We initiate the study of multi-party computation for classical functionalities (in the plain model) with security against malicious polynomial-time quantum adversaries. We observe that existing techniques readily give a polynomial-round protocol, but our main result is a construction of *constant-round* post-quantum multi-party computation. We assume mildly super-polynomial quantum hardness of learning with errors (LWE), and polynomial quantum hardness of an LWE-based circular security assumption. Along the way, we develop the following cryptographic primitives that may be of independent interest:
1. A spooky encryption scheme for relations computable by quantum circuits, from the quantum hardness of an LWE-based circular security assumption. This yields the first quantum multi-key fully-homomorphic encryption scheme with classical keys.
2. Constant-round zero-knowledge secure against multiple parallel quantum verifiers from spooky encryption for relations computable by quantum circuits. To enable this, we develop a new straight-line non-black-box simulation technique against *parallel* verifiers that does not clone the adversary's state. This forms the heart of our technical contribution and may also be relevant to the classical setting.
3. A constant-round post-quantum non-malleable commitment scheme, from the mildly super-polynomial quantum hardness of LWE.
We present attacks that show that unconditionally secure two-party classical computation is impossible for many classes of function. Our analysis applies to both quantum and relativistic protocols. We illustrate our results by showing the impossibility of oblivious transfer.
Quantum conference is a process of securely exchanging messages between three or more parties, using quantum resources. A Measurement Device Independent Quantum Dialogue (MDI-QD) protocol, which is secure against information leakage, has been proposed (Quantum Information Processing 16.12 (2017): 305) in 2017, is proven to be insecure against intercept-and-resend attack strategy. We first modify this protocol and generalize this MDI-QD to a three-party quantum conference and then to a multi-party quantum conference. We also propose a protocol for quantum multi-party XOR computation. None of th…
The Universal Composability model (UC) by Canetti (FOCS 2001) allows for secure composition of arbitrary protocols. We present a quantum version of the UC model which enjoys the same compositionality guarantees. We prove that in this model statistically secure oblivious transfer protocols can be constructed from commitments. Furthermore, we show that every statistically classically UC secure protocol is also statistically quantum UC secure. Such implications are not known for other quantum security definitions. As a corollary, we get that quantum UC secure protocols for general multi-party com…
The cryptographic task of secure multi-party (classical) computation has received a lot of attention in the last decades. Even in the extreme case where a computation is performed between $k$ mutually distrustful players, and security is required even for the single honest player if all other players are colluding adversaries, secure protocols are known. For quantum computation, on the other hand, protocols allowing arbitrary dishonest majority have only been proven for $k=2$. In this work, we generalize the approach taken by Dupuis, Nielsen and Salvail (CRYPTO 2012) in the two-party setting t…
Since the negative result of Lo (Physical Review A, 1997), it has been left open whether there exist some functions that can be securely computed in two-party setting in quantum domain when one of the parties is malicious. In this paper, we for the first time, show that there are some functions for which secure two-party quantum computation is indeed possible for non-simultaneous channel model. This is in sharp contrast with the impossibility result of Ben -Or et al. (FOCS, 2006) in broadcast channel model. The functions we study are of two types - one is any function without an embedded XOR, …
Secure multi-party computation (SMPC) protocols allow several parties that distrust each other to collectively compute a function on their inputs. In this paper, we introduce a protocol that lifts classical SMPC to quantum SMPC in a composably and statistically secure way, even for a single honest party. Unlike previous quantum SMPC protocols, our proposal only requires very limited quantum resources from all but one party; it suffices that the weak parties, i.e. the clients, are able to prepare single-qubit states in the X-Y plane. The novel quantum SMPC protocol is constructed in a naturally…
In classical two-party computation, a trusted initializer who prepares certain initial correlations, known as one-time tables, can help make the inputs of both parties information-theoretically secure. We propose some bipartite quantum protocols with possible aborts for approximately generating such bipartite classical correlations with varying degrees of privacy, without introducing a third party. Under some weak requirements for the parties, the security level is nontrivial for use in bipartite computation. We show that the security is sometimes dependent on the noise level, but we propose a…
Blind quantum computation protocols allow a user with limited quantum technology to delegate an intractable computation to a quantum server while keeping the computation perfectly secret. Whereas in some protocols a user can verify that calculated outcomes are correct, a third party cannot do this, which allows a dishonest user or owner to benefit illegally. I propose a new blind quantum computation protocol with a new property called public verifiability, which enables any third party to assure that a party does not benefit from attempted deception.
