Delegating Multi-Party Quantum Computations vs. Dishonest Majority in Two Quantum Rounds
Theodoros Kapourniotis, Elham Kashefi, Luka Music, Harold Ollivier
备注：
The proposed H/I-gadget (sec 5.1.2) turned out being insecure because the corrections to apply to the output state depended on the outcome and the desired operation (fig.6). This construction is now superseded by "Asymmetric Quantum Secure Multi-Party Computation With Weak Clients Against Dishonest Majority" (arxiv:2303.08865)
Multi-Party Quantum Computation (MPQC) has attracted a lot of attention as a potential killer-app for quantum networks through it's ability to preserve privacy and integrity of the highly valuable computations they would enable. Contributing to the latest challenges in this field, we present a composable protocol achieving blindness and verifiability even in the case of a single honest client. The security of our protocol is reduced, in an information-theoretically secure way, to that of a classical composable Secure Multi-Party Computation (SMPC) used to coordinate the various parties. Our scheme thus provides a statistically secure upgrade of such classical scheme to a quantum one with the same level of security.
In addition, (i) the clients can delegate their computation to a powerful fully fault-tolerant server and only need to perform single qubit operations to unlock the full potential of multi-party quantum computation; (ii) the amount of quantum communication with the server is reduced to sending quantum states at the beginning of the computation and receiving the output states at the end, which is optimal and removes the need for interactive quantum communication; and (iii) it has a low constant multiplicative qubit overhead compared to the single-client delegated protocol it is built upon.
The main technical ingredient of our paper is the bootstraping of the MPQC construction by Double Blind Quantum Computation, a new composable resource for blind multiparty quantum computation, that demonstrates the surprising fact that the full protocol does not require verifiability of all components to achieve security.
This study presents the first semi-quantum private comparison protocol under an almost-dishonest third party. The proposed protocol allows two classical participants to compare their secret information without compromising it's privacy. The security analyses indicate that the protocol is free from several well-known attacks.
We introduce a scheme for secure multi-party computation utilising the quantum correlations of entangled states. First we present a scheme for two-party computation, exploiting the correlations of a Greenberger-Horne-Zeilinger state to provide, with the help of a third party, a near-private computation scheme. We then present a variation of this scheme which is passively secure with threshold t=2, in other words, remaining secure when pairs of players conspire together provided they faithfully follow the protocol. We show that this can be generalised to computations of n-party polynomials of d…
The mediated semi-quantum key distribution (MSQKD) protocol is an important research issue that lets two classical participants share secret keys securely between each other with the help of a third party (TP). However, in the existing MSQKD protocols, there are two improvable issues, namely (1) the classical participants must be equipped with expensive detectors to avoid Trojan horse attacks and (2) the trustworthiness level of TP must be honest. To the best of our knowledge, none of the existing MSQKD protocols can resolve both these issues. Therefore, this study takes Bell states as the qua…
The cryptographic task of secure multi-party (classical) computation has received a lot of attention in the last decades. Even in the extreme case where a computation is performed between $k$ mutually distrustful players, and security is required even for the single honest player if all other players are colluding adversaries, secure protocols are known. For quantum computation, on the other hand, protocols allowing arbitrary dishonest majority have only been proven for $k=2$. In this work, we generalize the approach taken by Dupuis, Nielsen and Salvail (CRYPTO 2012) in the two-party setting t…
Secure multi-party computation (SMPC) protocols allow several parties that distrust each other to collectively compute a function on their inputs. In this paper, we introduce a protocol that lifts classical SMPC to quantum SMPC in a composably and statistically secure way, even for a single honest party. Unlike previous quantum SMPC protocols, our proposal only requires very limited quantum resources from all but one party; it suffices that the weak parties, i.e. the clients, are able to prepare single-qubit states in the X-Y plane. The novel quantum SMPC protocol is constructed in a naturally…
We find that existing multi-party quantum key agreement (MQKA) protocols designed for fairness of the key are, in fact, unfair. Our analysis shows that these protocols are sensitive to collusive attacks; that is, dishonest participants can collaborate to predetermine the key without being detected. In fact, the transmission structures of the quantum particles in those unfair MQKA protocols, three of which have already been analyzed, have much in common. We call these unfair MQKA protocols circle-type MQKA protocols. Likewise, the transmission structures of the quantum particles in MQKA protoco…
We investigate definitions of and protocols for multi-party quantum computing in the scenario where the secret data are quantum systems. We work in the quantum information-theoretic model, where no assumptions are made on the computational power of the adversary. For the slightly weaker task of verifiable quantum secret sharing, we give a protocol which tolerates any t < n/4 cheating parties (out of n). This is shown to be optimal. We use this new tool to establish that any multi-party quantum computation can be securely performed as long as the number of dishonest players is less than n/6.
