Establishing the security of continuous-variable quantum key distribution against general attacks in a realistic finite-size regime is an outstanding open problem in the field of theoretical quantum cryptography if we restrict our attention to protocols that rely on the exchange of coherent states. Indeed, techniques based on the uncertainty principle are not known to work for such protocols, and the usual tools based on de Finetti reductions only provide security for unrealistically large block lengths. We address this problem here by considering a new type of Gaussian de Finetti reduction, that exploits the invariance of some continuous-variable protocols under the action of the unitary group $U(n)$ (instead of the symmetric group $S_n$ as in usual de Finetti theorems), and by introducing generalized $SU(2,2)$ coherent states. Our reduction shows that it is sufficient to prove the security of these protocols against Gaussian collective attacks in order to obtain security against general attacks, thereby confirming rigorously the widely held belief that Gaussian attacks are indeed optimal against such protocols.
In the realistic quantum key distribution (QKD), Alice and Bob respectively get a quantum state from an unknown channel, whose dimension may be unknown. However, while discussing the security, sometime we need to know exact dimension, since current exponential de Finetti theorem, crucial to the information-theoretical security proof, is deeply related with the dimension and can only be applied to finite dimensional case. Here we address this problem in detail. We show that if POVM elements corresponding to Alice and Bob's measured results can be well described in a finite dimensional subspace …
According to the quantum de Finetti theorem, if the state of an N-partite system is invariant under permutations of the subsystems then it can be approximated by a state where almost all subsystems are identical copies of each other, provided N is sufficiently large compared to the dimension of the subsystems. The de Finetti theorem has various applications in physics and information theory, where it is for instance used to prove the security of quantum cryptographic schemes. Here, we extend de Finetti's theorem, showing that the approximation also holds for infinite dimensional systems, as lo…
We introduce a general framework for de Finetti reduction results, applicable to various notions of partially exchangeable probability distributions. Explicit statements are derived for the cases of exchangeability, Markov exchangeability, and some generalizations of these. Our techniques are combinatorial and rely on the "BEST" theorem, enumerating the Eulerian cycles of a multigraph.
We propose various new techniques in quantum information theory, including a de Finetti style representation theorem for finite symmetric quantum states. As an application, we give a proof for the security of quantum key distribution which applies to arbitrary protocols.
The de Finetti representation theorem for continuous variable quantum system is first developed to approximate an N-partite continuous variable quantum state with a convex combination of independent and identical subsystems, which requires the original state to obey permutation symmetry conditioned on successful experimental verification on k of N subsystems. We generalize the de Finetti theorem to include asymmetric bounds on the variance of canonical observables and biased basis selection during the verification step. Our result thereby enables application of infinite-dimensional de Finetti …
De Finetti theorems show how sufficiently exchangeable states are well-approximated by convex combinations of i.i.d. states. Recently, it was shown that in many quantum information applications a more relaxed de Finetti reduction (i.e. only a matrix inequality between the symmetric state and one of de Finetti form) is enough, and that it leads to more concise and elegant arguments. Here we show several uses and general flexible applicability of a constrained de Finetti reduction in quantum information theory, which was recently discovered by Duan, Severini and Winter. In particular we show tha…
We use a recently discovered constrained de Finetti reduction (aka "Post-Selection Lemma") to study the parallel repetition of multi-player non-local games under no-signalling strategies. Since the technique allows us to reduce general strategies to independent plays, we obtain parallel repetition (corresponding to winning all rounds) in the same way as exponential concentration of the probability to win a fraction larger than the value of the game. Our proof technique leads us naturally to a relaxation of no-signalling (NS) strategies, which we dub sub-no-signalling (SNOS). While for two play…
We propose a general method for studying properties of quantum channels acting on an n-partite system, whose action is invariant under permutations of the subsystems. Our main result is that, in order to prove that a certain property holds for any arbitrary input, it is sufficient to consider the special case where the input is a particular de Finetti-type state, i.e., a state which consists of n identical and independent copies of an (unknown) state on a single subsystem. A similar statement holds for more general channels which are covariant with respect to the action of an arbitrary finite …
Quantum versions of de Finetti's theorem are powerful tools, yielding conceptually important insights into the security of key distribution protocols or tomography schemes and allowing to bound the error made by mean-field approaches. Such theorems link the symmetry of a quantum state under the exchange of subsystems to negligible quantum correlations and are well understood and established in the context of distinguishable particles. In this work, we derive a de Finetti theorem for finite sized Majorana fermionic systems. It is shown, much reflecting the spirit of other quantum de Finetti the…