One of the central themes in classical cryptography is multi-party computation, which performs joint computation on multiple participants' data while maintaining data privacy. The extension to the quantum regime was proposed in 2002, but despite two decades of research, the current state-of-the-art multi-party quantum computation protocol for a fixed number of parties (even 2 parties) requires unbounded rounds of communication, which greatly limit its practical usage. In this work, we propose the first constant-round multi-party quantum computation protocol for a fixed number of parties agains…
We introduce a scheme for secure multi-party computation utilising the quantum correlations of entangled states. First we present a scheme for two-party computation, exploiting the correlations of a Greenberger-Horne-Zeilinger state to provide, with the help of a third party, a near-private computation scheme. We then present a variation of this scheme which is passively secure with threshold t=2, in other words, remaining secure when pairs of players conspire together provided they faithfully follow the protocol. We show that this can be generalised to computations of n-party polynomials of d…
A fundamental task in modern cryptography is the joint computation of a function which has two inputs, one from Alice and one from Bob, such that neither of the two can learn more about the other's input than what is implied by the value of the function. In this Letter, we show that any quantum protocol for the computation of a classical deterministic function that outputs the result to both parties (two-sided computation) and that is secure against a cheating Bob can be completely broken by a cheating Alice. Whereas it is known that quantum protocols for this task cannot be completely secure,…
I construct a secure multi-party scheme to compute a classical function by a succinct use of a specially designed fault-tolerant random polynomial quantum error correction code. This scheme is secure provided that (asymptotically) strictly greater than five-sixths of the players are honest. Moreover, the security of this scheme follows directly from the theory of quantum error correcting code, and hence is valid without any computational assumption. I also discuss the quantum-classical complexity-security tradeoff in secure multi-party computation schemes and argue why a full-blown quantum cod…
We investigate definitions of and protocols for multi-party quantum computing in the scenario where the secret data are quantum systems. We work in the quantum information-theoretic model, where no assumptions are made on the computational power of the adversary. For the slightly weaker task of verifiable quantum secret sharing, we give a protocol which tolerates any t < n/4 cheating parties (out of n). This is shown to be optimal. We use this new tool to establish that any multi-party quantum computation can be securely performed as long as the number of dishonest players is less than n/6.
It had been widely claimed that quantum mechanics can protect private information during public decision in for example the so-called two-party secure computation. If this were the case, quantum smart-cards could prevent fake teller machines from learning the PIN (Personal Identification Number) from the customers' input. Although such optimism has been challenged by the recent surprising discovery of the insecurity of the so-called quantum bit commitment, the security of quantum two-party computation itself remains unaddressed. Here I answer this question directly by showing that all ``one-si…
The application and analysis of the Cut-and-Choose technique in protocols secure against quantum adversaries is not a straightforward transposition of the classical case, among other reasons due to the difficulty to use rewinding in the quantum realm. We introduce a Quantum Computation Cut-and-Choose (QC-CC) technique which is a generalisation of the classical Cut-and-Choose in order to build quantum protocols secure against quantum covert adversaries. Such adversaries can deviate arbitrarily provided that their deviation is not detected. As an application of the QC-CC we give a protocol for s…
We give a cheat sensitive protocol for blind universal quantum computation that is efficient in terms of computational and communication resources: it allows one party to perform an arbitrary computation on a second party's quantum computer without revealing either which computation is performed, or its input and output. The first party's computational capabilities can be extremely limited: she must only be able to create and measure single-qubit superposition states. The second party is not required to use measurement-based quantum computation. The protocol requires the (optimal) exchange of …
We consider the task of secure multi-party distributed quantum computation on a quantum network. We propose a protocol based on quantum error correction which reduces the number of necessary qubits. That is, each of the $n$ nodes in our protocol requires an operational workspace of $n^2+Θ(s) n$ qubits, as opposed to previously shown $Ω\big((n^3+n^2s^2)\log n\big)$ qubits, where $s$ is a security parameter. To achieve universal computation, we develop a distributed procedure for verifying magic states based on magic state distillation and statistical testing of randomly selected states. This al…
Secure multi-party computing, also called "secure function evaluation", has been extensively studied in classical cryptography. We consider the extension of this task to computation with quantum inputs and circuits. Our protocols are information-theoretically secure, i.e. no assumptions are made on the computational power of the adversary. For the weaker task of verifiable quantum secret sharing, we give a protocol which tolerates any t < n/4 cheating parties (out of n). This is shown to be optimal. We use this new tool to show how to perform any multi-party quantum computation as long as the …
In a recent paper (Phys. Rev. Lett. 109, 160501 (2012). arXiv:1201.0849), it is claimed that any quantum protocol for classical two-sided computation between Alice and Bob can be proven completely insecure for Alice if it is secure against Bob. Here we show that the proof is not sufficiently general, because the security definition it based on is only a sufficient condition but not a necessary condition.