We develop a three-party quantum secret sharing protocol based on arbitrary dimensional quantum states. In contrast to the previous quantum secret sharing protocols, the sender can always control the state, just using local operations, for adjusting the correlation of measurement directions of three parties and thus there is no waste of resource due to the discord between the directions. Moreover, our protocol contains the hidden value which enables the sender to leak no information of secret key to the dishonest receiver until the last steps of the procedure.
Security of the three-party quantum secret sharing (QSS) schemes based on entanglement and a collective eavesdropping check is analyzed in the case of considerable quantum channel losses. An opaque attack scheme is presented for the dishonest agent to eavesdrop the message obtained by the other agent freely, which reveals that these QSS schemes are insecure for transmission efficiencies lower than 50%, especially when they are used to share an unknown quantum state. Finally, we present a general way to improve the security of QSS schemes for sharing not only a private key but also an unknown q…
We present an efficient and economic scheme for five-party quantum state sharing of an arbitrary m-qubit state with $2m$ three-particle Greenberger-Horne-Zeilinger (GHZ) states and three-particle GHZ-state measurements. It is more convenient than other schemes as it only resorts to three-particle GHZ states and three-particle joint measurement, not five-particle entanglements and five-particle joint measurements. Moreover, this symmetric scheme is in principle secure even though the number of the dishonest agents is more than one. Its total efficiency approaches the maximal value.
Secure multi-party computing, also called "secure function evaluation", has been extensively studied in classical cryptography. We consider the extension of this task to computation with quantum inputs and circuits. Our protocols are information-theoretically secure, i.e. no assumptions are made on the computational power of the adversary. For the weaker task of verifiable quantum secret sharing, we give a protocol which tolerates any t < n/4 cheating parties (out of n). This is shown to be optimal. We use this new tool to show how to perform any multi-party quantum computation as long as the …
Recently there were many quantum protocols devoted to solve the millionaire problem and private comparison problem by adding a semi-honest third party. They all require complicated quantum methods, while still leak a non-trivial amount of information to at least one of the parties. But it will be shown here that once the third party is introduced, there are very simple protocols which require quantum key distribution as the only quantum resource, and the amount of information leaked can be made arbitrarily small. Furthermore, even a dishonest third party cannot spoil the protocols. Thus our so…
We study quantum protocols among two distrustful parties. Under the sole assumption of correctness - guaranteeing that honest players obtain their correct outcomes - we show that every protocol implementing a non-trivial primitive necessarily leaks information to a dishonest player. This extends known impossibility results to all non-trivial primitives. We provide a framework for quantifying this leakage and argue that leakage is a good measure for the privacy provided to the players by a given protocol. Our framework also covers the case where the two players are helped by a trusted third par…