We derive a bound for the security of QKD with finite resources under one-way post-processing, based on a definition of security that is composable and has an operational meaning. While our proof relies on the assumption of collective attacks, unconditional security follows immediately for standard protocols like Bennett-Brassard 1984 and six-states. For single-qubit implementations of such protocols, we find that the secret key rate becomes positive when at least N\sim 10^5 signals are exchanged and processed. For any other discrete-variable protocol, unconditional security can be obtained us…
We prove the security of Gaussian continuous-variable quantum key distribution against arbitrary attacks in the finite-size regime. The novelty of our proof is to consider symmetries of quantum key distribution in phase space in order to show that, to good approximation, the Hilbert space of interest can be considered to be finite-dimensional, thereby allowing for the use of the postselection technique introduced by Christandl, Koenig and Renner (Phys. Rev. Lett. 102, 020504 (2009)). Our result greatly improves on previous work based on the de Finetti theorem which could not provide security f…
We provide a security analysis of continuous-variable quantum key distribution (CVQKD) with discrete modulation against general attacks in a realistic finite-size regime. To realize this goal, we first prove security of the continuous-variable quantum key distribution protocol with discrete modulation against collective attacks by using the reliable tomography of the covariance matrix, leading to the reliable and tight error bounds in the derived confidence regions. Combining the proof with de Finetti reduction, the discrete-modulation-based continuous-variable quantum key distribution (DM-CVQ…
We give the first composable security proof for continuous-variable quantum key distribution with coherent states against collective attacks. Crucially, in the limit of large blocks the secret key rate converges to the usual value computed from the Holevo bound. Combining our proof with either the de Finetti theorem or the Postselection technique then shows the security of the protocol against general attacks, thereby confirming the long-standing conjecture that Gaussian attacks are optimal asymptotically in the composable security framework. We expect that our parameter estimation procedure, …
Proving the unconditional security of a quantum key distribution (QKD) scheme is a highly challenging task as one needs to determine the most efficient attack compatible with experimental data. This task is even more demanding for continuous-variable QKD as the Hilbert space where the protocol is described is infinite dimensional. A very natural way to address this problem is to make an extensive use of the symmetries of the protocols. In this article, we investigate a symmetry in phase space that is particularly relevant to continuous-variable QKD, and explore the way towards a new quantum de…
We present a general framework encompassing a number of continuous-variable quantum key distribution protocols, including standard one-way protocols, measurement-device-independent protocols as well as some two-way protocols, or any other continuous-variable protocol involving only a Gaussian modulation of coherent states and heterodyne detection. The main interest of this framework is that the corresponding protocols are all covariant with respect to the action of the unitary group $U(n)$, implying that their security can be established thanks to a Gaussian de Finetti reduction. In particular…
A practical quantum key distribution (QKD) protocol necessarily runs in finite time and, hence, only a finite amount of communication is exchanged. This is in contrast to most of the standard results on the security of QKD, which only hold in the limit where the number of transmitted signals approaches infinity. Here, we analyze the security of QKD under the realistic assumption that the amount of communication is finite. At the level of the general formalism, we present new results that help simplifying the actual implementation of QKD protocols: in particular, we show that symmetrization ste…
We present a rigorous security analysis of Continuous-Variable Measurement-Device Independent Quantum Key Distribution (CV MDI QKD) in a finite size scenario. The security proof is obtained in two steps: by first assessing the security against collective Gaussian attacks, and then extending to the most general class of coherent attacks via the Gaussian de Finetti reduction. Our result combines recent state-of-the-art security proofs for CV QKD with new findings about min-entropy calculus and parameter estimation. In doing so, we improve the finite-size estimate of the secret key rate. Our conc…
Schur-Weyl duality is a ubiquitous tool in quantum information. At its heart is the statement that the space of operators that commute with the tensor powers of all unitaries is spanned by the permutations of the tensor factors. In this work, we describe a similar duality theory for tensor powers of Clifford unitaries. The Clifford group is a central object in many subfields of quantum information, most prominently in the theory of fault-tolerance. The duality theory has a simple and clean description in terms of finite geometries. We demonstrate its effectiveness in several applications: (1) …
We present a security proof for establishing private entanglement by means of recurrence-type entanglement distillation protocols over noisy quantum channels. We consider protocols where the local devices are imperfect, and show that nonetheless a confidential quantum channel can be established, and used to e.g. perform distributed quantum computation in a secure manner. While our results are not fully device independent (which we argue to be unachievable in settings with quantum outputs), our proof holds for arbitrary channel noise and noisy local operations, and even in the case where the ea…
