Quantum cryptography: Public key distribution and coin tossing
Charles H. Bennett, Gilles Brassard
备注：
One cover + 5 pages; 2 figures. This is a best-possible quality scan of the original so-called BB84 paper as it appeared in the Proceedings of the International Conference on Computers, Systems & Signal Processing, Bangalore, India, pp. 175-179, December 1984. The journal reference gives an open-access freshly typeset version prepared on the occasion of the 30th anniversary of the original paper
发表信息：
Theoretical Computer Science, Vol. 560 (Part 1), 2014, pp. 7-11
When elementary quantum systems, such as polarized photons, are used to transmit digital information, the uncertainty principle gives rise to novel cryptographic phenomena unachievable with traditional transmission media, e.g. a communications channel on which it is impossible in principle to eavesdrop without a high probability of disturbing the transmission in such a way as to be detected. Such a quantum channel can be used in conjunction with ordinary insecure classical channels to distribute random key information between two users with the assurance that it remains unknown to anyone else, even when the users share no secret information initially. We also present a protocol for coin-tossing by exchange of quantum messages, which is secure against traditional kinds of cheating, even by an opponent with unlimited computing power, but ironically can be subverted by use of a still subtler quantum phenomenon, the Einstein-Podolsky-Rosen paradox.
We show that a secure quantum protocol for coin tossing exist. The existence of quantum coin tossing support the conjecture of D.Mayers [Phys.Rev.Lett. 78, 3414(1997)] that only asymmetrical tasks as quantum bit commitment are impossible.
We suggest an attack on a symmetric non-ideal quantum coin-tossing protocol suggested by Mayers Salvail and Chiba-Kohno. The analysis of the attack shows that the protocol is insecure.
A relativistic quantum information exchange protocol is proposed allowing two distant users to realize ``coin tossing'' procedure. The protocol is based on the point that in relativistic quantum theory reliable distinguishing between the two orthogonal states generally requires a finite time depending on the structure of these states.
We review the quantum version of a well known problem of cryptography called coin tossing (``flipping a coin via telephone''). It can be regarded as a game where two remote players (who distrust each other) tries to generate a uniformly distributed random bit which is common to both parties. The only resource they can use to perform this task is a classical or quantum communication channel. In this paper we provide a general overview over such coin tossing protocols, concerning in particular their security.
An unconditionally secure quantum cion tossing protocol for two remote participants via entangled swapping is presented. The security of this protocol is guaranteed by the nonlocal property of quantum entanglement and the classical complexity.
A significant branch of classical cryptography deals with the problems which arise when mistrustful parties need to generate, process or exchange information. As Kilian showed a while ago, mistrustful classical cryptography can be founded on a single protocol, oblivious transfer, from which general secure multi-party computations can be built. The scope of mistrustful quantum cryptography is limited by no-go theorems, which rule out, inter alia, unconditionally secure quantum protocols for oblivious transfer or general secure two-party computations. These theorems apply even to protocols which…
In this letter we present the first implementation of a quantum coin tossing protocol. This protocol belongs to a class of ``two-party'' cryptographic problems, where the communication partners distrust each other. As with a number of such two-party protocols, the best implementation of the quantum coin tossing requires qutrits. In this way, we have also performed the first complete quantum communication protocol with qutrits. In our experiment the two partners succeeded to remotely toss a row of coins using photons entangled in the orbital angular momentum. We also show the experimental bound…
The cryptographic protocol of coin tossing consists of two parties, Alice and Bob, that do not trust each other, but want to generate a random bit. If the parties use a classical communication channel and have unlimited computational resources, one of them can always cheat perfectly. Here we analyze in detail how the performance of a quantum coin tossing experiment should be compared to classical protocols, taking into account the inevitable experimental imperfections. We then report an all-optical fiber experiment in which a single coin is tossed whose randomness is higher than achievable by …
There had been well known claims of ``provably unbreakable'' quantum protocols for bit commitment and coin tossing. However, we, and independently Mayers, showed that all proposed quantum bit commitment (and therefore coin tossing) schemes are, in principle, insecure because the sender, Alice, can always cheat successfully by using an EPR-type of attack and delaying her measurements. One might wonder if secure quantum bit commitment and coin tossing protocols exist at all. Here we prove that an EPR-type of attack by Alice will, in principle, break {\em any} realistic quantum bit commitment and…
In the literature, strong coin tossing protocols based on bit commitment have been proposed. Here we examine a protocol that instead tries to achieve the task by sharing entanglement securely. The protocol uses only qubits, and has bias 1/4. This is equal to the best known bias for bit commitment based schemes.