This study explores a new security problem existing in various state-of-the-art quantum private comparison (QPC) protocols, where a malicious third-party (TP) announces fake comparison (or intermediate) results. In this case, the participants could eventually be led to a wrong direction and the QPC will become fraudulent. In order to resolve this problem, a new level of trustworthiness for TP is defined and a new QPC protocol is proposed, where a second TP is introduced to monitor the first one. Once a TP announces a fake comparison (or intermediate) result, participants can detect the fraud i…
A quantum metrology scheme can be decomposed into three quantum tasks: state preparation, parameter encoding and measurements. Consequently, it is imperative to have access to the technologies which can execute the aforementioned tasks to fully implement a quantum metrology scheme. In the absence of one or more of these technologies, one can proceed by delegating the tasks to a third party. However, doing so has security ramifications: the third party can bias the result or leak information. In this article, we outline different scenarios where one or more tasks are delegated to an untrusted (…
Semiquantum key distribution allows a quantum party to share a random key with a "classical" party who only can prepare and measure qubits in the computational basis or reorder some qubits when he has access to a quantum channel. In this work, we present a protocol where a secret key can be established between a quantum user and an almost classical user who only needs the quantum ability to access quantum channels, by securely delegating quantum computation to a quantum server. We show the proposed protocol is robust even when the delegated quantum server is a powerful adversary, and is experi…
Recently, Sun et al. [Quant Inf Proc DOI: 10.1007/s11128-013-0569-x] presented an efficient multi-party quantum key agreement (QKA) protocol by employing single particles and unitary operations. The aim of this protocol is to fairly and securely negotiate a secret session key among $N$ parties with a high qubit efficiency. In addition, the authors claimed that no participant can learn anything more than his/her prescribed output in this protocol, i.e., the sub-secret keys of the participants can be kept secret during the protocol. However, here we points out that the sub-secret of a participan…
Blind quantum computation protocols allow a user with limited quantum technology to delegate an intractable computation to a quantum server while keeping the computation perfectly secret. Whereas in some protocols a user can verify that calculated outcomes are correct, a third party cannot do this, which allows a dishonest user or owner to benefit illegally. I propose a new blind quantum computation protocol with a new property called public verifiability, which enables any third party to assure that a party does not benefit from attempted deception.
In Yang et al.'s literatures (J. Phys. A: Math. 42, 055305, 2009; J. Phys. A:Math. 43, 209801, 2010), a quantum private comparison protocol based on Bell states and hash function is proposed, which aims to securely compare the equality of two participants' information with the help of a dishonest third party (TP). However, this study will point out their protocol cannot resist a special kind of attack, TP's same initial states attack, which is presented in this paper. That is, the dishonest TP can disturb the comparison result without being detected through preparing the same initial states. F…
This study proposes a new mediated asymmetric semi-quantum key distribution (MASQKD) protocol. With the help of a dishonest third party, two classical participants, who have only limited asymmetric quantum capabilities, can share a secret key with each other. The proposed protocol is shown to be immune to several well-known attacks. Furthermore, an improved MASQKD protocol is proposed in which the quantum capabilities of one participant can be further reduced.
