It was shown in [WST08] that cryptographic primitives can be implemented based on the assumption that quantum storage of qubits is noisy. In this work we analyze a protocol for the universal task of oblivious transfer that can be implemented using quantum-key-distribution (QKD) hardware in the practical setting where honest participants are unable to perform noise-free operations. We derive trade-offs between the amount of storage noise, the amount of noise in the operations performed by the honest participants and the security of oblivious transfer which are greatly improved compared to the results in [WST08]. As an example, we show that for the case of depolarizing noise in storage we can obtain secure oblivious transfer as long as the quantum bit-error rate of the channel does not exceed 11% and the noise on the channel is strictly less than the quantum storage noise. This is optimal for the protocol considered. Finally, we show that our analysis easily carries over to quantum protocols for secure identification.
We provide a complete proof of the security of quantum cryptography against any eavesdropping attack including coherent measurements even in the presence of noise. Polarization-based cryptographic schemes are shown to be equivalent to EPR-based schemes. We also show that the performance of a noisy channel approaches that of a noiseless one as the error rate tends to zero. (i.e., the secrecy capacity $C_s (ε) \to C_s (0)$ as $ε\to 0$.) One implication of our results is that one can {\it double} the efficiency of a most well-known quantum cryptographic scheme proposed by Bennett and Brassard sim…
When the 4-state or the 6-state protocol of quantum cryptography is carried out on a noisy (i.e. realistic) quantum channel, then the raw key has to be processed to reduce the information of an adversary Eve down to an arbitrarily low value, providing Alice and Bob with a secret key. In principle, quantum algorithms as well as classical algorithms can be used for this processing. A natural question is: up to which error rate on the raw key is a secret-key agreement at all possible? Under the assumption of incoherent eavesdropping, we find that the quantum and classical limits are precisely the…
Existing quantum cryptographic schemes are not, as they stand, operable in the presence of noise on the quantum communication channel. Although they become operable if they are supplemented by classical privacy-amplification techniques, the resulting schemes are difficult to analyse and have not been proved secure. We introduce the concept of quantum privacy amplification and a cryptographic scheme incorporating it which is provably secure over a noisy channel. The scheme uses an `entanglement purification' procedure which, because it requires only a few quantum Controlled-Not and single-qubit…
We show how to implement cryptographic primitives based on the realistic assumption that quantum storage of qubits is noisy. We thereby consider individual-storage attacks, i.e. the dishonest party attempts to store each incoming qubit separately. Our model is similar to the model of bounded-quantum storage, however, we consider an explicit noise model inspired by present-day technology. To illustrate the power of this new model, we show that a protocol for oblivious transfer (OT) is secure for any amount of quantum-storage noise, as long as honest players can perform perfect quantum operation…
We give a proof that entanglement purification, even with noisy apparatus, is sufficient to disentangle an eavesdropper (Eve) from the communication channel. In the security regime, the purification process factorises the overall initial state into a tensor-product state of Alice and Bob, on one side, and Eve on the other side, thus establishing a completely private, albeit noisy, quantum communication channel between Alice and Bob. The security regime is found to coincide for all practical purposes with the purification regime of a two-way recurrence protocol. This makes two-way entanglement …
This thesis initiates the study of cryptographic protocols in the bounded-quantum-storage model. On the practical side, simple protocols for Rabin Oblivious Transfer, 1-2 Oblivious Transfer and Bit Commitment are presented. No quantum memory is required for honest players, whereas the protocols can only be broken by an adversary controlling a large amount of quantum memory. The protocols are efficient, non-interactive and can be implemented with today's technology. On the theoretical side, new entropic uncertainty relations involving min-entropy are established and used to prove the security o…
It has been suggested that the ability of quantum mechanics to allow secure distribution of secret key together with its inability to allow bit commitment or communicate superluminally might be sufficient to imply the rest of quantum mechanics. I argue using a toy theory as a counterexample that this is not the case. I further discuss whether an additional axiom (key storage) brings back the quantum nature of the theory.
