We study quantum protocols among two distrustful parties. Under the sole assumption of correctness - guaranteeing that honest players obtain their correct outcomes - we show that every protocol implementing a non-trivial primitive necessarily leaks information to a dishonest player. This extends known impossibility results to all non-trivial primitives. We provide a framework for quantifying this leakage and argue that leakage is a good measure for the privacy provided to the players by a given protocol. Our framework also covers the case where the two players are helped by a trusted third party. We show that despite the help of a trusted third party, the players cannot amplify the cryptographic power of any primitive. All our results hold even against quantum honest-but-curious adversaries who honestly follow the protocol but purify their actions and apply a different measurement at the end of the protocol. As concrete examples, we establish lower bounds on the leakage of standard universal two-party primitives such as oblivious transfer.
Quantum communication has demonstrated its usefulness for quantum cryptography far beyond quantum key distribution. One domain is two-party cryptography, whose goal is to allow two parties who may not trust each other to solve joint tasks. Another interesting application is position-based cryptography whose goal is to use the geographical location of an entity as its only identifying credential. Unfortunately, security of these protocols is not possible against an all powerful adversary. However, if we impose some realistic physical constraints on the adversary, there exist protocols for which…
The goal of two-party cryptography is to enable two parties, Alice and Bob, to solve common tasks without the need for mutual trust. Examples of such tasks are private access to a database, and secure identification. Quantum communication enables security for all of these problems in the noisy-storage model by sending more signals than the adversary can store in a certain time frame. Here, we initiate the study of device-independent protocols for two-party cryptography in the noisy-storage model. Specifically, we present a relatively easy to implement protocol for a cryptographic building bloc…
Any two-party cryptographic primitive can be implemented using quantum communication under the assumption that it is difficult to store a large number of quantum states perfectly. However, achieving reliable quantum communication over long distances remains a difficult problem. Here, we consider a large network of nodes with only neighboring quantum links. We exploit properties of this cloud of nodes to enable any two nodes to achieve security even if they are not directly connected. Our results are based on techniques from classical cryptography and do not resort to technologically difficult …
Entanglement between three or more parties exhibits a realm of properties unknown to two-party states. Bipartite states are easily classified using the Schmidt decomposition. The Schmidt coefficients of a bipartite pure state encompass all the non-local properties of the state and can be "seen" by looking at one party's density matrix only. Pure states of three and more parties however lack such a simple form. They have more invariants under local unitary transformations than any one party can "see" on their sub-system. These "hidden non-localities" will allow us to exhibit a class of multipar…
Device-independent quantum cryptography allows security even if the devices used to execute the protocol are untrusted - whether this is due to unknown imperfections in the implementation, or because the adversary himself constructed them to subvert the security of the protocol. While device-independence has seen much attention in the domain of quantum key distribution, relatively little is known for general protocols. Here we introduce a new model for device-independence for two-party protocols and position verification in the noisy-storage model. For the first time, we show that such protoco…
We study quantum protocols among two distrustful parties. By adopting a rather strict definition of correctness - guaranteeing that honest players obtain their correct outcomes only - we can show that every strictly correct quantum protocol implementing a non-trivial classical primitive necessarily leaks information to a dishonest player. This extends known impossibility results to all non-trivial primitives. We provide a framework for quantifying this leakage and argue that leakage is a good measure for the privacy provided to the players by a given protocol. Our framework also covers the cas…
Cryptanalysis is an important branch in the study of cryptography, including both the classical cryptography and the quantum one. In this paper we analyze the security of two three-party quantum key distribution protocols (QKDPs) proposed recently, and point out that they are susceptible to a simple and effective attack, i.e. the dense-coding attack. It is shown that the eavesdropper Eve can totally obtain the session key by sending entangled qubits as the fake signal to Alice and performing collective measurements after Alice's encoding. The attack process is just like a dense-coding communic…
We show that non-maximally entangled states can be used to build a quantum key distribution (QKD) scheme whose security and key rate transmission is nearly equivalent to those of standard QKD protocols. These aspects can be controlled by using the new free parameter in the present scheme, namely, the degree of partial entanglement. Furthermore, we discuss how to build a controlled QKD scheme, also based on partially entangled states, where a third party can decide whether or not Alice and Bob are allowed to share a key.
