Secret sharing and multiparty computation (also called "secure function evaluation") are fundamental primitives in modern cryptography, allowing a group of mutually distrustful players to perform correct, distributed computations under the sole assumption that some number of them will follow the protocol honestly. This paper investigates how much trust is necessary -- that is, how many players must remain honest -- in order for distributed quantum computations to be possible.
We present a verifiable quantum secret sharing (VQSS) protocol, and a general secure multiparty quantum computation (MPQC) protocol, which can tolerate any (n-1)/2 (rounded down) cheaters among n players. Previous protocols for these tasks tolerated (n-1)/4 (rounded down) and (n-1)/6 (rounded down) cheaters, respectively. The threshold we achieve is tight - even in the classical case, ``fair'' multiparty computation is not possible if any set of n/2 players can cheat.
Our protocols rely on approximate quantum error-correcting codes, which can tolerate a larger fraction of errors than traditional, exact codes. We introduce new families of authentication schemes and approximate codes tailored to the needs of our protocols, as well as new state purification techniques along the lines of those used in fault-tolerant quantum circuits.
This paper introduces quantum multiparty protocols which allow the use of temporary assumptions. We prove that secure quantum multiparty computations are possible if and only if classical multi party computations work. But these strict assumptions are necessary only during the execution of the protocol and can be loosened after termination of the protocol. We consider two settings: 1. A collusion of players tries to learn the secret inputs of honest players or tries to modify the result of the computation. 2. A collusion of players cheats in the above way or tries to disrupt the protocol, i.e.…
We investigate coin-flipping protocols for multiple parties in a quantum broadcast setting: (1) We propose and motivate a definition for quantum broadcast. Our model of quantum broadcast channel is new. (2) We discovered that quantum broadcast is essentially a combination of pairwise quantum channels and a classical broadcast channel. This is a somewhat surprising conclusion, but helps us in both our lower and upper bounds. (3) We provide tight upper and lower bounds on the optimal bias epsilon of a coin which can be flipped by k parties of which exactly g parties are honest: for any 1 <= g <=…
We present the first quantum anonymous notification (QAN) protocol that introduces anonymity and paves the way for anonymous secure quantum communication in quantum networks. QAN protocol has applications ranging from multiparty quantum computation to quantum internet. We utilize the QAN protocol to propose an anonymous quantum private comparison protocol in an $n$-node quantum network. This protocol can compare private information of any $2 \leq k \leq n$ parties with the help of the remaining $n-k$ parties and a semi-honest third party. These protocols feature a traceless property, i.e., enc…
We propose one of the very few constructive consequences of the second law of thermodynamics. More specifically, we present protocols for secret-key establishment and multiparty computation the security of which is based fundamentally on Landauer's principle. The latter states that the erasure cost of each bit of information is at least kTln2 (where k is Boltzmann's constant and T is the absolute temperature of the environment). Albeit impractical, our protocols explore the limits of reversible computation, and the only assumption about the adversary is her inability to access a quantity of fr…
We study quantum protocols among two distrustful parties. By adopting a rather strict definition of correctness - guaranteeing that honest players obtain their correct outcomes only - we can show that every strictly correct quantum protocol implementing a non-trivial classical primitive necessarily leaks information to a dishonest player. This extends known impossibility results to all non-trivial primitives. We provide a framework for quantifying this leakage and argue that leakage is a good measure for the privacy provided to the players by a given protocol. Our framework also covers the cas…
I construct a secure multi-party scheme to compute a classical function by a succinct use of a specially designed fault-tolerant random polynomial quantum error correction code. This scheme is secure provided that (asymptotically) strictly greater than five-sixths of the players are honest. Moreover, the security of this scheme follows directly from the theory of quantum error correcting code, and hence is valid without any computational assumption. I also discuss the quantum-classical complexity-security tradeoff in secure multi-party computation schemes and argue why a full-blown quantum cod…