We discuss the security implications of noise for quantum coin tossing protocols. We find that if quantum error correction can be used, so that noise levels can be made arbitrarily small, then reasonable security conditions for coin tossing can be framed so that results from the noiseless case will continue to hold. If, however, error correction is not available (as is the case with present day technology), and significant noise is present, then tossing a single coin becomes problematic. In this case, we are led to consider random n-bit string generation in the presence of noise, rather than s…
In coin tossing two remote participants want to share a uniformly distributed random bit. At the least in the quantum version, each participant test whether or not the other has attempted to create a bias on this bit. It is requested that, for b = 0,1, the probability that Alice gets bit b and pass the test is smaller than 1/2 whatever she does, and similarly for Bob. If the bound 1/2 holds perfectly against any of the two participants, the task realised is called an exact coin tossing. If the bound is actually $1/2 + ξ$ where the bias $ξ$ vanishes when a security parameter m defined by the pr…
The relativistic quantum protocols realizing the bit commitment and distant coin tossing schemes are proposed. The protocols are based on the fact that the non-stationary orthogonal extended quantum states cannot be reliably distinguished if they are not fully accessible for the measurement. As the states propagate from the domain controlled by one of the user to the domain accessible for the measurements performed by the other user, they become reliably distinguishable for the second user. Important for the protocol are both the quantum nature of the states and the existence of a finite maxim…
Quantum coin tossing (QCT) is an important primitive of quantum cryptography and has received continuous interest. However, in practical QCT, Bob's detectors can be subjected to detector-side channel attacks launched by dishonest Alice, which will possibly make the protocol completely insecure. Here, we report a simple strategy of a detector-blinding attack based on a recent experiment. To remove all the detector side channels, we present a solution of measurement-device-independent QCT (MDI-QCT). This method is similar to the idea of MDI quantum key distribution (QKD). MDI-QCT is loss toleran…
We define cryptographic assumptions applicable to two mistrustful parties who each control two or more separate secure sites between which special relativity guarantees a time lapse in communication. We show that, under these assumptions, unconditionally secure coin tossing can be carried out by exchanges of classical information. We show also, following Mayers, Lo and Chau, that unconditionally secure bit commitment cannot be carried out by finitely many exchanges of classical or quantum information. Finally we show that, under standard cryptographic assumptions, coin tossing is strictly weak…
It is well-known that pure quantum states are typically almost maximally entangled, and thus have close to maximally mixed subsystems. We consider whether this is true for probabilistic theories more generally, and not just for quantum theory. We derive a formula for the expected purity of a subsystem in any probabilistic theory for which this quantity is well-defined. It applies to typical entanglement in pure quantum states, coin tossing in classical probability theory, and randomization in post-quantum theories; a simple generalization yields the typical entanglement in (anti)symmetric quan…
There had been well known claims of unconditionally secure quantum protocols for bit commitment. However, we, and independently Mayers, showed that all proposed quantum bit commitment schemes are, in principle, insecure because the sender, Alice, can almost always cheat successfully by using an Einstein-Podolsky-Rosen (EPR) type of attack and delaying her measurements. One might wonder if secure quantum bit commitment protocols exist at all. We answer this question by showing that the same type of attack by Alice will, in principle, break any bit commitment scheme. The cheating strategy genera…
Joint Institute for Nuclear Research（联合核研究所）；Universidade de São Paulo（圣保罗大学）
The procedure of tossing quantum coins and dice is described. This case is an important example of a quantum procedure because it presents a typical framework employed in quantum information processing and quantum computing. The emphasis is on the clarification of the difference between quantum and classical conditional probabilities. These probabilities are designed for characterizing different systems, either quantum or classical, and they, generally, cannot be reduced to each other. Thus the Lüders probability cannot be treated as a generalization of the classical conditional probability. T…
Methods of quantum mechanics promise information-theoretic security for various protocols in cryptography. However, impossibility of some cryptographic applications such as standard bit commitment, oblivious transfer, multiparty secure computations and ideal coin tossing in quantum regime leaves an obvious question on the completeness of quantum cryptography. Instead of using wide range of rules and techniques for a variety of cryptographic applications, we demonstrate here a unified structure for quantum cryptography based on quantum non-local correlations. The unified framework achieves same…
