QSA’s technology rests on two pillars: a physical fingerprint that can’t be copied, and a readout method backed by a quantum-mechanical guarantee, not just an engineering one. Here’s how the two fit together.
A Physical Unclonable Function (PUF) is a physical object that maps a stimulus, a challenge, to an output, a response, through a transformation that’s unique to that exact piece of hardware. The mapping depends on microscopic, uncontrollable degrees of freedom from manufacturing, at a scale no fabrication process can fully control. The same challenge always gives the same response from the same PUF, and an uncorrelated one from any other.
That’s what makes a PUF useful for authentication. It behaves like a secret without storing one digitally, so there’s nothing to steal from a database. Classical PUFs do share one weakness though: given enough challenge-response pairs, an attacker can sometimes train a model that predicts new responses without ever touching the device. Closing that gap is what our quantum readout protocols are built to do, and it’s the core of what sets QSA apart from classical hardware roots of trust.
Our PUF is built into a photonic integrated circuit (PIC), the same class of chip used to route and process light in optical networking hardware. During fabrication, the waveguides and resonators pick up nanometer-scale disorder that no process can fully eliminate. That disorder governs exactly how light couples between optical modes as it travels through the circuit.
The result is a transmission response unique to that one chip. Illuminate it, and the output pattern is unrepeatable, even between two chips cut from the same wafer. It’s the on-chip analogue of the speckle pattern a bulk disordered medium produces, and we’ve verified that uniqueness across every chip we’ve fabricated: no two have ever matched.
Because the fingerprint lives entirely in how light interacts with the chip, it can be read out purely optically. No electronic conversion step, no power required at the PUF itself, and it’s queryable remotely over a standard optical link using the same weak coherent light already used across fiber networks.
Even a classical unclonable key is still vulnerable to digital emulation: an attacker who knows its behavior can construct the expected response on a computer without touching the device. Turn the challenge down to a handful of photons, though, and this stops being feasible even with full knowledge of the PUF. The challenge itself becomes a quantum object no attacker can fully characterize before it’s gone, which is a gap classical hardware roots of trust simply can’t close.
K: optical modes spanned. n: photons per challenge. Attacker fidelity is provably bounded by roughly 1 / (S + 1).
First demonstrated in 2014 on an earlier scattering-medium PUF (Goorden et al., Optica). The same guarantee carries over to our on-chip PUFs.
The no-cloning theorem guarantees an unknown quantum state can’t be copied. Encode a challenge as a weak coherent state spread across more optical modes than it carries photons, and any measurement an attacker performs, including the strongest classical attacks considered in the literature, can extract only partial, permanently lost information about what was sent. That’s a bound set by quantum mechanics, not equipment.
It holds even when the protocol and every past challenge-response pair are public. That means we can run our authentication entirely in the open, publishing every detail of the readout scheme, without weakening the guarantee at all: a property no classical PUF or digital credential can offer.
We send a low-photon challenge with many possible states. The PUF transforms it and returns the response unchanged. Only the genuine chip produces the expected result, provable with a single successful round.
We extend node authentication so every symbol of a transmitted message is tied to its own PUF round. That confirms not just who sent a message, but that every bit of it is genuine and unaltered, similar in purpose to a MAC.
We go beyond authentication to include encryption: messages that can only be decoded by whoever holds the matching PUF, with no pre-shared secret required. A physical-key analogue to asymmetric communication.
Our approach builds directly on peer-reviewed research from the University of Twente, the Eindhoven University of Technology, and other collaborators, including our own contribution to GSMA’s whitepaper on authentication for quantum communication networks.
Quantum Physical Unclonable Function (qPUF): QSA Technology’s contribution to GSMA’s whitepaper on authentication for quantum communication networks.
Uppu, Wolterink, Goorden, Chen, Škorić, Mosk & Pinkse: Asymmetric cryptography with physical unclonable keys, Quantum Science and Technology 4, 045011.
Goorden, Horstmann, Mosk, Škorić & Pinkse: Quantum-secure authentication of a physical unclonable key, Optica 1(6), 421-424.
Škorić, Mosk & Pinkse: Security of Quantum-Readout PUFs against quadrature-based challenge-estimation attacks
Škorić: Quantum readout of Physical Unclonable Functions, International Journal of Quantum Information 10(1), 1250001.
We’re happy to go deeper on the physics, the protocols or how we implement them.