure encryption scheme. For an \(n\)-message space and ciphertext dimension \(d=rn\), the key is a Haar-random unitary \(U\in\mathcal U(d)\), and encryption is
\[
\Enc(m,U)=U\left(\ketbra{m}{m}\otimes I_{d/n}\right)U^*.
\]
Equivalently, in the rank-\(r\) formulation,
\[
\sigma_m=\frac1r\ketbra{m}\otimes I_r.
\]
Decryption applies \(U^*\) and measures the message register. For the one-bit case, the scheme satisfies
\[
\mathfrak c^2_{1\to 1}(\ttt Q\mid\mathscr M)\le \frac12+\frac{1}{2\sqrt{d+1}}.
\]
For \(n\) messages and \(t\) input copies, it satisfies
\[
\mathfrak c^2_{t\to 1}(\ttt Q_{r,n}\mid\mathscr M)\le \frac12+\frac{7t}{\sqrt r},
\]
and in the adaptive collusion game,
\[
\mathfrak t(\ttt Q_{r,n}\mid \ttt A)\le \frac12+7\frac{Q}{\sqrt r}.
\]
The same paper states that the Haar scheme can be made efficient by replacing Haar randomness with a sufficiently good unitary design, specifically that \(t\)-copy UTE needs a \(2t\)-design [2510.00903].

A separate plain-model line begins from one-way UTE. Construction 3.8 in “Untelegraphable Encryption and its Applications” combines a statistically one-way secure UTE with a universal hash family. The secret key is
\[
sk=(sk_{\mathrm{ow}},h,r),
\]
with \(sk_{\mathrm{ow}}\leftarrow \mathsf{OWUTE.Gen}(1^\lambda)\), \(h\leftarrow\mathcal H\), and \(r\leftarrow\{0,1\}\). To encrypt \(m\in\{0,1\}\), one samples \(x\leftarrow\mathcal M_\lambda\), computes \(|ct_{\mathrm{ow}}\rangle\leftarrow \mathsf{OWUTE.Enc}(sk_{\mathrm{ow}},x)\), and outputs
\[
|ct\rangle=\big(|ct_{\mathrm{ow}}\rangle,\ r\oplus h(x)\oplus m\big).
\]
If the underlying OWUTE is statistically one-way secure, Theorem 3.10 states that the resulting construction is statistically indistinguishable secure [2410.24189].

The same paper then gives a collusion-resistant construction from one-time UTE and secret-key non-committing encryption. Construction 3.15 samples a fresh one-time UTE key \(sk_{1\mathrm{UTE}}\), encrypts the message under one-time UTE, encrypts \(sk_{1\mathrm{UTE}}\) under non-committing encryption, and outputs the pair
\[
|ct\rangle=(|ct_{1\mathrm{UTE}}\rangle,ct_{\mathrm{NCE}}).
\]
Theorem 3.17 states that if the one-time UTE has indistinguishability security and the non-committing encryption is secure against QPT adversaries, then the result is collusion-resistant UTE [2410.24189].

Everlasting security appears in two forms in the supplied literature. In the QROM construction of [2410.24189], the ciphertext has the form
\[
|ct\rangle=\big(|ct_{1\mathrm{UTE}}\rangle,\ ct_{\mathrm{SKE}},\ H(r)\oplus sk_{1\mathrm{UTE}}\big),
\]
where a CPA-secure SKE encryption hides \(r\) online and the one-time UTE key is masked through the random oracle. Theorem 5.3 states that if \(\Pi_{1\mathrm{UTE}}\) is statistically indistinguishable secure and \(\Pi_{\mathrm{SKE}}\) is CPA secure, then the construction is everlasting collusion-resistant UTE in the QROM. In [2510.00903], everlasting collusion-resistant UTE is obtained for the unbounded case under pseudorandom unitaries by transferring the Haar-based security proof computationally.

## 4. Relation to unclonable encryption and the broader UE landscape

The basic distinction between UE and UTE is structural. In UE, a pirate may transform the ciphertext into multiple quantum systems and later multiple receivers try to decrypt after key revelation. In UTE, the pirate is forced to collapse the relevant information to a classical transcript before the key is released [2510.00903]. This makes UTE strictly weaker as a notion, but also more tractable. “Untelegraphable Encryption and its Applications” states the separation directly: UTE is a strict relaxation of UE, and UTE security does not automatically imply UE security [2410.24189].