Non-local boxes are hypothetical ``machines'' that give rise to superstrong non-local correlations, leading to a stronger violation of Bell/CHSH inequalities than is possible within the framework of quantum mechanics. We show how non-local boxes can be used to perform any two-party secure computation. We first construct a protocol for bit commitment and then show how to achieve oblivious transfer using non-local boxes. Both have been shown to be impossible using quantum mechanics alone.
Multiparty quantum cryptography based on distributed entanglement will find its natural application in the upcoming quantum networks. The security of many multipartite device-independent (DI) protocols, such as DI conference key agreement, relies on bounding the von Neumann entropy of the parties' outcomes conditioned on the eavesdropper's information, given the violation of a multipartite Bell inequality. We consider three parties testing the Mermin-Ardehali-Belinskii-Klyshko (MABK) inequality and certify the privacy of their outcomes by bounding the conditional entropy of a single party's ou…
A significant branch of classical cryptography deals with the problems which arise when mistrustful parties need to generate, process or exchange information. As Kilian showed a while ago, mistrustful classical cryptography can be founded on a single protocol, oblivious transfer, from which general secure multi-party computations can be built. The scope of mistrustful quantum cryptography is limited by no-go theorems, which rule out, inter alia, unconditionally secure quantum protocols for oblivious transfer or general secure two-party computations. These theorems apply even to protocols which…
Secure multi-party computing, also called "secure function evaluation", has been extensively studied in classical cryptography. We consider the extension of this task to computation with quantum inputs and circuits. Our protocols are information-theoretically secure, i.e. no assumptions are made on the computational power of the adversary. For the weaker task of verifiable quantum secret sharing, we give a protocol which tolerates any t < n/4 cheating parties (out of n). This is shown to be optimal. We use this new tool to show how to perform any multi-party quantum computation as long as the …
We study the cryptographic primitive Oblivious Transfer; a composable construction of this resource would allow arbitrary multi-party computation to be carried out in a secure way, i.e. to compute functions in a distributed way while keeping inputs from different parties private. First we review a framework that allows us to analyze composability of classical and quantum cryptographic protocols in special relativity: Abstract Cryptography implemented with Causal Boxes. We then (1) explore and formalize different versions of oblivious transfer found in the literature, (2) prove that their equiv…
Multipartite cryptography is useful for some particular missions. In this paper, we present a quantum key distribution scheme in which three separated observers can securely share a set of keys by using a sequence of $3$-particle GHZ states. We prove that the violation of Svetlichny's inequality can be utilized to test for eavesdropping, and even when the eavesdropper can completely control the outcomes of two participants' measurements, our scheme still ensures the security of the keys distribution. This scheme can be easily extended to the case of $N$-party keys distribution, and the violati…
We consider a game in which two separate laboratories collaborate to prepare a quantum system and are then asked to guess the outcome of a measurement performed by a third party in a random basis on that system. Intuitively, by the uncertainty principle and the monogamy of entanglement, the probability that both players simultaneously succeed in guessing the outcome correctly is bounded. We are interested in the question of how the success probability scales when many such games are performed in parallel. We show that any strategy that maximizes the probability to win every game individually i…
One of the central themes in classical cryptography is multi-party computation, which performs joint computation on multiple participants' data while maintaining data privacy. The extension to the quantum regime was proposed in 2002, but despite two decades of research, the current state-of-the-art multi-party quantum computation protocol for a fixed number of parties (even 2 parties) requires unbounded rounds of communication, which greatly limit its practical usage. In this work, we propose the first constant-round multi-party quantum computation protocol for a fixed number of parties agains…
We present a three-stage quantum cryptographic protocol guaranteeing security in which each party uses its own secret key. Unlike the BB84 protocol, where the qubits are transmitted in only one direction and classical information exchanged thereafter, the communication in the proposed protocol remains quantum in each stage. A related system of key distribution is also described.
