盲量子计算[A. Broadbent、J. Fitzsimons和E. Kashefi，Proceedings of the 50 th Annual IEEE Symposium on Foundations of Computer Science 517（2009）]是一种安全的云量子计算协议，其使得客户端（其没有足够的量子技术供其支配）能够将其量子计算委托给服务器（其具有通用量子计算机），而不向服务器泄露任何相关信息。在[T. Morimae和K. Fujii，Phys.Rev.A { \bf 87}，050301（R）（2013）]，提出了一种新的盲量子计算协议，所谓的测量-Alice协议。该协议提供了几个优点，比以前的协议，如设备无关的安全性，客户端的要求较低，和一个更简单，更强大的安全性的基础上无信令的原则。本文利用构造密码学[U。Maurer，Proceedings of Theory of Security and Applications，TOSCA 2011，第33-56页。Springer（2011）]。度量Alice协议的上述优点使得组合安全性的证明更加直观和透明。
英文摘要：
Blind quantum computing [A. Broadbent, J. Fitzsimons, and E. Kashefi, Proceedings of the 50th Annual IEEE Symposium on Foundations of Computer Science 517 (2009)] is a secure cloud quantum computing protocol which enables a client (who does not have enough quantum technology at her disposal) to delegate her quantum computation to a server (who has a universal quantum computer) without leaking any relevant information to the server. In [T. Morimae and K. Fujii, Phys. Rev. A {\bf87}, 050301(R) (2013)], a new blind quantum computing protocol, so called the measuring-Alice protocol, was proposed. This protocol offers several advantages over previous protocols, such as the device-independent security, less demanding requirements for the client, and a simpler and stronger security based on the no-signaling principle. In this paper, we show composable security of the measuring-Alice protocol by using the formalism of the constructive cryptography [U. Maurer, Proceedings of Theory of Security and Applications, TOSCA 2011, pages 33-56. Springer (2011)]. The above advantages of measuring-Alice protocol enable more intuitive and transparent proofs for the composable security.
We consider a setup in which the channel from Alice to Bob is less noisy than the channel from Eve to Bob. We show that there exist encoding and decoding which accomplish error correction and authentication simultaneously; that is, Bob is able to correctly decode a message coming from Alice and reject a message coming from Eve with high probability. The system does not require any secret key shared between Alice and Bob, provides information theoretic security, and can safely be composed with other protocols in an arbitrary context.
We introduce a simple protocol for verifiable measurement-only blind quantum computing. Alice, a client, can perform only single-qubit measurements, whereas Bob, a server, can generate and store entangled many-qubit states. Bob generates copies of a graph state, which is a universal resource state for measurement-based quantum computing, and sends Alice each qubit of them one by one. Alice adaptively measures each qubit according to her program. If Bob is honest, he generates the correct graph state, and therefore Alice can obtain the correct computation result. Regarding the security, whateve…
Blind quantum computation is a two-party protocol which involves a server Bob who has rich quantum computational resource and provides quantum computation service and a client Alice who wants to delegate her quantum computation to Bob without revealing her quantum algorithms and her input to (resp., output from) the algorithms. Since Bob may be truant and pretend to execute some computation, Alice wants to verify Bob's computation. Verifiable blind quantum computation enables Alice to check whether Bob is cheating or not. If Bob is cheating and claims his innocence, Alice can refute the denial…
Measurement-device-independent quantum key distribution protocol, whose security analysis does not rely on any assumption on the detection system, can immune the attacking against detectors. We give a first composable security analysis for continuous-variable measurement-device-independent quantum key distribution using squeezed states against general coherent attacks. The security analysis is derived based on the entanglement-based scheme considering finite size effect. A version of entropic uncertainty relation is exploited to give a lower bound on the conditional smooth min-entropy by trust…
Blind quantum computation (BQC) allows a client (Alice), who only possesses relatively poor quantum devices, to delegate universal quantum computation to a server (Bob) in such a way that Bob cannot know Alice's inputs, algorithm, and outputs. The quantum channel between Alice and Bob is noisy, and the loss over the long-distance quantum communication should also be taken into account. Here we propose to use decoherence-free subspace (DFS) to overcome the collective noise in the quantum channel for BQC, which we call DFS-BQC. We propose three variations of DFS-BQC protocols. One of them, a coh…