We initiate the study of two-party cryptographic primitives with unconditional security, assuming that the adversary's quantum memory is of bounded size. We show that oblivious transfer and bit commitment can be implemented in this model using protocols where honest parties need no quantum memory, whereas an adversarial player needs quantum memory of size at least n/2 in order to break the protocol, where n is the number of qubits transmitted. This is in sharp contrast to the classical bounded-memory model, where we can only tolerate adversaries with memory of size quadratic in honest players'…
We present simple protocols for oblivious transfer and password-based identification which are secure against general attacks in the noisy-quantum-storage model as defined in [KWW09]. We argue that a technical tool from [KWW09] suffices to prove security of the known protocols. Whereas the more involved protocol for oblivious transfer from [KWW09] requires less noise in storage to achieve security, our "canonical" protocols have the advantage of being simpler to implement and the security error is easier control. Therefore, our protocols yield higher OT-rates for many realistic noise parameter…
We consider the security of continuous-variable quantum cryptography as we approach the classical-limit, i.e., when the unknown preparation noise at the sender's station becomes significantly noisy or thermal (even by as much as 10,000 times the variance of the vacuum mode). We show that, provided the channel transmission losses do not exceed 50%, the security of quantum cryptography is not dependent on the channel transmission, and is therefore, incredibly robust against significant amounts of excess preparation noise. We extend these results to consider for the first time quantum cryptograph…
We present the first protocol for oblivious transfer that can be implemented with an optical continuous-variable system, and prove its security in the noisy-storage model. This model allows security to be achieved by sending more quantum signals than an attacker can reliably store at one specific point during the protocol. Concretely, we determine how many signals need to be sent in order to achieve security by establishing a trade-off between quantum uncertainty generated in the protocol and the classical capacity of the memory channel. As our main technical tool, we study and derive new unce…
The security of a cryptographic key that is generated by communication through a noisy quantum channel relies on the ability to distill a shorter secure key sequence from a longer insecure one. For an important class of protocols, which exploit tomographically complete measurements on entangled pairs of any dimension, we show that the noise threshold for classical advantage distillation is identical with the threshold for quantum entanglement distillation. As a consequence, the two distillation procedures are equivalent: neither offers a security advantage over the other.
The noisy-storage model allows the implementation of secure two-party protocols under the sole assumption that no large-scale reliable quantum storage is available to the cheating party. No quantum storage is thereby required for the honest parties. Examples of such protocols include bit commitment, oblivious transfer and secure identification. Here, we provide a guideline for the practical implementation of such protocols. In particular, we analyze security in a practical setting where the honest parties themselves are unable to perform perfect operations and need to deal with practical probl…
Classical and quantum information theory are simply explained. To be more specific it is clarified why Shannon entropy is used as measure of classical information and after a brief review of quantum mechanics it is possible to demonstrate why the density matrix is the main tool of quantum information theory. Then von Neumann entropy is introduced and with its help a great difference between classical and quantum information theory is presented: quantum entanglement. Moreover an information theoretic interpretation of quantum measurement is discussed. Data compression, error correction and nois…
We give a security proof of quantum cryptography based entirely on entanglement purification. Our proof applies to all possible attacks (individual and coherent). It implies the security of cryptographic keys distributed with the help of entanglement-based quantum repeaters. We prove the security of the obtained quantum channel which may not only be used for quantum key distribution, but also for secure, albeit noisy, transmission of quantum information.
We extend the security proof for continuous variable quantum key distribution protocols using post selection to account for arbitrary eavesdropping attacks by employing the concept of an equivalent protocol where the post-selection is implemented as a series of quantum operations including a virtual distillation. We introduce a particular `Gaussian' post selection and demonstrate that the security can be calculated using only experimentally accessible quantities. Finally we explicitly evaluate the performance for the case of a noisy Gaussian channel in the limit of unbounded key length and fin…
Cryptography's importance in our everyday lives continues to grow in our increasingly digital world. Oblivious transfer (OT) has long been a fundamental and important cryptographic primitive since it is known that general two-party cryptographic tasks can be built from this basic building block. Here we show the experimental implementation of a 1-2 random oblivious transfer (ROT) protocol by performing measurements on polarization-entangled photon pairs in a modified entangled quantum key distribution system, followed by all of the necessary classical post-processing including one-way error co…
