Latest / Quickly Quantum / August 9, 2026 — Uncloneable Encryption Grows Up: From One Bit to Real Messages
Transcript
- Today on Quickly Quantum: quantum mechanics gives us a rule that nothing can copy — the no-cloning theorem, the idea that you literally cannot make a perfect copy of an unknown quantum state. Cryptographers have spent years trying to turn that rule into a weapon: encryption where even someone who steals your ciphertext and later gets the key can't have secretly cloned it and handed a working copy to a partner. The question this week is whether that dream just grew up from a single bit of information into something you could actually use to send a message. Two papers landed within days of each other at the end of July, both trying to answer it, and this Sunday, the whole episode is theirs — no headlines, just one idea, stress-tested from every angle. Welcome back to Quickly Quantum, your daily brief on the quantum frontier. It's Sunday, August 9, 2026. Let's get into it. So let's build the picture. Back in twenty twenty, researchers Anne Broadbent and Sébastien Lord introduced uncloneable encryption — U-E for short. The pitch: encrypt a classical message into a quantum ciphertext, a message stored in quantum states instead of plain bits, such that even an adversary who eventually learns your decryption key can't have split that ciphertext into two copies that both decrypt correctly. Think of a secret that self-destructs the moment somebody tries to duplicate it — not because of a rule you enforce, but because physics won't allow the copy. For years, though, every real construction had a catch. Some leaned on computational assumptions — secure only as long as nobody ever builds a fast-enough algorithm to break it, which is exactly the kind of promise quantum computing itself keeps threatening to void. Others worked one bit at a time, not a real message. And some leaked security by a polynomial factor — the guarantee got weaker as the message got longer, defeating the point. Then in March of this year, that changed. A paper called 'The uncloneable bit exists,' from Archishna Bhattacharyya, Anne Broadbent, and Eric Culf, proved unconditional — information-theoretic, physics-guaranteed, not just computer-science-probable — security for a single bit. No adversary, no matter how powerful, can beat a coin flip at cloning it. But the authors themselves flagged the obvious next question: could this become useful for a real, arbitrary-length message without falling back on the very computational assumptions the breakthrough escaped? Call it the graduation problem — can uncloneable encryption grow from a single bit into a real message — and two competing papers, landing within about a week of each other in late July, showed up with different answers. First up: the purists. Archishna Bhattacharyya and collaborators — same lead author as the March breakthrough — came back this time in a paper on arXiv and Nature Physics, arguing uncloneability shouldn't have to compromise. Their claim: you can make the guarantee a physical fact for real messages, not just a single bit, without leaning on any assumption a future algorithm could someday break. The trick is showing the encoding bases used in the single-bit scheme are actually a subset of what's called Clifford unitaries, a specific, well-understood family of quantum operations. That observation upgrades the single-bit result into unconditional uncloneable encryption for messages of arbitrary length, with encoding time that scales only polynomially — reasonably, not explosively — with message length. In plain terms: a whole message, uncloneably encrypted, with a guarantee that doesn't weaken as it grows, and that no computer, quantum or otherwise, can ever crack no matter how fast it gets. That's the strongest possible version of the promise, and a physics outlet caught the mechanism nicely — @physorg_com posted on X, summarizing it as, 'as more quantum states are used, two interceptors' odds of both reading the hidden bit sink toward a coin flip.' That's the intuition in one sentence: throw more quantum resource at the encoding, and the ceiling on any coordinated cheating strategy drops toward pure chance. The open question this camp doesn't fully answer is what 'polynomial encoding time' actually costs at real message sizes — polynomial can still mean slow in practice, and a proof that something scales reasonably in theory isn't the same as a scheme you'd want running tomorrow. Now the second camp says the purists are optimizing for the wrong thing first. Seyoon Ragavan, in a paper posted to the IACR's eprint archive, argues unconditional security is a lovely ideal, but what actually matters for uncloneable encryption to go anywhere is efficiency and reusability — a scheme usable more than once, in what's called the plain model, meaning no exotic idealized assumptions baked into the proof, just standard cryptographic tools. His trade: lean on one modest, well-motivated computational assumption instead of demanding zero. What he delivers is the first plain-model, one-time, efficient uncloneable encryption scheme for a single classical bit that avoids both old failure modes — no polynomial security loss, no crushing inefficiency. And he goes further: the first plain-model construction of many-time secure encryption, meaning you can reuse the same key more than once, for messages of arbitrary, polynomial length. The catch is that it assumes the existence of what are called pseudorandom function-like states, a cryptographic building block that's plausible but not proven to exist. The mechanics are almost charmingly simple: the key is a uniformly random, non-identity, phase-free Pauli operation on however many qubits you're encoding — Pauli operators being among the most basic building blocks in quantum mechanics — implemented with operations and classical computation that both scale linearly with message size. That's the part that should catch an engineer's ear — linear scaling is fast, not some exotic construction that only exists on paper. Ragavan's implicit argument is that a scheme nobody can actually run isn't more secure in any way that matters — it's just secure in a proof. Third camp: James Bartusek and Eli Goldin, who work in a corner of the field sometimes called microcrypt — building cryptography on the absolute minimum assumptions possible, ideally nothing stronger than the existence of the uncloneable bit itself. Their argument is that the real prize isn't unconditional security and it isn't raw efficiency — it's finding the weakest possible foundation many-time uncloneable