The historical UE construction in [1903.00130] already explains why quantum mechanics is essential. If ciphertexts are classical, then adversaries can copy them perfectly and both decrypt after learning the key; meaningful uncloneability is therefore impossible classically. This impossibility intuition also clarifies the UTE setting: the substantive resource is not mere secrecy, but the inability to convert certain quantum information into reusable classical form.

Recent work has connected the two notions quantitatively. For any QECM \(\ttt Q\), if \(s\) is the number of UE receivers, then
\[
\mathfrak c^N_{1\to s}(\ttt Q)\le \mathfrak c^N_{1\to 1}(\ttt Q\mid\mathscr M)+3\eta d\left(\frac{\log d}{N^2s}\right)^{1/3},
\]
where \(\eta\) bounds the average operator norm of the ciphertexts. Hence
\[
\lim_{s\to\infty}\mathfrak c^N_{1\to s}(\ttt Q)=\mathfrak c^N_{1\to 1}(\ttt Q\mid\mathscr M),
\]
with convergence rate \(\mathcal O(s^{-1/3})\). In this precise sense, UTE arises as a limit of UE when the number of receivers grows [2510.00903].

The same paper also derives lower bounds for UTE that immediately imply new lower bounds for UE. In particular, for any correct QECM with ciphertext dimension \(d\),
\[
\mathfrak c^N_{1\to 1}(\ttt Q\mid\mathscr M)\ge \frac1N+\Omega\!\left(\frac1{\sqrt d}\right),
\]
improving the previous known UE lower bound
\[
\frac1N+\Omega\!\left(\frac1d\right).
\]
This suggests that UTE is not merely a relaxation convenient for constructions; it is also a tool for deriving structural limits on UE [2510.00903].

That perspective is reinforced by later UE work. “A Note on Boosting Uncloneable Encryption in Microcrypt” states that if a \(t\to t'\) uncloneable bit exists, then reusable symmetric-key encryption suffices to obtain many-time secure \(t\to t'\) uncloneable encryption for arbitrary-length messages, and pseudorandom unitaries suffice to upgrade to identical-copy security [2605.27647]. “Unclonable Encryption in the Haar Random Oracle Model” gives a reusable many-time UE scheme with unclonable indistinguishability in the Haar random oracle model, supports arbitrary-length messages, and positions the result as evidence that reusable UE may exist in “microcrypt” even when one-way functions do not [2603.11437]. A plausible implication is that modern UTE serves both as a standalone primitive and as an intermediate technical layer in the search for plain-model indistinguishability-secure UE.

## 5. Applications, separations, and derived primitives

One of the most prominent applications of UTE is to impossibility results for hyper-efficient shadow tomography. Definition 3.7 of [2410.24189] considers a procedure that, given copies of an unknown state \(\rho\), outputs a classical circuit \(C\) approximating \(\Pr[E(i,\rho)=1]\) for a large family of measurements. Theorem 3.25 states that if such hyper-efficient tomography exists for all mixed states, then there is no correct \(k\)-copy secure UTE. The reduction interprets a UTE ciphertext as the unknown state and sets
\[
E(dk,|ct\rangle):=\mathsf{Dec}(dk,|ct\rangle).
\]
If tomography produced a sufficiently accurate classical circuit, then key revelation would let the adversary evaluate \(C(dk)\) and recover the hidden message, contradicting UTE. The paper further states Corollary 3.38: assuming pseudorandom state generators, hyper-efficient shadow tomography for all mixed states does not exist [2410.24189].

The same work gives a separation between UTE and UE in the classical oracle model. Using a one-shot MAC primitive, it constructs an indistinguishability-secure UTE scheme in which there is an explicit attack that breaks one-way unclonable security for an unbounded polynomial number of second-stage adversaries. Corollary 4.8 states that, under quasi-polynomial LWE in the classical oracle model, there exists indistinguishability-secure UTE that is not one-way unclonable secure for any unbounded polynomial number of second-stage adversaries [2410.24189]. This is one of the clearest formal demonstrations that no-telegraphing and no-cloning are distinct security requirements.