Alice is a charismatic quantum cryptographer who believes her parties are unmissable; Bob is a (relatively) glamorous string theorist who believes he is an indispensable guest. To prevent possibly traumatic collisions of self-perception and reality, their social code requires that decisions about invitation or acceptance be made via a cryptographically secure variable bias coin toss (VBCT). This generates a shared random bit by the toss of a coin whose bias is secretly chosen, within a stipulated range, by one of the parties; the other party learns only the random bit. Thus one party can secre…
Coin tossing is a cryptographic task in which two parties who do not trust each other aim to generate a common random bit. Using classical communication this is impossible, but non trivial coin tossing is possible using quantum communication. Here we consider the case when the parties do not want to toss a single coin, but many. This is called bit string generation. We report the experimental generation of strings of coins which are provably more random than achievable using classical communication. The experiment is based on the ``plug and play'' scheme developed for quantum cryptography, and…
After a general introduction, the thesis is divided into four parts. In the first, we discuss the task of coin tossing, principally in order to highlight the effect different physical theories have on security in a straightforward manner, but, also, to introduce a new protocol for non-relativistic strong coin tossing. This protocol matches the security of the best protocol known to date while using a conceptually different approach to achieve the task. In the second part variable bias coin tossing is introduced. This is a variant of coin tossing in which one party secretly chooses one of two b…
Here we propose a general relativistic quantum framework for cryptography that exploits the fascinating connection of quantum non-locality and special theory of relativity with cryptography. The underlying principle of unconditional security is causality and two-fold quantum non-local correlations: first entanglement swapping and then teleportation over causally independent entangled systems. We show that the proposed framework has following remarkable and novel features in mistrustful cryptography: (i) It helps in defining a new notion of oblivious transfer where both the data transferred and…
The security of quantum communication using a weak coherent source requires an accurate knowledge of the source's mean photon number. Finite calibration precision or an active manipulation by an attacker may cause the actual emitted photon number to deviate from the known value. We model effects of this deviation on the security of three quantum communication protocols: the Bennett-Brassard 1984 (BB84) quantum key distribution (QKD) protocol without decoy states, Scarani-Acin-Ribordy-Gisin 2004 (SARG04) QKD protocol, and a coin-tossing protocol. For QKD, we model both a strong attack using tec…
The security of source has become an increasingly important issue in quantum cryptography. Based on the framework of measurement-device-independent quantum-key-distribution (MDI-QKD), the source becomes the only region exploitable by a potential eavesdropper (Eve). Phase randomization is a cornerstone assumption in most discrete-variable (DV-) quantum communication protocols (e.g., QKD, quantum coin tossing, weak coherent state blind quantum computing, and so on), and the violation of such an assumption is thus fatal to the security of those protocols. In this paper, we show a simple quantum h…
We investigate sampling procedures that certify that an arbitrary quantum state on $n$ subsystems is close to an ideal mixed state $φ^{\otimes n}$ for a given reference state $φ$, up to errors on a few positions. This task makes no sense classically: it would correspond to certifying that a given bitstring was generated according to some desired probability distribution. However, in the quantum case, this is possible if one has access to a prover who can supply a purification of the mixed state. In this work, we introduce the concept of mixed-state certification, and we show that a natural sam…
A long sequence of tosses of a classical coin produces an apparently random bit string, but classical randomness is an illusion: the algorithmic information content of a classically-generated bit string lies almost entirely in the description of initial conditions. This letter presents a simple argument that, by contrast, a sequence of bits produced by tossing a quantum coin is, almost certainly, genuinely (algorithmically) random. This result can be interpreted as a strengthening of Bell's no-hidden-variables theorem, and relies on causality and quantum entanglement in a manner similar to Bel…
It is believed that superselection rules in quantum mechanics can restrict the possible operation on a qbit. If this was true, the model used by Mayers for the impossibility of bit commitment and by Kitaev for the impossibility of coin flipping would be inadequate. We explain why this is not the case. We show that a charge superselection rule implies no restriction on the operations that can be executed on any individual qbit.