Quantum secure signature schemes have a lot of attention recently, in particular because of the NIST call to standardize quantum safe cryptography. However, only few signature schemes can have concrete quantum security because of technical difficulties associated with the Quantum Random Oracle Model (QROM). In this paper, we show that code-based signature schemes based on the full domain hash paradigm can behave very well in the QROM i.e. that we can have tight security reductions. We also study quantum algorithms related to the underlying code-based assumption. Finally, we apply our reduction…
Effective discrete-modulated continuous variable QKD under general attacks using dimension reduction
Luxquanta Technologies S.L.（Luxquanta科技有限公司）；ICFO - Institut de Ciencies Fotoniques, The Barcelona Institute of Science and Technology（ICFO-光子科学研究所，巴塞罗那科学技术研究院）；Universidad de Valladolid（巴利亚多利德大学）；ICREA – Institució Catalana de Recerca i Estudis Avançats（加泰罗尼亚高级研究学院）
We introduce the concept of cryptographic reduction, in analogy with a similar concept in computational complexity theory. In this framework, class $A$ of crypto-protocols reduces to protocol class $B$ in a scenario $X$, if for every instance $a$ of $A$, there is an instance $b$ of $B$ and a secure transformation $X$ that reproduces $a$ given $b$, such that the security of $b$ guarantees the security of $a$. Here we employ this reductive framework to study the relationship between security in quantum key distribution (QKD) and quantum secure direct communication (QSDC). We show that replacing …
The majority of research to date has concentrated on the quantum key distribution (QKD) between two parties. In general, the QKD protocols proposed for the multiparty scenario often involve the usage of a maximally entangled state, such as GHZ, which is challenging to implement in practice. This paper examines the prepare and measure version of multiparty communication through quantum key distribution. It is sufficient to have the capability of preparing and measuring a single qubit state. The security of the multiparty prepare and measure QKD is demonstrated by utilizing the well-known techni…
In known security reductions for the Fujisaki-Okamoto transformation, decryption failures are handled via a reduction solving the rather unnatural task of finding failing plaintexts given the private key, resulting in a Grover search bound. Moreover, they require an implicit rejection mechanism for invalid ciphertexts to achieve a reasonable security bound in the QROM. We present a reduction that has neither of these deficiencies: We introduce two security games related to finding decryption failures, one capturing the computationally hard task of using the public key to find a decryption fail…
The dimension reduction method enables security proofs of quantum key distribution (QKD) protocols that are originally formulated in infinite dimensions via reduction to a tractable finite-dimensional optimization. The reduction of dimensions is associated with a correction term in the secret key rate calculation. The previously derived correction term is loose when the protocol measurements are nearly block-diagonal with respect to the projection onto the reduced finite-dimensional subspace. Here, we provide a tighter correction term. It interpolates between the two extreme cases where all me…
Shor's quantum factoring algorithm and a few other efficient quantum algorithms break many classical crypto-systems. In response, people proposed post-quantum cryptography based on computational problems that are believed hard even for quantum computers. However, security of these schemes against \emph{quantum} attacks is elusive. This is because existing security analysis (almost) only deals with classical attackers and arguing security in the presence of quantum adversaries is challenging due to unique quantum features such as no-cloning. This work proposes a general framework to study which…
We prove the unconditional security of a quantum key distribution (QKD) protocol on a noisy channel against the most general attack allowed by quantum physics. We use the fact that in a previous paper we have reduced the proof of the unconditionally security of this QKD protocol to a proof that a corresponding Quantum String Oblivious Transfer (String-QOT) protocol would be unconditionally secure against Bob if implemented on top of an unconditionally secure bit commitment scheme. We prove a lemma that extends a security proof given by Yao for a (one bit) QOT protocol to this String-QOT protoc…
The security of real-world quantum key distribution (QKD) critically depends on the number of data points the system can collect in a fixed time interval. To date, state-of-the-art finite-key security analyses require block lengths in the order of 1E4 bits to obtain positive secret keys. This requirement, however, can be very difficult to achieve in practice, especially in the case of entanglement-based satellite QKD systems, where the overall channel loss can go up to 70 dB or more. Here, we provide an improved finite-key security analysis which can reduce the block length requirement by 14% …
Applying the Fiat-Shamir transform on identification schemes is one of the main ways of constructing signature schemes. While the classical security of this transformation is well understood, it is only very recently that generic results for the quantum case have been proposed [DFMS19,LZ19]. These results are asymptotic and therefore can't be used to derive the concrete security of these signature schemes without a significant loss in parameters. In this paper, we show that if we start from a commit-and-open identification scheme, where the prover first commits to several strings and then as a…
We propose efficient-phase-encoding protocols for continuous-variable quantum key distribution using coherent states and postselection. By these phase encodings, the probability of basis mismatch is reduced and total efficiency is increased. We also propose mixed-state protocols by omitting a part of classical communication steps in the efficient-phase-encoding protocols. The omission implies a reduction of information to an eavesdropper and possibly enhances the security of the protocols. We investigate the security of the protocols against individual beam splitting attack.