Quantum correlations exhibit behaviour that cannot be resolved with a local hidden variable picture of the world. In quantum information, they are also used as resources for information processing tasks, such as Measurement-based Quantum Computation (MQC). In MQC, universal quantum computation can be achieved via adaptive measurements on a suitable entangled resource state. In this paper, we look at a version of MQC in which we remove the adaptivity of measurements and aim to understand what computational abilities still remain in the resource. We show that there are explicit connections betwe…
This paper studies secure multiparty quantum computation (SMQC) without nonlocal measurements. Firstly, this task is reduced to secure two-party quantum computation of nonlocal controlled-NOT (NL-CNOT) gate. Then, in the passive adversaries model, the secure computation of NL-CNOT is reduced to bit commitment. Thus, a SMQC scheme can be constructed based on bit commitment. This scheme does not depend on trusted third party, and is secure in the passive adversaries model. It is also pointed out that a vulnerability exists in any secure two-party quantum computation protocol of NL-CNOT gate.
To construct a quantum network with many end users, it is critical to have a cost-efficient way to distribute entanglement over different network ends. We demonstrate an entanglement access network, where the expensive resource, the entangled photon source at the telecom wavelength and the core communication channel, is shared by many end users. Using this cost-efficient entanglement access network, we report experimental demonstration of a secure multiparty computation protocol, the privacy-preserving secure sum problem, based on the network quantum cryptography.
Secure multi-party quantum computation (MPQC) protocol is a versatile tool that enables error-free distributed quantum computation to a group of $n$ mutually distrustful quantum nodes even when some of the quantum nodes do not follow the instructions of the protocol honestly. However, in case of the MPQC protocols built on top of the quantum error correction technique, the versatility is significantly affected by the fact that one has to choose a particular quantum error-correcting code (QECC), which immediately applies a constraint on the number of quantum nodes $n$. Therefore, in this talk, …
A fully homomorphic encryption system hides data from unauthorized parties, while still allowing them to perform computations on the encrypted data. Aside from the straightforward benefit of allowing users to delegate computations to a more powerful server without revealing their inputs, a fully homomorphic cryptosystem can be used as a building block in the construction of a number of cryptographic functionalities. Designing such a scheme remained an open problem until 2009, decades after the idea was first conceived, and the past few years have seen the generalization of this functionality t…
In this article, we are interested in the physical model of general quantum protocols implementing secure two-party computations in the light of Mayers' and Lo's & Chau's no-go theorems of bit commitment and oblivious transfer. In contrast to the commonly adobted quantum pure two-party model in the literature where classical communication is normally ignored, we propose an alternative interpretation for the purification of classical communication in two-party protocols by introducing a quantum third party for the classical channel. This interpretation leads to a global three-party model, invol…
Secure two-party computation considers the problem of two parties computing a joint function of their private inputs without revealing anything beyond the output. In this work, we consider the setting where the two parties (a classical Alice and a quantum Bob) can communicate only via a classical channel. Our first result shows that it is in general impossible to realize a two-party quantum functionality with black-box simulation in the case of malicious quantum adversaries. In particular, we show that the existence of a secure quantum computing protocol that relies only on classical channels …
Since unconditionally secure quantum two-party computations are known to be impossible, most existing quantum private comparison (QPC) protocols adopted a third party. Recently, we proposed a QPC protocol which involves two parties only, and showed that although it is not unconditionally secure, it only leaks an extremely small amount of information to the other party. Here we further propose the device-independent version of the protocol, so that it can be more convenient and dependable in practical applications.