Cryptographic protocols are the backbone of our information society. This includes two-party protocols which offer protection against distrustful players. Such protocols can be built from a basic primitive called oblivious transfer. We present and experimentally demonstrate here the first quantum protocol for oblivious transfer for optical continuous-variable systems, and prove its security in the noisy-storage model. This model allows to establish security by sending more quantum signals than an attacker can reliably store during the protocol. The security proof is based on new uncertainty re…
Fundamental primitives such as bit commitment and oblivious transfer serve as building blocks for many other two-party protocols. Hence, the secure implementation of such primitives are important in modern cryptography. In this work, we present a bit commitment protocol which is secure as long as the attacker's quantum memory device is imperfect. The latter assumption is known as the noisy-storage model. We experimentally executed this protocol by performing measurements on polarization-entangled photon pairs. Our work includes a full security analysis, accounting for all experimental error ra…
The security of a cryptographic key that is generated by communication through a noisy quantum channel relies on the ability to distill a shorter secure key sequence from a longer insecure one. We show that -- for protocols that use quantum channels of any dimension and completely characterize them by state tomography -- the noise threshold for classical advantage distillation is substantially lower than the threshold for quantum entanglement distillation because the eavesdropper can perform powerful coherent attacks. The earlier claims that the two noise thresholds are identical, which were b…
Reliable Entropy Estimation from Observed Statistics for Device-Independent Quantum Cryptography
Institute for Quantum Information, RWTH Aachen University（亚琛工业大学量子信息研究所）；Institut für Theoretische Physik, Leibniz Universität Hannover（汉诺威莱布尼茨大学理论物理研究所）
Position-based quantum cryptography (PBQC) allows a party to use its geographical location as its only credential to implement various cryptographic protocols. Such a protocol may lead to important applications in practice. Although it has been shown that any PBQC protocol is breakable if the adversaries pre-share an arbitrarily large entangled state, the security of PBQC in the bounded-quantum-storage model is still an open question. In this paper, we study the performance of various PBQC protocols over a lossy channel under the assumption that no entanglement is pre-shared between adversarie…
We give an exponential separation between one-way quantum and classical communication protocols for a partial Boolean function (a variant of the Boolean Hidden Matching Problem of Bar-Yossef et al.) Earlier such an exponential separation was known only for a relational problem. The communication problem corresponds to a \emph{strong extractor} that fails against a small amount of \emph{quantum} information about its random source. Our proof uses the Fourier coefficients inequality of Kahn, Kalai, and Linial. We also give a number of applications of this separation. In particular, we show that …
In this article we deal with the security of the BB84 quantum cryptography protocol over noisy channels using generalized privacy amplification. For this we estimate the fraction of bits needed to be discarded during the privacy amplification step. This estimate is given for two scenarios, both of which assume the eavesdropper to access each of the signals independently and take error correction into account. One scenario does not allow a delay of the eavesdropper's measurement of a measurement probe until he receives additional classical information. In this scenario we achieve a sharp bound.…
Basic techniques to prove the unconditional security of quantum cryptography are described. They are applied to a quantum key distribution protocol proposed by Bennett and Brassard in 1984. The proof considers a practical variation on the protocol in which the channel is noisy and photons may be lost during the transmission. The initial coding into the channel must be perfect (i.e., exactly as described in the protocol). No restriction is imposed on the detector used at the receiving side of the channel, except that whether or not the received system is detected must be independent of the basi…
Coherent control of collective spontaneous emission in an extended atomic ensemble resonantly interacting with single-photon wave packets is analyzed. A scheme for coherent manipulation of collective atomic states is developed such that superradiant states of the atomic system can be converted into subradiant ones and vice versa. Possible applications of such a scheme for optical quantum state storage and single-photon wave packet shaping are discussed. It is shown that also in the absence of inhomogeneous broadening of the resonant line, single-photon wave packets with arbitrary pulse shape m…
Relativistic protocols have been proposed to overcome some impossibility results in classical and quantum cryptography. In such a setting, one takes the location of honest players into account, and uses the fact that information cannot travel faster than the speed of light to limit the abilities of dishonest agents. For example, various relativistic bit commitment protocols have been proposed. Although it has been shown that bit commitment is sufficient to construct oblivious transfer and thus multiparty computation, composing specific relativistic protocols in this way is known to be insecure…
Device-independent quantum cryptography allows security even if the devices used to execute the protocol are untrusted - whether this is due to unknown imperfections in the implementation, or because the adversary himself constructed them to subvert the security of the protocol. While device-independence has seen much attention in the domain of quantum key distribution, relatively little is known for general protocols. Here we introduce a new model for device-independence for two-party protocols and position verification in the noisy-storage model. For the first time, we show that such protoco…