It was shown in [WST08] that cryptographic primitives can be implemented based on the assumption that quantum storage of qubits is noisy. In this work we analyze a protocol for the universal task of oblivious transfer that can be implemented using quantum-key-distribution (QKD) hardware in the practical setting where honest participants are unable to perform noise-free operations. We derive trade-offs between the amount of storage noise, the amount of noise in the operations performed by the honest participants and the security of oblivious transfer which are greatly improved compared to the r…
Oblivious transfer is an important primitive in modern cryptography. Applications include secure multiparty computation, oblivious sampling, e-voting, and signatures. Information-theoretically secure perfect 1-out-of 2 oblivious transfer is impossible to achieve. Imperfect variants, where both participants' ability to cheat is still limited, are possible using quantum means while remaining classically impossible. Precisely what security parameters are attainable remains unknown. We introduce a theoretical framework for studying semirandom quantum oblivious transfer, which is shown to be equiva…
In this article we show for the first time that quantum coin flipping with security guarantees that are strictly better than any classical protocol is possible to implement with current technology. Our protocol takes into account all aspects of an experimental implementation like losses, multi-photon pulses emitted by practical photon sources, channel noise, detector dark counts and finite quantum efficiency. We calculate the abort probability when both players are honest, as well as the probability of one player forcing his desired outcome. For channel length up to 21 km, we achieve a cheatin…
Relativistic protocols have been proposed to overcome some impossibility results in classical and quantum cryptography. In such a setting, one takes the location of honest players into account, and uses the fact that information cannot travel faster than the speed of light to limit the abilities of dishonest agents. For example, various relativistic bit commitment protocols have been proposed. Although it has been shown that bit commitment is sufficient to construct oblivious transfer and thus multiparty computation, composing specific relativistic protocols in this way is known to be insecure…
Blind quantum computation (BQC) allows a client with limited quantum power to delegate his quantum computational task to a powerful server and still keep his input, output, and algorithm private. There are mainly two kinds of models about BQC, namely circuit-based and measurement-based models. In addition, a hybrid model called ancilla-driven universal blind quantum computing (ADBQC) was proposed by combining the properties of both circuit-based and measurement-based models, where all unitary operations on the register qubits can be realized with the aid of single ancillae coupled to the regis…
The widely held belief that BQP strictly contains BPP raises fundamental questions: Upcoming generations of quantum computers might already be too large to be simulated classically. Is it possible to experimentally test that these systems perform as they should, if we cannot efficiently compute predictions for their behavior? Vazirani has asked: If predicting Quantum Mechanical systems requires exponential resources, is QM a falsifiable theory? In cryptographic settings, an untrusted future company wants to sell a quantum computer or perform a delegated quantum computation. Can the customer be…
The widely held belief that BQP strictly contains BPP raises fundamental questions: if we cannot efficiently compute predictions for the behavior of quantum systems, how can we test their behavior? In other words, is quantum mechanics falsifiable? In cryptographic settings, how can a customer of a future untrusted quantum computing company be convinced of the correctness of its quantum computations? To provide answers to these questions, we define Quantum Prover Interactive Proofs (QPIP). Whereas in standard interactive proofs the prover is computationally unbounded, here our prover is in BQP,…
Attacks on classical cryptographic protocols are usually modeled by allowing an adversary to ask queries from an oracle. Security is then defined by requiring that as long as the queries satisfy some constraint, there is some problem the adversary cannot solve, such as compute a certain piece of information. In this paper, we introduce a fundamentally new model of quantum attacks on classical cryptographic protocols, where the adversary is allowed to ask several classical queries in quantum superposition. This is a strictly stronger attack than the standard one, and we consider the security of…
Quantum Advantage for Two-Party Differential Privacy
University of Illinois at Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；Joint Center for Quantum Information and Computer Science, NIST/University of Maryland（量子信息与计算机科学联合中心，美国国家标准与技术研究院/马里兰大学）；Joint Quantum Institute, NIST/University of Maryland（量子研究所，美国国家标准与技术研究院/马里兰大学）