Oblivious transfer is a fundamental primitive in cryptography. While perfect information theoretic security is impossible, quantum oblivious transfer protocols can limit the dishonest players' cheating. Finding the optimal security parameters in such protocols is an important open question. In this paper we show that every 1-out-of-2 oblivious transfer protocol allows a dishonest party to cheat with probability bounded below by a constant strictly larger than 1/2. Alice's cheating is defined as her probability of guessing Bob's index, and Bob's cheating is defined as his probability of guessin…
The fairness of a secure multi-party quantum key agreement (MQKA) protocol requires that all involved parties are entirely peer entities and can equally influence the outcome of the protocol to establish a shared key wherein no one can decide the shared key alone. However, it is found that parts of the existing MQKA protocols are sensitive to collusion attacks, i.e., some of the dishonest participants can collaborate to predetermine the final key without being detected. In this paper, a multi-party QKA protocol resisting collusion attacks is proposed. Different from previous QKA protocol resis…
The no-cloning property of quantum mechanics allows unforgeability of quantum banknotes and credit cards. Quantum credit card protocols involve a bank, a client and a payment terminal, and their practical implementation typically relies on encoding information on weak coherent states of light. Here, we provide a security proof in this practical setting for semi-device-independent quantum money with classical verification, involving an honest bank, a dishonest client and a potentially untrusted terminal. Our analysis uses semidefinite programming in the coherent state framework and aims at simu…
We present a number of schemes that use quantum mechanics to preserve privacy, in particular, we show that entangled quantum states can be useful in maintaining privacy. We further develop our original proposal [see Phys. Lett. A 349, 75 (2006)] for protecting privacy in voting, and examine its security under certain types of attacks, in particular dishonest voters and external eavesdroppers. A variation of these quantum-based schemes can be used for multi-party function evaluation. We consider functions corresponding to group multiplication of $N$ group elements, with each element chosen by a…
Quantum secret sharing allows each player to have classical information for secret sharing in quantum mechanical ways. In this work, we construct a class of quantum states on which players can quantumly perform secret sharing secure against dishonest players as well as eavesdropper. We here call them the genuine secret-sharing states. In addition, we show that if $N$ players share an $N$-party genuine secret-sharing state, then arbitrary $M$ players out of the total players can share an $M$-party genuine secret-sharing state by means of local operations and classical communication on the state…
We present a quantum protocol for the task of weak coin flipping. We find that, for one choice of parameters in the protocol, the maximum probability of a dishonest party winning the coin flip if the other party is honest is 1/sqrt(2). We also show that if parties restrict themselves to strategies wherein they cannot be caught cheating, their maximum probability of winning can be even smaller. As such, the protocol offers additional security in the form of cheat sensitivity.
The goal of two-party cryptography is to enable two parties, Alice and Bob, to solve common tasks without the need for mutual trust. Examples of such tasks are private access to a database, and secure identification. Quantum communication enables security for all of these problems in the noisy-storage model by sending more signals than the adversary can store in a certain time frame. Here, we initiate the study of device-independent protocols for two-party cryptography in the noisy-storage model. Specifically, we present a relatively easy to implement protocol for a cryptographic building bloc…
We propose a quantum secret sharing scheme between $m$-party and $n$-party using three conjugate bases, i.e. six states. A sequence of single photons, each of which is prepared in one of the six states, is used directly to encode classical information in the quantum secret sharing process. In this scheme, each of all $m$ members in group 1 choose randomly their own secret key individually and independently, and then directly encode their respective secret information on the states of single photons via unitary operations, then the last one (the $m$th member of group 1) sends $1/n$ of the resul…
Multipartite entangled states are a fundamental resource for a wide range of quantum information processing tasks. In particular, in quantum networks it is essential for the parties involved to be able to verify if entanglement is present before they carry out a given distributed task. Here we design and experimentally demonstrate a protocol that allows any party in a network to check if a source is distributing a genuinely multipartite entangled state, even in the presence of untrusted parties. The protocol remains secure against dishonest behaviour of the source and other parties, including …