In the distrustful quantum cryptography model the different parties have conflicting interests and do not trust one another. Nevertheless, they trust the quantum devices in their labs. The aim of the device-independent approach to cryptography is to do away with the necessity of making this assumption, and, consequently, significantly increase security. In this paper we enquire whether the scope of the device-independent approach can be extended to the distrustful cryptography model, thereby rendering it `fully' distrustful. We answer this question in the affirmative by presenting a device-ind…
Quantum-cryptography key distribution (QCKD) experiments have been recently reported using polarization-entangled photons. However, in any practical realization, quantum systems suffer from either unwanted or induced interactions with the environment and the quantum measurement system, showing up as quantum and, ultimately, statistical noise. In this paper, we investigate how ideal polarization entanglement in spontaneous parametric downconversion (SPDC) suffers quantum noise in its practical implementation as a secure quantum system, yielding errors in the transmitted bit sequence. Because al…
We elaborate on a model of quantum random walk proposed by Hillery et. al., and Jeong et. al., which uses the multiports for quantum "coin tossing". The dynamics of this model is analyzed for the case when the multiports are arranged on the hypercube. If the hypercube is attached to semi-infinite lines, then it can act as a scattering potential, which can be reduced to a quantum walk on the line with non-unitary evolution. We also show how this model can be implemented using simple quantum gates.
Symmetric extendibility of quantum states has recently drawn attention in the context of quantum cryptography to judge whether quantum states shared between two distant parties can be purified by means of one-way error correction protocols. In this letter we study the symmetric extendibility in a specific class of two-qudit states, i. e. states composed of two d-level systems, in order to find upper bounds on tolerable error rates for a wide class of qudit-based quantum cryptographic protocols using two-way error correction. In important cases these bounds coincide with previously known lower …
We give a proof that entanglement purification, even with noisy apparatus, is sufficient to disentangle an eavesdropper (Eve) from the communication channel. In the security regime, the purification process factorises the overall initial state into a tensor-product state of Alice and Bob, on one side, and Eve on the other side, thus establishing a completely private, albeit noisy, quantum communication channel between Alice and Bob. The security regime is found to coincide for all practical purposes with the purification regime of a two-way recurrence protocol. This makes two-way entanglement …
Practical quantum communication (QC) protocols are assumed to be secure provided implemented devices are properly characterized and all known side channels are closed. We show that this is not always true. We demonstrate a laser-damage attack capable of modifying device behaviour on-demand. We test it on two practical QC systems for key distribution and coin-tossing, and show that newly created deviations lead to side channels. This reveals that laser damage is a potential security risk to existing QC systems, and necessitates their testing to guarantee security.
Mistrustful cryptography includes important tasks like bit commitment, oblivious transfer, coin flipping, secure computations, position authentication, digital signatures and secure unforgeable tokens. Practical quantum implementations presently use photonic setups. In many such implementations, Alice sends photon pulses encoding quantum states and Bob chooses measurements on these states. In practice, Bob generally uses single photon threshold detectors, which cannot distinguish the number of photons in detected pulses. Also, losses and other imperfections require Bob to report the detected p…
Granting information privacy is of crucial importance in our society, notably in fiber communication networks. Quantum cryptography provides a unique means to establish, at remote locations, identical strings of genuine random bits, with a level of secrecy unattainable using classical resources. However, several constraints, such as non-optimized photon number statistics and resources, detectors' noise, and optical losses, currently limit the performances in terms of both achievable secret key rates and distances. Here, these issues are addressed using an approach that combines both fundamenta…
Relativistic protocols have been proposed to overcome some impossibility results in classical and quantum cryptography. In such a setting, one takes the location of honest players into account, and uses the fact that information cannot travel faster than the speed of light to limit the abilities of dishonest agents. For example, various relativistic bit commitment protocols have been proposed. Although it has been shown that bit commitment is sufficient to construct oblivious transfer and thus multiparty computation, composing specific relativistic protocols in this way is known to be insecure…
In quantum theory, the no-information-without-disturbance and no-free-information theorems express that those observables that do not disturb the measurement of another observable and those that can be measured jointly with any other observable must be trivial, i.e., coin tossing observables. We show that in the framework of general probabilistic theories these statements do not hold in general and continue to completely specify these two classes of observables. In this way, we obtain characterizations of the probabilistic theories where these statements hold. As a particular class of state sp…