UTE has also been used to build higher-level primitives. The same paper defines untelegraphable secret sharing, in which first-stage adversaries associated with non-qualified groups output only classical strings before a second-stage adversary receives honest shares from a qualified group. Construction 6.4 combines classical secret sharing with collusion-resistant UTE, and Theorem 6.6 states that if the classical scheme is secure and UTE is collusion-resistant secure, then the resulting UTSS is untelegraphable secure; Corollary 6.9 states existence for all polynomial-size monotone Boolean circuits assuming post-quantum one-way functions [2410.24189].

Functional encryption variants are treated similarly. The paper defines untelegraphable secret-key functional encryption and untelegraphable public-key functional encryption, constructs the secret-key version from FE with untelegraphable keys and adaptively secure SKFE, and constructs the public-key version by combining untelegraphable SKFE, standard PKFE, CPA-secure SKE, and a PRF. Theorem 7.16 states that if PKFE is adaptively secure, the PRF is secure, SKE is CPA secure, and UTSKFE is secure, then the resulting UTPKFE is secure; Corollary 7.21 states existence of untelegraphable PKFE for \(P/\mathrm{poly}\) assuming sub-exponentially secure iO, OWFs, and LWE [2410.24189].

## 6. Adjacent notions, variants, and unresolved directions

Several neighboring notions illuminate what UTE is and is not. “Two-way Unclonable Encryption with a vulnerable sender” does not use the term UTE, but introduces Vulnerable-Sender Unclonable Encryption (VSUE), an asymmetric variant in which secrecy must hold in the Reject branch even if Alice’s shared keys later leak. Formally, with key split \(K=(S,P)\), VSUE requires
\[
\big\|\rho^{MS\,T E}_{\tt reject}-\rho^M\otimes \rho^{ST E}_{\tt reject}\big\|_1\le \varepsilon.
\]
This is closely related in spirit to UTE because security survives a later compromise of sender-side secrets, but the paper’s formulation remains within the unclonable-encryption framework rather than the no-telegraphing framework [2010.10827].

An earlier conceptual precursor is the quantum generalization of Shannon unicity distance. “Unicity Distance of Quantum Encryption Protocols” does not use the term UTE, but studies when ciphertext-only observation does or does not suffice to recover a unique key. Its QUD2 and QUD3 notions track the elimination of spurious keys through meaningful-plaintext testing, and the paper shows that some short-key quantum schemes can have infinite unicity distance because wrong-key decryption disturbs the ciphertext irreversibly or because accessible information about the key never approaches key entropy [1204.5884]. This suggests a precursor to no-telegraphing intuition: a quantum ciphertext may fail to support reliable classical verification or exhaustive key testing even when large amounts of ciphertext are available.

The strongest unresolved issues lie at the boundary between UTE and UE. “Towards Unconditional Uncloneable Encryption” studies a candidate unconditional uncloneable bit and proves the conjectured bound
\[
\Pr[\mathrm{win}] \le \frac12+\frac{1}{2\sqrt K}
\]
for \(K=2,\ldots,7\), confirms it numerically up to \(K=17\) using the NPA hierarchy, proves an asymptotic upper bound of
\[
\frac58,
\]
and reports a numerical upper bound of approximately \(0.5980\) [2410.23064]. The paper is formally about the Broadbent–Lord style uncloneable-indistinguishability game rather than UTE, but it is explicitly described as very close in spirit to UTE. In parallel, [2410.24189] states that no plain-model construction of everlasting UTE is known and gives evidence that this is a challenging task, while [2510.00903] argues that UTE may provide a path toward the central open problem of indistinguishability security for UE in the plain model.

A recurring misconception is that UTE simply renames UE. The literature does not support that as a uniform statement. Some papers did use “untelegraphable encryption” for uncloneable encryption [1903.00130], but the contemporary formal literature distinguishes them sharply: UTE restricts the adversary to classical telegraphing, UE allows arbitrary quantum branching, and explicit constructions separate the two notions [2410.24189]. Another misconception is that the 2010 Peacock proposal already constituted modern UTE. It did not: that proposal was preliminary, hash-based, and lacked a rigorous adversarial model [1001.1844]. The modern subject is specifically quantum, game-based, and tied to the no-telegraphing principle.

Source: https://www.emergentmind.com/topics/untelegraphable-encryption-ute