We develop a method to connect the infinite-dimensional description of optical continuous-variable quantum key distribution (QKD) protocols to a finite-dimensional formulation. The secure key rates of the optical QKD protocols can then be evaluated using recently-developed reliable numerical methods for key rate calculations. We apply this method to obtain asymptotic key rates for discrete-modulated continuous-variable QKD protocols, which are of practical significance due to their experimental simplicity and potential for large-scale deployment in quantum-secured networks. Importantly, our se…
Device independent quantum key distribution aims to provide a higher degree of security than traditional QKD schemes by reducing the number of assumptions that need to be made about the physical devices used. The previous proof of security by Pironio et al. applies only to collective attacks where the state is identical and independent and the measurement devices operate identically for each trial in the protocol. We extend this result to a more general class of attacks where the state is arbitrary and the measurement devices have no memory. We accomplish this by a reduction of arbitrary adver…
The interest in post-quantum cryptography - classical systems that remain secure in the presence of a quantum adversary - has generated elegant proposals for new cryptosystems. Some of these systems are set in the random oracle model and are proven secure relative to adversaries that have classical access to the random oracle. We argue that to prove post-quantum security one needs to prove security in the quantum-accessible random oracle model where the adversary can query the random oracle with quantum states. We begin by separating the classical and quantum-accessible random oracle models by…
We present a simplified framework for proving sequential composability in the quantum setting. In particular, we give a new, simulation-based, definition for security in the bounded-quantum-storage model, and show that this definition allows for sequential composition of protocols. Damgard et al. (FOCS '05, CRYPTO '07) showed how to securely implement bit commitment and oblivious transfer in the bounded-quantum-storage model, where the adversary is only allowed to store a limited number of qubits. However, their security definitions did only apply to the standalone setting, and it was not clea…
Quantum key distribution is the most well-known application of quantum cryptography. Previous proposed proofs of security of quantum key distribution contain various technical subtleties. Here, a conceptually simpler proof of security of quantum key distribution is presented. The new insight is the invariance of the error rate of a teleportation channel: We show that the error rate of a teleportation channel is independent of the signals being transmitted. This is because the non-trivial error patterns are permuted under teleportation. This new insight is combined with the recently proposed qu…
The famous Fiat-Shamir transformation turns any public-coin three-round interactive proof, i.e., any so-called sigma-protocol, into a non-interactive proof in the random-oracle model. We study this transformation in the setting of a quantum adversary that in particular may query the random oracle in quantum superposition. Our main result is a generic reduction that transforms any quantum dishonest prover attacking the Fiat-Shamir transformation in the quantum random-oracle model into a similarly successful quantum dishonest prover attacking the underlying sigma-protocol (in the standard model)…
Recent research in quantum cryptography has led to the development of schemes that encrypt and authenticate quantum messages with computational security. The security definitions used so far in the literature are asymptotic, game-based, and not known to be composable. We show how to define finite, composable, computational security for secure quantum message transmission. The new definitions do not involve any games or oracles, they are directly operational: a scheme is secure if it transforms an insecure channel and a shared key into an ideal secure channel from Alice to Bob, i.e., one which …
We call quantum security the area of IT security dealing with scenarios where one or more parties have access to quantum hardware. This encompasses both the fields of post-quantum cryptography (that is, traditional cryptography engineered to be resistant against quantum adversaries), and quantum cryptography (that is, security protocols designed to be natively run on a quantum infrastructure, such as quantum key distribution). In this work, we propose the first systematic classification of quantum security scenarios, and for each of them we recall the main tools and results, as well as present…
The Code Equivalence problem is that of determining whether two given linear codes are equivalent to each other up to a permutation of the coordinates. This problem has a direct reduction to a nonabelian hidden subgroup problem (HSP), suggesting a possible quantum algorithm analogous to Shor's algorithms for factoring or discrete log. However, we recently showed that in many cases of interest---including Goppa codes---solving this case of the HSP requires rich, entangled measurements. Thus, solving these cases of Code Equivalence via Fourier sampling appears to be out of reach of current famil…
Efficient Quantum Voting with Information-Theoretic Security
Harvard University（哈佛大学）；John A. Paulson School of Engineering and Applied Sciences, Harvard University（哈佛大学生工程与应用科学学院）；University of Copenhagen（哥本哈根大学）；QMATH, Department of Mathematical Sciences, University of Copenhagen（哥本哈根大学数学科学系量子数学中心）；Delft University of Technology（代尔夫特理工大学）；QuTech and Kavli Institute of Nanoscience, Delft University of Technology（代尔夫特理工大学夸特技术研究所和卡弗里纳米科学研究所）