Blind quantum computation (BQC) is a new type of quantum computation model. BQC allows a client (Alice) who does not have enough sophisticated technology and knowledge to perform universal quantum computation and resorts a remote quantum computation server (Bob) to delegate universal quantum computation. During the computation, Bob cannot know Alice's inputs, algorithm and outputs. In single-server BQC protocol, it requires Alice to prepare and distribute single-photon states to Bob. Unfortunately, the distributed single photons will suffer from noise, which not only makes the single-photon st…
Delegating difficult computations to remote large computation facilities, with appropriate security guarantees, is a possible solution for the ever-growing needs of personal computing power. For delegated computation protocols to be usable in a larger context---or simply to securely run two protocols in parallel---the security definitions need to be composable. Here, we define composable security for delegated quantum computation. We distinguish between protocols which provide only blindness---the computation is hidden from the server---and those that are also verifiable---the client can check…
A broadcasting multiple blind signature scheme based on quantum GHZ entanglement has been presented recently by Tian et al. It is said that the scheme's unconditional security is guaranteed by adopting quantum key preparation, quantum encryption algorithm and quantum entanglement. In this paper, we prove that each signatory can get the signed message just by an intercept-resend attack. Then, we show there still exists some participant attacks and external attacks. Specifically, we verify the message sender Alice can impersonate each signatory to sign the message at will, and so is the signatur…
How correlated are two quantum systems from the perspective of a third? We answer this by providing an optimal quantum state redistribution protocol for multipartite product sources. Specifically, given an arbitrary quantum state of three systems, where Alice holds two and Bob holds one, we identify the cost, in terms of quantum communication and entanglement, for Alice to give one of her parts to Bob. The communication cost gives the first known operational interpretation to quantum conditional mutual information. The optimal procedure is self-dual under time reversal and is perfectly composa…
We introduce a protocol between a classical polynomial-time verifier and a quantum polynomial-time prover that allows the verifier to securely delegate to the prover the preparation of certain single-qubit quantum states. The protocol realizes the following functionality, with computational security: the verifier chooses one of the observables $Z$, $X$, $Y$, $(X+Y)/\sqrt{2}$, $(X-Y)/\sqrt{2}$; the prover receives a uniformly random eigenstate of the observable chosen by the verifier; the verifier receives a classical description of that state. The prover is unaware of which state he received a…
Recent research in quantum cryptography has led to the development of schemes that encrypt and authenticate quantum messages with computational security. The security definitions used so far in the literature are asymptotic, game-based, and not known to be composable. We show how to define finite, composable, computational security for secure quantum message transmission. The new definitions do not involve any games or oracles, they are directly operational: a scheme is secure if it transforms an insecure channel and a shared key into an ideal secure channel from Alice to Bob, i.e., one which …
Here we extend the concept of blind client-server quantum computation, in which a client with limited quantum power controls the execution of a quantum computation on a powerful server, without revealing any details of the computation. Our extension is to introduce a three-node setting in which an oracular quantum computation can be executed blindly. In this Blind Oracular Quantum Computation (BOQC), the oracle (Oscar) is another node, with limited power, who acts in cooperation with the client (Alice) to supply quantum information to the server so that the oracle part of the quantum computati…
We present a scheme for teleporting an unknown, two-particle entangled state with a message from a sender (Alice) to a receiver (Bob) via a six-particle entangled channel. We also present another scheme for teleporting an unknown one-particle entangled state with a message transmitted in a two-way form between the same sender and receiver via a five-qubit cluster state. One-way hash functions, Bell-state measurements, and unitary operations are adopted in these two schemes. Our schemes use the physical characteristics of quantum mechanics to implement delegation, signature, and verification pr…
