arXiv subjects

Thomas Lorünser

Publications and source records attributed to Thomas Lorünser.

11 recordsLinked to original sources

arXiv2026

Software Defined Networks Key Relay for Large-Scale Quantum Key Distribution Networks

This work addresses the orchestration of large-scale Quantum Key Distribution Networks (QKDNs) using Software Defined Networking (SDN). Building on ETSI and ITU specifications, common best practices and architectures are outlined. The main task of the SDN Controller is to aggregate technical key performance indicators (KPI) from the network and, based on these, select the optimal path. Multiple path selection algorithms, based on Dijkstra or a maximum-minimum capacity algorithm, with built-in load balancing are presented. The algorithms were tested in simulations and their performances, and tradeoffs, are discussed. Additional critical aspects related to SDN controlled QKDNs are discussed, such as query batching, multi-path selection and group key capabilities. An oblivious multi-party protocol is proposed for relay path selection in a multi-domain scenario, so providers don't have to disclose sensitive information about their QKDN. These contributions aim to enhance scalability, resilience and interoperability in quantum-secure network infrastructures.

cs.CR↗

arXiv2026

Privacy-Preserving Distributed Optimization Under Time Constraints Using Secure Multi-Party Computation and Evolutionary Algorithms

In distributed optimization, multiple parties collaborate to find an optimal solution to a problem. Privacy-preserving distributed optimization uses techniques, such as secure multi-party computation (MPC), to protect the private inputs of each party. In time-critical settings, the runtime overhead introduced by privacy-preserving computations may prevent the optimization from finishing within the deadline. This paper presents an approach for privacy-preserving distributed optimization in time-critical settings that combines evolutionary algorithms for solution search and MPC for the evaluation of solutions. The approach reduces the impact of privacy-preserving computations on runtime and allows to return solution within the deadline. Obfuscation of evaluation results provides additional protection for private inputs from an honest-but-curious platform provider, but introduces a potential trade-off between protection and solution quality. This trade-off is investigated in experiments using a genetic algorithm for both the single-objective assignment problem and the traveling salesperson problem, as well as NSGA-II for the multi-objective assignment problem.

cs.NE↗

arXiv2026

Topology-Hiding Path Validation for Large-Scale Quantum Key Distribution Networks

Secure long-distance communication in quantum key distribution (QKD) networks depends on trusted repeater nodes along the entire transmission path. Consequently, these nodes will be subject to strict auditing and certification in future large-scale QKD deployments. However, trust must also extend to the network operator, who is responsible for fulfilling contractual obligations -- such as ensuring certified devices are used and transmission paths remain disjoint where required. In this work, we present a path validation protocol specifically designed for QKD networks. It enables the receiver to verify compliance with agreed-upon policies. At the same time, the protocol preserves the operator's confidentiality by ensuring that no sensitive information about the network topology is revealed to users. We provide a formal model and a provably secure generic construction of the protocol, along with a concrete instantiation. For long-distance communication involving 100 nodes, the protocol has a computational cost of 1-2.5s depending on the machine, and a communication overhead of less than 70kB - demonstrating the efficiency of our approach.

quant-ph↗

arXiv2026

Topology-Hiding Connectivity-Assurance for QKD Inter-Networking

While QKD ensures information-theoretic security at the link level, real-world deployments depend on trusted repeaters, creating potential vulnerabilities. In this paper, we thus introduce a topology-hiding connectivity assurance protocol to enhance trust in quantum key distribution (QKD) network infrastructures. Our protocol allows network providers to jointly prove the existence of a secure connection between endpoints without revealing internal topology details. By extending graph-signature techniques to support multi-graphs and hidden endpoints, we enable zero-knowledge proofs of connectivity that ensure both soundness and topology hiding. We further discuss how our approach can certify, e.g., multiple disjoint paths, supporting multi-path QKD scenarios. This work bridges cryptographic assurance methods with the operational requirements of QKD networks, promoting verifiable and privacy-preserving inter-network connectivity.

cs.CR↗

arXiv2025

Commitment Schemes from OWFs with Applications to Quantum Oblivious Transfer

Commitment schemes are essential to many cryptographic protocols and schemes with applications that include privacy-preserving computation on data, privacy-preserving authentication, and, in particular, oblivious transfer protocols. For quantum oblivious transfer (qOT) protocols, unconditionally binding commitment schemes that do not rely on hardness assumptions from structured mathematical problems are required. These additional constraints severely limit the choice of commitment schemes to random oracle-based constructions or Naor's bit commitment scheme. As these protocols commit to individual bits, the use of such commitment schemes comes at a high bandwidth and computational cost. In this work, we investigate improvements to the efficiency of commitment schemes used in qOT protocols and propose an extension of Naor's commitment scheme requiring the existence of one-way functions (OWF) to reduce communication complexity for 2-bit strings. Additionally, we provide an interactive string commitment scheme with preprocessing to enable a fast and efficient computation of commitments.

cs.CR↗

arXiv2025

Secure Multi-Party Biometric Verification using QKD assisted Quantum Oblivious Transfer