A set of schemes for secure quantum communication are analyzed under the influence of non-Markovian channels. By comparing with the corresponding Markovian cases, it is seen that the average fidelity in all these schemes can be maintained for relatively longer periods of time. The effects of non-Markovian noise on a number of facets of quantum cryptography, such as quantum secure direct communication, deterministic secure quantum communication and their controlled counterparts, quantum dialogue, quantum key distribution, quantum key agreement, etc., have been extensively investigated. Specific…
We consider the implementation of two-party cryptographic primitives based on the sole assumption that no large-scale reliable quantum storage is available to the cheating party. We construct novel protocols for oblivious transfer and bit commitment, and prove that realistic noise levels provide security even against the most general attack. Such unconditional results were previously only known in the so-called bounded-storage model which is a special case of our setting. Our protocols can be implemented with present-day hardware used for quantum key distribution. In particular, no quantum sto…
Secure two-party cryptography is possible if the adversary's quantum storage device suffers imperfections. For example, security can be achieved if the adversary can store strictly less then half of the qubits transmitted during the protocol. This special case is known as the bounded-storage model, and it has long been an open question whether security can still be achieved if the adversary's storage were any larger. Here, we answer this question positively and demonstrate a two-party protocol which is secure as long as the adversary cannot store even a small fraction of the transmitted pulses…
Quantum cryptography was proposed as a counter to the capacity of quantum computers to break classical cryptosystems. A broad subclass of quantum cryptography, called quantum key distribution (QKD), relies on quantum mechanical process for secure distribution of the keys. Quantum channels are inherently noisy, and therefore these protocols will be susceptible to noise as well. In this paper, we study the performance of two QKD protocols - BB84 and E91 under thermal relaxation error. We show that while E91 protocol loses its security immediately due to loss of entanglement, the performance of B…
We investigate robustness of probabilistic storage and retrieval device optimized for phase gates to noise. We use noisy input composed of convex combination of unitary channel with either depolarizing or dephasing channel. We find out that the resistance to dephasing noise is higher than to depolarization. Interestingly, for the depolarisation the retrieval reduces the degree of noise. We also examine the possible realizations showing that their performance is different when the noise is present.
A quantum key distribution system may be probed by an eavesdropper Eve by sending in bright light from the quantum channel and analyzing the back-reflections. We propose and experimentally demonstrate a setup for mounting such a Trojan-horse attack. We show it in operation against the quantum cryptosystem Clavis2 from ID~Quantique, as a proof-of-principle. With just a few back-reflected photons, Eve discerns Bob's secret basis choice, and thus the raw key bit in the Scarani-Acín-Ribordy-Gisin 2004 protocol, with higher than 90% probability. This would clearly breach the security of the cryptos…
We give an exponential separation between one-way quantum and classical communication complexity for a Boolean function. Earlier such a separation was known only for a relation. A very similar result was obtained earlier but independently by Kerenidis and Raz [KR06]. Our version of the result gives an example in the bounded storage model of cryptography, where the key is secure if the adversary has a certain amount of classical storage, but is completely insecure if he has a similar amount of quantum storage.
In quantum key distribution implementations, each session is typically chosen long enough so that the secret key rate approaches its asymptotic limit. However, this choice may be constrained by the physical scenario, as in the perspective use with satellites, where the passage of one terminal over the other is restricted to a few minutes. Here we demonstrate experimentally the extraction of secure keys leveraging an optimal design of the prepare-and-measure scheme, according to recent finite-key theoretical tight-bounds. The experiment is performed in different channel conditions, and assuming…
The present thesis deals with various methods of quantum error correction. It is divided into two parts. In the first part, dynamical decoupling methods are considered which have the task of suppressing the influence of residual imperfections in a quantum memory. The suppression is achieved by altering the dynamics of an imperfect quantum memory with the help of a sequence of local unitary operations applied to the qudits. Whereas up to now the operations of such decoupling sequences have been constructed in a deterministic fashion, strategies are developed in this thesis which construct the o…
We study information storage in noisy quantum registers and computers using the methods of statistical dynamics. We develop the concept of a strictly contractive quantum channel in order to construct mathematical models of physically realizable, i.e., nonideal, quantum registers and computers. Strictly contractive channels are simple enough, yet exhibit very interesting features, which are meaningful from the physical point of view. In particular, they allow us to incorporate the crucial assumption of finite precision of all experimentally realizable operations. Strict contractivity also helps…