Cryptography without Long-Term Quantum Memory and Global Entanglement: Classical Setups for One-Time Programs, Copy Protection, and Stateful Obfuscation
Here we propose a general relativistic quantum framework for cryptography that exploits the fascinating connection of quantum non-locality and special theory of relativity with cryptography. The underlying principle of unconditional security is causality and two-fold quantum non-local correlations: first entanglement swapping and then teleportation over causally independent entangled systems. We show that the proposed framework has following remarkable and novel features in mistrustful cryptography: (i) It helps in defining a new notion of oblivious transfer where both the data transferred and…
Position-based quantum cryptography (PBQC) allows a party to use its geographical location as its only credential to implement various cryptographic protocols. Such a protocol may lead to important applications in practice. Although it has been shown that any PBQC protocol is breakable if the adversaries pre-share an arbitrarily large entangled state, the security of PBQC in the bounded-quantum-storage model is still an open question. In this paper, we study the performance of various PBQC protocols over a lossy channel under the assumption that no entanglement is pre-shared between adversarie…
A fundamental task in modern cryptography is the joint computation of a function which has two inputs, one from Alice and one from Bob, such that neither of the two can learn more about the other's input than what is implied by the value of the function. In this Letter, we show that any quantum protocol for the computation of a classical deterministic function that outputs the result to both parties (two-sided computation) and that is secure against a cheating Bob can be completely broken by a cheating Alice. Whereas it is known that quantum protocols for this task cannot be completely secure,…
Tomography of the two qubit density matrix shared by Alice and Bob is an essential ingredient for guaranteeing an acceptable margin of confidentiality during the establishment of a secure fresh key through the Quantum Key Distribution (QKD) scheme. We show how the Singapore protocol for key distribution is optimal from this point of view, due to the fact that it is based on so called SIC POVM qubit tomography which allows the most accurate full tomographic reconstruction of an unknown density matrix on the basis of a restricted set of experimental data. We illustrate with the help of experimen…
To construct a quantum network with many end users, it is critical to have a cost-efficient way to distribute entanglement over different network ends. We demonstrate an entanglement access network, where the expensive resource, the entangled photon source at the telecom wavelength and the core communication channel, is shared by many end users. Using this cost-efficient entanglement access network, we report experimental demonstration of a secure multiparty computation protocol, the privacy-preserving secure sum problem, based on the network quantum cryptography.
Understanding the structure of nonlocal correlations is important in many fields ranging from fundamental questions of physics to device-independent cryptography. We present a protocol that can convert extremal two-party--two-input nonlocal no-signaling boxes of any type into any other extremal two-party--two-input nonlocal no-signaling box perfectly. Our results are exact, and even though the number of required boxes cannot be determined in advance, their expected number is finite. Our protocol is adaptive and demonstrates for the first time the usefulness of using no-signaling boxes in diffe…
A new commitment scheme based on position-verification and non-local quantum correlations is presented here for the first time in literature. The only credential for unconditional security is the position of committer and non-local correlations generated; neither receiver has any pre-shared data with the committer nor does receiver require trusted and authenticated quantum/classical channels between him and the committer. In the proposed scheme, receiver trusts the commitment only if the scheme itself verifies position of the committer and validates her commitment through non-local quantum cor…
We investigate a fundamental property of device independent security in quantum cryptography by characterizing probability distributions which are necessarily independent of the measurement results of any eavesdropper. We show that probability distributions that are secure in this sense are exactly the extremal quantum probability distributions. This allows us to give a characterization of security in algebraic terms. We apply the method to common examples for two-party as well as multi-party setups and present a scheme for verifying security of probability distributions with two parties, two …