Private set intersection is an important problem with implications in many areas, ranging from remote diagnostics to private contact discovery. In this work, we consider the case of two-party PSI in the honest-but-curious setting. We propose a protocol that solves the server-aided PSI problem using delegated blind quantum computing. More specifically, the proposed protocol allows Alice and Bob (who do not have any quantum computational resources or quantum memory) to interact with Steve (who has a quantum computer) in order for Alice and Bob to obtain set intersection such that privacy is pres…
With the development of delegated quantum computation, clients will want to ensure confidentiality of their data and algorithms, and the integrity of their computations. While protocols for blind and verifiable quantum computation exist, they suffer from high overheads and from over-sensitivity: When running on noisy devices, imperfections trigger the same detection mechanisms as malicious attacks, resulting in perpetually aborted computations. We introduce the first blind and verifiable protocol for delegating BQP computations to a powerful server with repetition as the only overhead. It is c…
We propose a new composable and information-theoretically secure protocol to verify that a server has the power to sample from a sub-universal quantum machine implementing only commuting gates. By allowing the client to manipulate single qubits, we exploit properties of Measurement based Blind Quantum Computing to prove security against a malicious Server and therefore certify quantum supremacy without the need for a universal quantum computer.
In the standard oracle model, an oracle efficiently evaluates an unknown classical function independent of the quantum algorithm itself. Quantum algorithms have a complex interrelationship to their oracles; for example the possibility of quantum speedup is affected by the manner by which oracles are implemented. Therefore, it is physically meaningful to separate oracles from their quantum algorithms, and we introduce one such separation here. We define the Blind Oracular Quantum Computation (BOQC) scheme, in which the oracle is a distinct node in a quantum network. Our work augments the client…
Unclonable Encryption, introduced by Gottesman in 2003, is a quantum protocol that guarantees the secrecy of a successfully transferred classical message even when all keys leak at a later time. We propose an Unclonable Encryption protocol with the additional property that the sender's key material is allowed to leak even in the case of an unsuccessful run. This extra feature makes it possible to achieve secure quantum encryption even when one of the parties is unable to protect its keys against after-protocol theft. Such an asymmetry occurs e.g. in case of server-client scenarios, where the c…
Composable, unconditional security without a Quantum secret key: public broadcast channels and their conceptualizations, adaptive bit transmission rates, fidelity pruning under wiretaps
The question of whether a fully classical client can delegate a quantum computation to an untrusted quantum server while fully maintaining privacy (blindness) is one of the big open questions in quantum cryptography. Both yes and no answers have important practical and theoretical consequences, and the question seems genuinely hard. The state-of-the-art approaches to securely delegating quantum computation, without exception, rely on granting the client modest quantum powers, or on additional, non-communicating, quantum servers. In this work, we consider the single server setting, and push the…
Distributed computing is a fastest growing field -- enabling virtual computing, parallel computing, and distributed storage. By exploiting the counterfactual techniques, we devise a distributed blind quantum computation protocol to perform a universal two-qubit controlled unitary operation for any input state without using preshared entanglement and without exchanging physical particles between remote parties. This distributed protocol allows Bob to counterfactully apply an arbitrary unitary operator to Alice's qubit in probabilistic fashion, without revealing the operator to her, using a cont…
Plugging Leaks in Fault-Tolerant Quantum Computation and Verification
National Quantum Computing Centre, Rutherford Appleton Laboratory（拉瑟福德·阿普尔顿实验室国家量子计算中心）；School of Informatics, University of Edinburgh（爱丁堡大学信息学院）；Quandela；Département d’Informatique, Ecole Normale Supérieure（巴黎高等师范学院计算机科学系）