We present a practical implementation of a secure multiparty computation application enabled by quantum oblivious transfer (QOT) on an entanglement-based physical layer. The QOT protocol uses polarization-encoded entangled states to share oblivious keys between two parties with quantum key distribution (QKD) providing authentication. Our system integrates the post-processing for QKD and QOT, both sharing a single physical layer, ensuring efficient key generation and authentication. Authentication involves hashing messages into a crypto-context, verifying tags, and replenishing keys through a parallel QKD pipeline, which handles both key post-processing and authentication. Oblivious keys are generated over 12.9 km with a channel loss of 8.47 dB. In a back-to-back setup, a QOT rate of $9.3\times10^{-3}$ OTs/second is achieved, corresponding to 1 minute and 48 seconds per OT, primarily limited by the entanglement source. Using pre-distributed keys improved the rate to 0.11 OTs/second, or 9.1 seconds per OT. The considered QOT protocol is statistically correct, computationally secure for an honest receiver, and statistically secure for an honest sender, assuming a computationally hiding, statistically binding commitment, and a verifiable error-correcting scheme. A practical use case is demonstrated for privacy-preserving fingerprint matching against no-fly lists from Interpol and the United Nations. The fingerprint is secret-shared across two sites, ensuring security, while the matching is performed using the MASCOT protocol, supported by QOT. The application required 128 OTs, with the highest security achieved in 20 minutes and 39 seconds. This work demonstrates the feasibility of QOT in secure quantum communication applications.

quant-ph↗

arXiv2024

Protecting Privacy in Federated Time Series Analysis: A Pragmatic Technology Review for Application Developers

The federated analysis of sensitive time series has huge potential in various domains, such as healthcare or manufacturing. Yet, to fully unlock this potential, requirements imposed by various stakeholders must be fulfilled, regarding, e.g., efficiency or trust assumptions. While many of these requirements can be addressed by deploying advanced secure computation paradigms such as fully homomorphic encryption, certain aspects require an integration with additional privacy-preserving technologies. In this work, we perform a qualitative requirements elicitation based on selected real-world use cases. We match the derived requirements categories against the features and guarantees provided by available technologies. For each technology, we additionally perform a maturity assessment, including the state of standardization and availability on the market. Furthermore, we provide a decision tree supporting application developers in identifying the most promising technologies available matching their needs. Finally, existing gaps are identified, highlighting research potential to advance the field.

cs.CR↗

arXiv2022

Single-Use Delegatable Signatures Based on Smart Contracts

Delegation of cryptographic signing rights has found many application in the literature and the real world. However, despite very advanced functionalities and specific use cases, existing solutions share the natural limitation that the number of usages of these signing rights cannot be efficiently limited, but users can at most be disincentivized to abuse their rights. In this paper, we suggest a solution to this problem based on blockchains. We let a user define a smart contract defining delegated signing rights, which needs to be triggered to successfully sign a message. By leveraging the immutability of the blockchain, our construction can now guarantee that a user-defined threshold of signature invocations cannot be exceeded, thereby circumventing the need for dedicated hardware or similar assistance in existing constructions for one-time programs. We discuss different constructions supporting different features, and provide concrete implementations in the Solidity language of the Ethereum blockchain, proving the real-world efficiency and feasibility of our construction.

cs.CR↗

arXiv2015

Attacks on quantum key distribution protocols that employ non-ITS authentication

We demonstrate how adversaries with unbounded computing resources can break Quantum Key Distribution (QKD) protocols which employ a particular message authentication code suggested previously. This authentication code, featuring low key consumption, is not Information-Theoretically Secure (ITS) since for each message the eavesdropper has intercepted she is able to send a different message from a set of messages that she can calculate by finding collisions of a cryptographic hash function. However, when this authentication code was introduced it was shown to prevent straightforward Man-In-The-Middle (MITM) attacks against QKD protocols. In this paper, we prove that the set of messages that collide with any given message under this authentication code contains with high probability a message that has small Hamming distance to any other given message. Based on this fact we present extended MITM attacks against different versions of BB84 QKD protocols using the addressed authentication code; for three protocols we describe every single action taken by the adversary. For all protocols the adversary can obtain complete knowledge of the key, and for most protocols her success probability in doing so approaches unity. Since the attacks work against all authentication methods which allow to calculate colliding messages, the underlying building blocks of the presented attacks expose the potential pitfalls arising as a consequence of non-ITS authentication in QKD-postprocessing. We propose countermeasures, increasing the eavesdroppers demand for computational power, and also prove necessary and sufficient conditions for upgrading the discussed authentication code to the ITS level.

quant-ph↗

arXiv2009

Fully automated entanglement-based quantum cryptography system for telecom fiber networks

We present a quantum key distribution (QKD) system based on polarisation entanglement for use in telecom fibers. A QKD exchange up to 50km was demonstrated in the laboratory with a secure key rate of 550 bit/s. The system is compact, portable with a fully automated start-up and stabilisation modules for polarisation, synchronisation and photon coupling allow a hands-off operation. Stable and reliable key exchange in a deployed optical fiber of 16km length was demonstrated. In this fiber network we achieved over two weeks an automatic key generation with an average key rate of 2000 bit/s without manual intervention. During this period, the system had an average entanglement visibility of 93%, highlighting the technical level and stability achieved for entanglement-based quantum cryptography.

quant-ph↗

arXiv2008

High-fidelity transmission of polarization encoded qubits from an entangled source over 100 km of fiber

We demonstrate non-degenerate down-conversion at 810 and 1550 nm for long-distance fiber based quantum communication using polarization entangled photon pairs. Measurements of the two-photon visibility, without dark count subtraction, have shown that the quantum correlations (raw visibility 89%) allow secure quantum cryptography after 100 km of non-zero dispersion shifted fiber using commercially available single photon detectors. In addition, quantum state tomography has revealed little degradation of state negativity, decreasing from 0.99 at the source to 0.93 after 100 km, indicating minimal loss in fidelity during the transmission.

quant-ph↗