Quantum mechanical effects have enabled the construction of cryptographic primitives that are impossible classically. For example, quantum copy-protection allows for a program to be encoded in a quantum state in such a way that the program can be evaluated, but not copied. Many of these cryptographic primitives are two-party protocols, where one party, Bob, has full quantum computational capabilities, and the other party, Alice, is only required to send random BB84 states to Bob. In this work, we show how such protocols can generically be converted to ones where Alice is fully classical, assum…
In this work, we study position-based cryptography in the quantum setting. The aim is to use the geographical position of a party as its only credential. On the negative side, we show that if adversaries are allowed to share an arbitrarily large entangled quantum state, no secure position-verification is possible at all. We show a distributed protocol for computing any unitary operation on a state shared between the different users, using local operations and one round of classical communication. Using this surprising result, we break any position-verification scheme of a very general form. On…
We examine a situation in which an information-carrying signal is sent from two sources to a common receiver. The radiation travels through free space in the presence of noise. The information resides in a relationship between the two beams. We inquire into whether itis possible, in principle, that the locations of the transmitters can be concealed from a party who receives the radiation and decodes the information. Direction finding entails making a set of measurements on asignal and constructing an analytic continuation of the time dependent fields from the results. The fact that this proces…
Cryptographic protocols, such as protocols for secure function evaluation (SFE), have played a crucial role in the development of modern cryptography. The extensive theory of these protocols, however, deals almost exclusively with classical attackers. If we accept that quantum information processing is the most realistic model of physically feasible computation, then we must ask: what classical protocols remain secure against quantum attackers? Our main contribution is showing the existence of classical two-party protocols for the secure evaluation of any polynomial-time function under reasona…
We show how to implement cryptographic primitives based on the realistic assumption that quantum storage of qubits is noisy. We thereby consider individual-storage attacks, i.e. the dishonest party attempts to store each incoming qubit separately. Our model is similar to the model of bounded-quantum storage, however, we consider an explicit noise model inspired by present-day technology. To illustrate the power of this new model, we show that a protocol for oblivious transfer (OT) is secure for any amount of quantum-storage noise, as long as honest players can perform perfect quantum operation…
Mediated semi-quantum key distribution (M-SQKD) permits two limited "semi-quantum" or "classical" users to establish a secret key with the help of a third party (TP), in which TP has fully quantum power and may be untrusted. Several protocols have been studied recently for two-party scenarios, but no one has considered M-SQKD for multi-party scenarios. In this paper, we design a circular M-SQKD protocol based on Bell states, which offers an approach to realizing multiple "classical" users' key distribution. Then, we prove the protocol is unconditional security in the asymptotic scenario. The p…
Quantum steering, loosely speaking the distribution of entanglement from an untrusted party, is a form of quantum nonlocality which is intermediate between entanglement and Bell nonlocality. Determining which states can be steered is important from a conceptual point of view, but also for applications, e.g. in quantum cryptography. Here we show that bound entanglement, although it represents the weakest form of entanglement, can nevertheless lead to quantum steering. This is done by noticing that steering inequalities can be derived from entropic uncertainty relations. Our result has implicati…
We introduce a new setting for two-party cryptography with temporarily trusted third parties. In addition to Alice and Bob in this setting, there are additional third parties, which Alice and Bob both trust to be honest during the protocol. However, once the protocol concludes, there is no guarantee over the behaviour of these third parties. It is possible that they collaborate and act adversarially. Our goal is to use these third parties to facilitate protocols which are impossible in two-party cryptography. We implement a variant of bit commitment in this setting, which we call erasable bit …
Quantum self-testing addresses the following question: is it possible to verify the existence of a multipartite state even when one's measurement devices are completely untrusted? This problem has seen abundant activity in the last few years, particularly with the advent of parallel self-testing (i.e., testing several copies of a state at once), which has applications not only to quantum cryptography but also quantum computing. In this work we give the first error-tolerant parallel self-test in a three-party (rather than two-party) scenario, by showing that an arbitrary number of copies of the…
