We have developed a verification tool (called qrhl-tool, see the screenshot) for the verification of the security of quantum cryptographic protocols. Using this tool, it is possible to take a mathematical proof of the security of a protocol and "explain" it to the computer. The computer will then check that the proof contains no mistakes. This is necessary because humans tend to make error both when writing proofs and when verifying them; the tool gives us higher assurances in the security of the protocols. The tool is freely available as open-source.
The tool is not merely a piece of software, it comes with a large amount of mathematical theory behind it. To be sure that the tool performs as desired, we need to create a mathematical "logic" in which we write the computer-verified proofs. We developed a logic called qRHL; the qrhl-tool understands this logic (so the user of the tool needs to explain the proof in qRHL). Our development of the mathematical foundations so far includes: the basic logic qRHL, an extension of qRHL to handle local program variables (used only by one subprocedure in the cryptographic protocol we analyze), a mathematical theory of what a variable in a quantum program is in the first place ("quantum references"), a variant of qRHL that allows us to express quantitative statements, a logic to reason about classical versus quantum values, a logic for reasoning about conditional probabilities in quantum programs.
However, if we prove by hand that the logic used by qrhl-tool is correct, haven't we simply shifted the problem? Now it could be that there are errors in our manually checked proof of the correctness of that logic. Or we could have made mistakes when implementing them in qrhl-tool. To avoid this problem, we plan to go one step further: qrhl-tool itself should not just "trust" what steps are allowed in qRHL. Instead, it should break down each step into elementary mathematical reasoning steps that each are as simple as possible. Now we just need to be sure of only a small part of the toolchain, namely the trusted core that checks those elementary steps. (This is called the "foundational approach".) At this point, we have not yet reached this point, but we have made considerable progress: We use a general-purpose theorem prover for mathematical theorems, called Isabelle/HOL, to check some of the proof steps qrhl-tool makes. For this, we have already implemented support for a number of mathematical theories in Isabelle/HOL, such as support for reasoning about bounded operators over complex Hilbert spaces, and a foundationally verified implementation of our theory of variables in quantum programs. We also have a complete rewrite of the qrhl-tool that will eventually ensure that qrhl-tool can only do reasoning that is justified by underlying theories proven in Isabelle/HOL. (This rewrite is only ~90% complete.)
But is it feasible to use qrhl-tool to verify actual real-world cryptographic protocols? After all, "explaining" the security proof to qrhl-tool, while possible in principle, might be so labor-intensive that it cannot practically be done. To make sure that this is not the case, we have verified in qrhl-tool a state-of-the-art result in post-quantum cryptography, namely the security of the so-called Fujisaki-Okamoto transform. (This is an important technique for constructing encryption schemes that withstand quantum attacks. It is used, for example, in many candidates for future industry-standard encryption schemes.) This both gives deeper trust in the security of those encryption schemes, as well as shows that our approach of verifying the security of quantum protocols with the computer is feasible.
The most important results are:
* Development of the qrhl-tool. (Disseminated via open source project
https://dominique-unruh.github.io/qrhl-tool.(öffnet in neuem Fenster))
* Formal verification of the Fujisaki-Okamoto transform. (Disseminated by publication at Asiacrypt 2020.)
* The concept of quantum references. (Disseminated as public manuscript on arXiv.)
* Formalization of various mathematical theories in Isabelle/HOL. (Disseminated in the Archive of Formal Proofs.)