We present protocols for quantum key distribution in a prepare-and-measure setup with an asymmetric level of trust. While the device of the sender (Alice) is partially characterized, the receiver's (Bob's) device is treated as a black-box. The security of the protocols is based on the assumption that Alice's prepared states have limited overlaps, but no explicit bound on the Hilbert space dimension is required. The protocols are immune to attacks on the receiver's device, such as blinding attacks. The users can establish a secret key while continuously monitoring the correct functioning of the…
Quantum mechanical effects have enabled the construction of cryptographic primitives that are impossible classically. For example, quantum copy-protection allows for a program to be encoded in a quantum state in such a way that the program can be evaluated, but not copied. Many of these cryptographic primitives are two-party protocols, where one party, Bob, has full quantum computational capabilities, and the other party, Alice, is only required to send random BB84 states to Bob. In this work, we show how such protocols can generically be converted to ones where Alice is fully classical, assum…
Assume that Alice can do only classical probabilistic polynomial-time computing while Bob can do quantum polynomial-time computing. Alice and Bob communicate over only classical channels, and finally Bob gets a state $|x_0\rangle+|x_1\rangle$ with some bit strings $x_0$ and $x_1$. Is it possible that Alice can know $\{x_0,x_1\}$ but Bob cannot? Such a task, called {\it remote state preparations}, is indeed possible under some complexity assumptions, and is bases of many quantum cryptographic primitives such as proofs of quantumness, (classical-client) blind quantum computing, (classical) verif…
The continuous-variable quantum key distribution with entanglement in the middle, a semi-device-independent protocol, places the source at the untrusted third party between Alice and Bob, and thus has the advantage of high levels of security with the purpose of eliminating the assumptions about the source device. However, previous works considered the collective-attack analysis, which inevitably assumes that the states of the source has an identical and independently distributed (i.i.d) structure, and limits the application of the protocol. To solve this problem, we modify the original protoco…
We discuss quantum key distribution protocols and their security analysis, considering a receiver-device-independent (RDI) model. The sender's (Alice's) device is partially characterized, in the sense that we assume bounds on the overlaps of the prepared quantum states. The receiver's (Bob's) device requires no characterisation and can be represented as a black-box. Our protocols are therefore robust to any attack on Bob, such as blinding attacks. In particular, we show that a secret key can be established even when the quantum channel has arbitrarily low transmission by considering RDI protoc…
We model (interactive) resources that provide Alice with a string $X$ and a guarantee that any Eve interacting with her interface of the resource obtains a (quantum) system $E$ such that the conditional (smooth) min-entropy of $X$ given $E$ is lower bounded by some $k$. This (abstract) resource specification encompasses any setting that results in the honest players holding such a string (or aborting). For example, it could be constructed from, e.g., noisy channels, quantum key distribution (QKD), or a violation of Bell inequalities, which all may be used to derive bounds on the min-entropy of…
In blind compression of quantum states, a sender Alice is given a specimen of a quantum state $ρ$ drawn from a known ensemble (but without knowing what $ρ$ is), and she transmits sufficient quantum data to a receiver Bob so that he can decode a near perfect specimen of $ρ$. For many such states drawn iid from the ensemble, the asymptotically achievable rate is the number of qubits required to be transmitted per state. The Holevo information is a lower bound for the achievable rate, and is attained for pure state ensembles, or in the related scenario of entanglement-assisted visible compression…
Secure delegated quantum computing allows a computationally weak client to outsource an arbitrary quantum computation to an untrusted quantum server in a privacy-preserving manner. One of the promising candidates to achieve classical delegation of quantum computation is classical-client remote state preparation ($RSP_{CC}$), where a client remotely prepares a quantum state using a classical channel. However, the privacy loss incurred by employing $RSP_{CC}$ as a sub-module is unclear. In this work, we investigate this question using the Constructive Cryptography framework by Maurer and Renner …