encryption can stand on, because the weaker the assumption, the more of cryptography survives in a worst-case world where, say, P equals N-P — the famous unsolved question of whether every problem whose solution can be checked quickly can also be solved quickly. If that turned out true, most of classical cryptography would collapse, but this quantum flavor might not. Across two papers, they prove something tight: if many-time secure symmetric key encryption exists — a standard tool most of today's internet security already assumes is fine — then many-time secure uncloneable encryption for arbitrary-length messages also exists. And because the reverse holds too, the two are shown equivalent in strength; neither is secretly harder to build than the other. Separately, working in what's called the Haar random oracle model — an idealized stand-in for a perfectly random quantum process — they build a scheme supporting key reuse, arbitrary-length messages, and the first evidence that reusable uncloneable encryption can exist even in a world where one-way functions, one of the most basic tools in all of cryptography, might not exist at all. That's genuinely striking if it holds up outside the idealized model — it would mean uncloneable encryption doesn't need cryptography's usual toolbox, just a stranger, more minimal one. But 'in the Haar random oracle model' is exactly the caveat that matters: it's a model, not yet a machine. And then there's the camp playing defense — the impossibility-result theorists, people like Prabhanjan Ananth and coauthors, whose job in this story is to keep everyone honest about what uncloneability can never do. Their argument: some versions of the dream are provably, mathematically dead, and no new construction changes that. Their prior analysis looked at a natural, simple design — a scheme that encrypts every bit of a message independently, called generalized conjugate encryption — and showed a cloning adversary using a generic strategy can still succeed with probability at least zero point seven one, raised to the power of the number of bits. That's nowhere near a coin flip; for a short message, that success rate is uncomfortably high. Separately, other work in this line has shown there's no indistinguishable-secure uncloneable encryption — and no quantum copy-protection, a related idea for locking software instead of messages — for single-bit-output point functions, in the standard model. A point function, for the non-cryptographers, is about the simplest thing to protect: a function that fires for exactly one secret input and nothing else, like a password check. If uncloneability can't be made airtight for something that simple, that's a real ceiling. The point of this camp isn't that the new papers are wrong — they're not contradicting Bhattacharyya's, Ragavan's, or Bartusek and Goldin's results, which are about different, more structured schemes. The point is narrower: uncloneability isn't a magic word that makes every design automatically safe just because it involves quantum states. The no-cloning theorem gives you leverage, not a blank check, and this week's optimism should be read against that backdrop. So where does this actually land? Three legitimately different papers just answered the graduation problem the March breakthrough left hanging — can a single uncloneable bit become a real, arbitrary-length uncloneable message — and they answered it three different ways, which tells you the field is diversifying, not stuck. Bhattacharyya's team wanted zero assumptions and got it, for one-time use. Ragavan wanted efficiency and reusability and got it, for a modest assumption. Bartusek and Goldin wanted the weakest possible foundation and got tight equivalence with ordinary encryption, plus a tantalizing hint that reusable uncloneable encryption might survive even without one-way functions. None of the three actually compete head to head — they're optimizing different variables, which is what you'd expect from a field that just cracked open a genuinely hard problem. But the impossibility camp's caveat is the one I keep coming back to: uncloneability is provably not a free property you get just by encrypting quantum-style. Some designs, even simple ones, leave real cracks — that zero point seven one to the n cloning probability isn't nothing. And the open questions here point at the same practical wall quantum key distribution hit years ago: does statistical security for real messages survive outside a proof sketch when you try to build the ciphertext at practical size, or does the polynomial blow-up quietly become exponential in practice? Can pseudorandom function-like states or a Haar random oracle ever be swapped for something you can actually compute, rather than an idealized stand-in mathematicians use to make the proof work? And even with all that solved, uncloneable encryption still needs long-lived quantum memory and quantum channels to move the ciphertext around — infrastructure decades from sitting on anyone's desk. Time for the Hype Check. I'm putting this at a six. The justification: three independent, technically serious results genuinely advanced the state of the art on a real open problem within the same two weeks — that's a field moving, not a press release. But every one of them still lives inside a proof, an idealized model, or a one-time-use limitation, and the honest comparison is quantum key distribution in its early years — a beautiful, physically real guarantee that took decades to become anything you could buy, and even now serves a narrow niche. Here's the computing tie-back: if uncloneable encryption ever gets efficient and reusable outside a lab, it rides on the same quantum memory and quantum networking hardware that quantum computing needs to link processors together — so every advance here quietly stress-tests the same hardware quantum computing itself is racing to build. For now, this is theory doing genuinely important work, not a product roadmap. If today's deep dive into uncloneable encryption scratched an itch, follow Quickly Quantum wherever you're listening, so tomorrow's headlines land in your feed automatically. And if you know someone who'd get a kick out of watching cryptographers argue about how paranoid encryption should be, send them this one — it's a good on-ramp into what quantum computing actually threatens, and protects. This has been Quickly Quantum, an AI-voiced podcast, created and built by a real human using today's cutting-edge technology. Nothing you heard on this show is financial advice. I'm Brian Lampert, and I'll catch you all tomorrow — take care!