We investigate sampling procedures that certify that an arbitrary quantum state on $n$ subsystems is close to an ideal mixed state $φ^{\otimes n}$ for a given reference state $φ$, up to errors on a few positions. This task makes no sense classically: it would correspond to certifying that a given bitstring was generated according to some desired probability distribution. However, in the quantum case, this is possible if one has access to a prover who can supply a purification of the mixed state. In this work, we introduce the concept of mixed-state certification, and we show that a natural sam…
We study quantum protocols among two distrustful parties. By adopting a rather strict definition of correctness - guaranteeing that honest players obtain their correct outcomes only - we can show that every strictly correct quantum protocol implementing a non-trivial classical primitive necessarily leaks information to a dishonest player. This extends known impossibility results to all non-trivial primitives. We provide a framework for quantifying this leakage and argue that leakage is a good measure for the privacy provided to the players by a given protocol. Our framework also covers the cas…
Inspired by the semi-quantum protocols, this paper defines the lightweight quantum security protocols, in which lightweight participants can only operate two out of four very lightweight quantum operations. Subsequently, this study proposes a Lightweight Mediated Quantum Key Distribution (LMQKD) protocol as an example to disclose the feasibility and advantage of the lightweight quantum protocol. In the proposed protocol, a dishonest third party (TP) with complete quantum capabilities helps two lightweight quantum users establish a secure key. The lightweight quantum users are allowed to perfor…
Weak coin flipping is among the fundamental cryptographic primitives which ensure the security of modern communication networks. It allows two mistrustful parties to remotely agree on a random bit when they favor opposite outcomes. Unlike other two-party computations, one can achieve information-theoretic security using quantum mechanics only: both parties are prevented from biasing the flip with probability higher than $1/2+ε$, where $ε$ is arbitrarily low. Classically, the dishonest party can always cheat with probability $1$ unless computational assumptions are used. Despite its importance,…
Anonymous voting is a voting method of hiding the link between a vote and a voter, the context of which ranges from governmental elections to decision making in small groups like councils or companies. In this paper, we propose a quantum anonymous voting protocol assisted by two kinds of entangled quantum states. Particularly, we provide a mechanism of opening and permuting the ordered votes of all the voters in an anonymous manner; any party, who is interested in the voting results, can acquire a permutation copy, and then obtains the voting result through simple calculation. Unlike all previ…
Semi-quantum private comparison (SQPC) allows two participants with limited quantum ability to securely compare the equality of their secrets with the help of a semi-dishonest third party (TP). Recently, Jiang proposed a SQPC protocol based on Bell states (Quantum Inf Process 19(6): 180, 2020) and claimed it is secure. In this paper, we present two types of attack on Jiang's SQPC protocol. In the first type of attack, an outside eavesdropper will make participants accept a wrong result. In the second type of attack, a malicious participant will not only make the other participant accept a wron…
Quantum Key Distribution by Quantum Energy Teleportation
Ben-Gurion University of the Negev（内盖夫本-古里安大学）；University of Massachusetts Boston（马萨诸塞大学波士顿分校）；Stony Brook University（石溪大学）；Tel-Aviv University（特拉维夫大学）
Coin flipping is a fundamental cryptographic primitive that enables two distrustful and far apart parties to create a uniformly random bit [Blu81]. Quantum information allows for protocols in the information theoretic setting where no dishonest party can perfectly cheat. The previously best-known quantum protocol by Ambainis achieved a cheating probability of at most 3/4 [Amb01]. On the other hand, Kitaev showed that no quantum protocol can have cheating probability less than $1/\sqrt{2}$ [Kit03]. Closing this gap has been one of the important open questions in quantum cryptography. In this pa…
We present a new protocol and two lower bounds for quantum coin flipping. In our protocol, no dishonest party can achieve one outcome with probability more than 0.75. Then, we show that our protocol is optimal for a certain type of quantum protocols. For arbitrary quantum protocols, we show that if a protocol achieves a bias of at most $ε$, it must use at least $Ω(\log \log \frac{1}ε)$ rounds of communication. This implies that the parallel repetition fails for quantum coin flipping. (The bias of a protocol cannot be arbitrarily decreased by running several copies of it in parallel.)