Coin flipping is a fundamental cryptographic primitive that enables two distrustful and far apart parties to create a uniformly random bit [Blu81]. Quantum information allows for protocols in the information theoretic setting where no dishonest party can perfectly cheat. The previously best-known quantum protocol by Ambainis achieved a cheating probability of at most 3/4 [Amb01]. On the other hand, Kitaev showed that no quantum protocol can have cheating probability less than $1/\sqrt{2}$ [Kit03]. Closing this gap has been one of the important open questions in quantum cryptography. In this pa…
We experimentally demonstrate a quantum walk on a line in phase space using one and two trapped ion. A walk with up to 23 steps is realized by subjecting an ion to state-dependent displacement operations interleaved with quantum coin tossing operations. To analyze the ion's motional state after each step we apply a technique that directly maps the probability density distribution onto the ion's internal state. The measured probability distributions and the position's second moment clearly show the non-classical character of the quantum walk. To further highlight the difference between the clas…
The no-cloning theorem asserts that, unlike classical information, quantum information cannot be copied. This seemingly undesirable phenomenon is harnessed in quantum cryptography. Uncloneable cryptography studies settings in which the impossibility of copying is a desired property, and achieves forms of security that are classically unattainable. The first example discovered and analyzed was in the context of cash. On the one hand, we want users to hold the cash; on the other hand, the cash should be hard to counterfeit. Quantum money uses variants of the no-cloning theorem to make counterfei…
For more than a decade, it was believed that unconditionally secure quantum bit commitment (QBC) is impossible. But basing on a previously proposed quantum key distribution scheme using orthogonal states, here we build a QBC protocol in which the density matrices of the quantum states encoding the commitment do not satisfy a crucial condition on which the no-go proofs of QBC are based. Thus the no-go proofs could be evaded. Our protocol is fault-tolerant and very feasible with currently available technology. It reopens the venue for other "post-cold-war" multi-party cryptographic protocols, e.…
In all existing quantum walk models, the assumption about a pre-existing fixed background causal structure is always made and has been taken for granted. Nevertheless, in this work we will get rid of this tacit assumption especially by introducing indefinite causal order ways of coin tossing and investigate this modern scenario. We find that an ideal-shape and fast-spreading uniform distribution can be prepared with our new model. First we will show how an always-symmetrical instantaneous distribution appears in an indefinite causal order quantum walk, which then paves the way for deriving con…
In extension of the bit commitment task and following work initiated by Crepeau and Kilian, we introduce and solve the problem of characterising the optimal rate at which a discrete memoryless channel can be used for bit commitment. It turns out that the answer is very intuitive: it is the maximum equivocation of the channel (after removing trivial redundancy), even when unlimited noiseless bidirectional side communication is allowed. By a well-known reduction, this result provides a lower bound on the channel's capacity for implementing coin tossing, which we conjecture to be an equality. The…
Mochon's proof [Moc07] of existence of quantum weak coin flipping with arbitrarily small bias is a fundamental result in quantum cryptography, but at the same time one of the least understood. Though used several times as a black box in important follow-up results [Gan09, CK09, AS10, CK11, KZ13] the result has not been peer-reviewed, its novel techniques (and in particular Kitaev's point game formalism) have not been applied anywhere else, and an explicit protocol is missing. We believe that truly understanding the existence proof and the novel techniques it relies on would constitute a major …
Quantum cryptography, quantum computer project, space-time quantization program and recent computer experiments reported by Accardi and his collaborators show the importance and actuality of the discussion of the completeness of quantum mechanics (QM) started by Einstein more than 70 years ago. Many years ago we pointed out that the violation of Bell's inequalities is neither a proof of completeness of QM nor an indication of the violation of Einsteinian causality. We also indicated how and in what sense a completeness of QM might be tested with the help of statistical nonparametric purity tes…
The experimental characterization of multi-photon quantum interference effects in optical networks is essential in many applications of photonic quantum technologies, which include quantum computing and quantum communication as two prominent examples. However, such characterization often requires technologies which are beyond our current experimental capabilities, and today's methods suffer from errors due to the use of imperfect sources and photodetectors. In this paper, we introduce a simple experimental technique to characterise multi-photon quantum interference by means of practical laser …
In this brief review, we discuss the role that quantum correlations, as quantified by quantum discord, play in two interesting settings. The first one is discerning which unitaries have been applied on a quantum system, by taking advantage of knowledge regarding its initial configuration. Here discord captures the "quantum" component of this knowledge, useful only when we have access to a quantum memory. In particular, discord can be used to detect whether an untrusted party has certain quantum capabilities. The second setting is quantum cryptography. Here discord represents an important resou…