Quantum secure direct communication (QSDC) and deterministic secure quantum communication (DSQC) are two important branches of quantum cryptography, where one can transmit a secret message securely without encrypting it by a prior key. In the practical scenario, an adversary can apply detector-side-channel attacks to get some non-negligible amount of information about the secret message. Measurement-device-independent (MDI) quantum protocols can remove this kind of detector-side-channel attack, by introducing an untrusted third party (UTP), who performs all the measurements during the protocol…
Device-independent quantum cryptographic schemes aim to guarantee security to users based only on the output statistics of any components used, and without the need to verify their internal functionality. Since this would protect users against untrustworthy or incompetent manufacturers, sabotage or device degradation, this idea has excited much interest, and many device-independent schemes have been proposed. Here we identify a critical weakness of device-independent protocols that rely on public communication between secure laboratories. Untrusted devices may record their inputs and outputs a…
We initiate the study of two-party cryptographic primitives with unconditional security, assuming that the adversary's quantum memory is of bounded size. We show that oblivious transfer and bit commitment can be implemented in this model using protocols where honest parties need no quantum memory, whereas an adversarial player needs quantum memory of size at least n/2 in order to break the protocol, where n is the number of qubits transmitted. This is in sharp contrast to the classical bounded-memory model, where we can only tolerate adversaries with memory of size quadratic in honest players'…
Non-local correlations are one of the most fascinating consequences of quantum physics from the point of view of information: Such correlations, although not allowing for signaling, are unexplainable by pre-shared information. The correlations have applications in cryptography, communication complexity, and sit at the very heart of many attempts of understanding quantum theory -- and its limits -- better in terms of classical information. In these contexts, the question is crucial whether such correlations can be distilled, i.e., whether weak correlations can be used for generating (a smaller …
An elementary derivation of best eavesdropping strategies for the 4 state BB84 quantum cryptography protocol is presented, for both incoherent and two--qubit coherent attacks. While coherent attacks do not help Eve to obtain more information, they are more powerful to reveal the whole message sent by Alice. Our results are based on symmetric eavesdropping strategies, which we show to be sufficient to analyze these kind of problems.
Cryptography's importance in our everyday lives continues to grow in our increasingly digital world. Oblivious transfer (OT) has long been a fundamental and important cryptographic primitive since it is known that general two-party cryptographic tasks can be built from this basic building block. Here we show the experimental implementation of a 1-2 random oblivious transfer (ROT) protocol by performing measurements on polarization-entangled photon pairs in a modified entangled quantum key distribution system, followed by all of the necessary classical post-processing including one-way error co…
Quantum information science breaks limitations of conventional information transfer, cryptography and computation by using quantum superpositions or entanglement as resources for information processing. Here, we report on the experimental realization of three-party quantum communication protocols using single three-level quantum system (qutrit) communication: secret sharing, detectable Byzantine agreement, and communication complexity reduction for a three-valued function. We have implemented these three schemes using the same optical fiber interferometric setup. Our realization is easily scal…
Einstein-Podolsky-Rosen (EPR) steering, a category of quantum nonlocal correlations describing the ability of one observer to influence another party's state via local measurements, is different from both entanglement and Bell nonlocality by possessing an asymmetric property. For multipartite EPR steering, the monogamous situation, where two observers cannot simultaneously steer the state of the third party, has been investigated rigorously both in theory and experiment. In contrast to the monogamous situation, the shareability of EPR steering in reduced subsystems allows the state of one part…
Quantum cryptography is the only approach to privacy ever proposed that allows two parties (who do not share a long secret key ahead of time) to communicate with provably perfect secrecy under the nose of an eavesdropper endowed with unlimited computational power and whose technology is limited by nothing but the fundamental laws of nature. This essay provides a personal historical perspective on the field. For the sake of liveliness, the style is purposely that of a spontaneous after-dinner speech.