The noisy binary linear problem (NBLP) is known as a computationally hard problem, and therefore, it offers primitives for post-quantum cryptography. An efficient quantum NBLP algorithm that exhibits a polynomial quantum sample and time complexities has recently been proposed. However, the algorithm requires a large number of samples to be loaded in a highly entangled state and it is unclear whether such a precondition on the quantum speedup can be obtained efficiently. Here, we present a complete analysis of the quantum solvability of the NBLP by considering the entire algorithm process, name…
We propose a wide class of distillation schemes for multi-partite entangled states that are CSS-states. Our proposal provides not only superior efficiency, but also new insights on the connection between CSS-states and bipartite graph states. We then apply our distillation schemes to the tri-partite case for three cryptographic tasks--namely, (a) conference key agreement, (b) quantum sharing of classical secrets and (c) third-man cryptography. Moreover, we construct ``prepare-and-measure'' protocols for the above three cryptographic tasks which can be implemented with the generation of only a …
Conditional detection is an important tool to extract weak signals from a noisy background and is closely linked to heralding, which is an essential component of protocols for long distance quantum communication and distributed quantum information processing in quantum networks. Here we demonstrate the conditional detection of time-bin qubits after storage in and retrieval from a photon-echo based waveguide quantum memory. Each qubit is encoded into one member of a photon-pair produced via spontaneous parametric down conversion, and the conditioning is achieved by the detection of the other me…
A quantum random-number generator (QRNG) can theoretically generate unpredictable random numbers with perfect devices and is an ideal and secure source of random numbers for cryptography. However, the practical implementations always contain imperfections, which will greatly influence the randomness of the final output and even open loopholes to eavesdroppers. Recently, Thewes et al. experimentally demonstrated a continuous-variable eavesdropping attack, based on heterodyne detection, on a trusted continuous-variable QRNG in Phys. Rev. A 100, 052318 (2019), yet like in many other practical con…
The problem of sharing entanglement over large distances is crucial for implementations of quantum cryptography. A possible scheme for long-distance entanglement sharing and quantum communication exploits networks whose nodes share Einstein-Podolsky-Rosen (EPR) pairs. In Perseguers et al. [Phys. Rev. A 78, 062324 (2008)] the authors put forward an important isomorphism between storing quantum information in a dimension $D$ and transmission of quantum information in a $D+1$-dimensional network. We show that it is possible to obtain long-distance entanglement in a noisy two-dimensional (2D) netw…
We give an entanglement assisted scheme for quantum key distribution. The scheme requires the maximally entangled 2-qubit state but does not require any quantum storage. The scheme is unconditionally secure under whatever Eve's attack. Given the symmetric noisy channel with uncorrelated noise, our scheme can tolerate the bit error rate up to 26% in the 4-state case and 30% in the 6-state respectively, respectively. These values are higher than those of all currently known two-level-state schemes without using a quantum storage.
Large-scale quantum-correlated networks could transform technologies ranging from communications and cryptography to computation, metrology, and simulation of novel materials. Critical to achieving such quantum enhancements is distributing high-quality entanglement between distant nodes. This is made possible in the unavoidable presence of decoherence by entanglement distillation. However, current versions of this protocol are prohibitively costly in terms of resources. We introduce a new scheme for continuous-variable entanglement distillation that requires only linear temporal and constant p…
Uncertainty relations lie at the very core of quantum mechanics, and form the cornerstone of essentially all quantum cryptographic applications. In particular, they play an important role in cryptographic protocols in the bounded-quantum-storage model, where proving the security of all existing protocols ultimately reduces to bounding such relations. Yet, very little is known about such uncertainty relations for more than two measurements. Here, we prove optimal entropic uncertainty relations for anti-commuting binary observables for the Shannon entropy, and nearly optimal relations for the co…
Recent work by Bravyi et al. constructs a relation problem that a noisy constant-depth quantum circuit (QNC$^0$) can solve with near certainty (probability $1 - o(1)$), but that any bounded fan-in constant-depth classical circuit (NC$^0$) fails with some constant probability. We show that this robustness to noise can be achieved in the other low-depth quantum/classical circuit separations in this area. In particular, we show a general strategy for adding noise tolerance to the interactive protocols of Grier and Schaeffer. As a consequence, we obtain an unconditional separation between noisy QN…
Typical address-oriented computer memories cannot recognize incomplete or noisy information. Associative (content-addressable) memories solve this problem but suffer from severe capacity shortages. I propose a model of a quantum memory that solves both problems. The storage capacity is exponential in the number of qbits and thus optimal. The retrieval mechanism for incomplete or noisy inputs is probabilistic, with postselection of the measurement result. The output is determined by a probability distribution on the memory which is peaked around the stored patterns closest in Hamming distance t…