To evade the well-known impossibility of unconditionally secure quantum two-party computations, previous quantum private comparison protocols have to adopt a third party. Here we study how far we can go with two parties only. We propose a very feasible and efficient protocol. Intriguingly, although the average amount of information leaked cannot be made arbitrarily small, we find that it never exceeds 14 bits for any length of the bit-string being compared.
We introduce relativistic multi-party biased die rolling protocols, generalizing coin flipping to $M \geq 2$ parties and to $N \geq 2$ outcomes for any chosen outcome biases, and show them unconditionally secure. Our results prove that the most general random secure multi-party computation, where all parties receive the output and there is no secret input by any party, can be implemented with unconditional security. Our protocols extend Kent's [A. Kent, Phys. Rev. Lett. 83, 5382 (1999)] two-party unbiased coin flipping protocol, do not require any quantum communication, are practical to implem…
Semiquantum key distribution allows a quantum party to share a random key with a "classical" party who only can prepare and measure qubits in the computational basis or reorder some qubits when he has access to a quantum channel. In this work, we present a protocol where a secret key can be established between a quantum user and an almost classical user who only needs the quantum ability to access quantum channels, by securely delegating quantum computation to a quantum server. We show the proposed protocol is robust even when the delegated quantum server is a powerful adversary, and is experi…
Secret sharing is a multiparty cryptographic task in which some secret information is splitted into several pieces which are distributed among the participants such that only an authorized set of participants can reconstruct the original secret. Similar to quantum key distribution, in quantum secret sharing, the secrecy of the shared information relies not on computational assumptions, but on laws of quantum physics. Here, we present an experimental demonstration of four-party quantum secret sharing via the resource of four-photon entanglement.
In this paper, we build upon the model of two-party quantum computation introduced by Salvail et al. [SSS09] and show that in this model, only trivial correct two-party quantum protocols are weakly self-composable. We do so by defining a protocol Π, calling any non-trivial sub-protocol πN times and showing that there is a quantum honest-but-curious strategy that cannot be modeled by acting locally in every single copy of π. In order to achieve this, we assign a real value called "payoff" to any strategy for Πand show that that there is a gap between the highest payoff achievable by coherent an…
The goal of two-party cryptography is to enable two parties, Alice and Bob, to solve common tasks without the need for mutual trust. Examples of such tasks are private access to a database, and secure identification. Quantum communication enables security for all of these problems in the noisy-storage model by sending more signals than the adversary can store in a certain time frame. Here, we initiate the study of device-independent protocols for two-party cryptography in the noisy-storage model. Specifically, we present a relatively easy to implement protocol for a cryptographic building bloc…
After a general introduction, the thesis is divided into four parts. In the first, we discuss the task of coin tossing, principally in order to highlight the effect different physical theories have on security in a straightforward manner, but, also, to introduce a new protocol for non-relativistic strong coin tossing. This protocol matches the security of the best protocol known to date while using a conceptually different approach to achieve the task. In the second part variable bias coin tossing is introduced. This is a variant of coin tossing in which one party secretly chooses one of two b…
$N$-Party Hadamard Test for Distributed Quantum Computation
NTT Computer and Data Science Laboratories, NTT Corporation（NTT 计算机与数据科学实验室）；Department of Electrical, Electronic, and Communication Engineering, Faculty of Science and Engineering, Chuo University（中央大学理工学部电气电子通信工程系）；JST, PRESTO（日本科学技术振兴机构 PRESTO 项目）
Any two-party cryptographic primitive can be implemented using quantum communication under the assumption that it is difficult to store a large number of quantum states perfectly. However, achieving reliable quantum communication over long distances remains a difficult problem. Here, we consider a large network of nodes with only neighboring quantum links. We exploit properties of this cloud of nodes to enable any two nodes to achieve security even if they are not directly connected. Our results are based on techniques from classical cryptography and do not resort to technologically difficult …
Recently, Shi et al. (Phys. Rev. A, 2015) proposed Quantum Oblivious Set Member Decision Protocol (QOSMDP) where two legitimate parties, namely Alice and Bob, play a game. Alice has a secret $k$ and Bob has a set $\{k_1,k_2,\cdots k_n\}$. The game is designed towards testing if the secret $k$ is a member of the set possessed by Bob without revealing the identity of $k$. The output of the game will be either "Yes" (bit $1$) or "No" (bit $0$) and is generated at Bob's place. Bob does not know the identity of $k$ and Alice does not know any element of the set. In a subsequent work (Quant. Inf. Pr…