Fundamental primitives such as bit commitment and oblivious transfer serve as building blocks for many other two-party protocols. Hence, the secure implementation of such primitives are important in modern cryptography. In this work, we present a bit commitment protocol which is secure as long as the attacker's quantum memory device is imperfect. The latter assumption is known as the noisy-storage model. We experimentally executed this protocol by performing measurements on polarization-entangled photon pairs. Our work includes a full security analysis, accounting for all experimental error ra…
We analyze the security of quantum cryptography schemes for $d$-level systems using 2 or $d+1$ maximally conjugated bases, under individual eavesdropping attacks based on cloning machines and measurement after the basis reconciliation. We consider classical advantage distillation protocols, that allow to extract a key even in situations where the mutual information between the honest parties is smaller than the eavesdropper's information. In this scenario, advantage distillation protocols are shown to be as powerful as quantum distillation: key distillation is possible using classical techniqu…
Network-centric quantum communications (NQC) - a new, scalable instantiation of quantum cryptography providing key management with forward security for lightweight encryption, authentication and digital signatures in optical networks - is briefly described. Results from a multi-node experimental test-bed utilizing integrated photonics quantum communications components, known as QKarDs, include: quantum identification; verifiable quantum secret sharing; multi-party authenticated key establishment, including group keying; and single-fiber quantum-secured communications that can be applied as a s…
A semi-quantum key distribution (SQKD) protocol allows two users, one of whom is restricted in their quantum capabilities, to establish a shared secret key, secure against an all-powerful adversary. In this paper, we design a new SQKD protocol using high-dimensional quantum states and conduct an information theoretic security analysis. We show that, similar to the fully-quantum key distribution case, high-dimensional systems can increase the noise tolerance in the semi-quantum case. Along the way, we prove several general security results which are applicable to other SQKD protocols (both high…
We extend the field of continuous-variable quantum cryptography to a network formulation where two honest parties connect to an untrusted relay by insecure quantum links. To generate secret correlations, they transmit coherent states to the relay where a continuous-variable Bell detection is performed and the outcome broadcast. Even though the detection could be fully corrupted and the links subject to optimal coherent attacks, the honest parties can still extract a secret key, achieving high rates when the relay is proximal to one party, as typical in public networks with access points or pro…
It had been widely claimed that quantum mechanics can protect private information during public decision in for example the so-called two-party secure computation. If this were the case, quantum smart-cards could prevent fake teller machines from learning the PIN (Personal Identification Number) from the customers' input. Although such optimism has been challenged by the recent surprising discovery of the insecurity of the so-called quantum bit commitment, the security of quantum two-party computation itself remains unaddressed. Here I answer this question directly by showing that all ``one-si…
We present a multi-partite protocol in a counterfactual paradigm. In counterfactual quantum cryptography, secure information is transmitted between two spatially separated parties even when there is no physical travel of particles transferring the information between them. We propose here a tripartite counterfactual quantum protocol for the task of certificate authorization. Here a trusted third party, Alice, authenticates an entity Bob (e.g., a bank) that a client Charlie wishes to securely transact with. The protocol is counterfactual with respect to either Bob or Charlie. We prove its secur…
It has been shown recently that the framework of quantum sampling, as introduced by Bouman and Fehr, can lead to new entropic uncertainty relations highly applicable to finite-key cryptographic analyses. Here we revisit these so-called sampling-based entropic uncertainty relations, deriving newer, more powerful, relations and applying them to source-independent quantum random number generators and high-dimensional quantum key distribution protocols. Along the way, we prove several interesting results in the asymptotic case for our entropic uncertainty relations. These sampling-based approaches…
It is well known that Shor's quantum algorithm for integer factorization can break down the RSA public-key cryptosystem, which is widely used in many cryptographic applications. Thus, public-key cryptosystems in the quantum computational setting are longed for cryptology. In order to define the security notions of public-key cryptosystems, we have to model the power of the sender, receiver, adversary and channel. While we may consider a setting where quantum computers are available only to adversaries, we generally discuss what are the right security notions for (quantum) public-key cryptosyst…