We present a composably secure protocol allowing $n$ parties to test an entanglement generation resource controlled by a possibly dishonest party. The test consists only in local quantum operations and authenticated classical communication once a state is shared among them and provides composable security, namely it can be used as a secure subroutine by $n$ honest parties within larger communication protocols to test if a source is sharing quantum states that are at least $ε$-close to the GHZ state. This claim comes on top of previous results on multipartite entanglement verification where the…
We study cheating strategies against a practical four-state quantum bit-commitment protocol and its two-state variant when the underlying quantum channels are noisy and the cheating party is constrained to using single-qubit measurements only. We show that simply inferring the transmitted photons' states by using the Breidbart basis, optimal for ambiguous (minimum-error) state discrimination, does not directly produce an optimal cheating strategy for this bit-commitment protocol. We introduce a new strategy, based on certain post-measurement processes, and show it to have better chances at che…
We show how to implement cryptographic primitives based on the realistic assumption that quantum storage of qubits is noisy. We thereby consider individual-storage attacks, i.e. the dishonest party attempts to store each incoming qubit separately. Our model is similar to the model of bounded-quantum storage, however, we consider an explicit noise model inspired by present-day technology. To illustrate the power of this new model, we show that a protocol for oblivious transfer (OT) is secure for any amount of quantum-storage noise, as long as honest players can perform perfect quantum operation…
Due to the exiting semi-quantum secret sharing protocol have two challenges including (1) the dealer must be the quantum user, and (2) the classical users must equip with the Trojan Horse detectors, this study wants to propose a novel mediate semi-quantum secret sharing (MSQSS) protocol to let a classical dealer can share his/her secrets to the classical agents with the help of a dishonest third-party (TP). The proposed MSQSS protocol adopts the one-way quantum communication and thus it is free from the Trojan Horse attacks. Furthermore, the security analysis is given for proving that the prop…
Bit commitment is a fundamental cryptographic primitive with numerous applications. Quantum information allows for bit commitment schemes in the information theoretic setting where no dishonest party can perfectly cheat. The previously best-known quantum protocol by Ambainis achieved a cheating probability of at most 3/4[Amb01]. On the other hand, Kitaev showed that no quantum protocol can have cheating probability less than 1/sqrt{2} [Kit03] (his lower bound on coin flipping can be easily extended to bit commitment). Closing this gap has since been an important and open question. In this pape…
We present a fair and optimistic quantum contract signing protocol between two clients that requires no communication with the third trusted party during the exchange phase. We discuss its fairness and show that it is possible to design such a protocol for which the probability of a dishonest client to cheat becomes negligible, and scales as N^{-1/2}, where N is the number of messages exchanged between the clients. Our protocol is not based on the exchange of signed messages: its fairness is based on the laws of quantum mechanics. Thus, it is abuse-free, and the clients do not have to generate…
Secret sharing allows a trusted party (the dealer) to distribute a secret to a group of players, who can only access the secret cooperatively. Quantum secret sharing (QSS) protocols could provide unconditional security based on fundamental laws in physics. While the general security proof has been established recently in an entanglement-based QSS protocol, the tolerable channel loss is unfortunately rather small. Here we propose a continuous variable QSS protocol using conventional laser sources and homodyne detectors. In this protocol, a Gaussian-modulated coherent state (GMCS) prepared by on…
This study proposes a multiparty mediated quantum secret sharing (MQSS) protocol that allows n restricted quantum users to share a secret via the assistance of a dishonest third-party (TP) with full quantum capabilities. Under the premise that a restricted quantum user can only perform the Hadamard transformation and the Z-basis measurement, the proposed MQSS protocol has addressed two common challenges in the existing semi-quantum secret sharing protocols: (1) the dealer must have full quantum capability, and (2) the classical users must equip with the wavelength quantum filter and the photon…
Lucerne School of Computer Science and Information Technology, Lucerne University of Applied Sciences and Arts（卢塞纳应用科学与艺术大学计算机科学与信息技术学院）；Ergon Informatik AG（Ergon信息科技股份公司）
The problem of reliably certifying the outcome of a computation performed by a quantum device is rapidly gaining relevance. We present two protocols for a classical verifier to verifiably delegate a quantum computation to two non-communicating but entangled quantum provers. Our protocols have near-optimal complexity in terms of the total resources employed by the verifier and the honest provers, with the total number of operations of each party, including the number of entangled pairs of qubits required of the honest provers, scaling as $O(g\log g)$ for delegating a circuit of size $g$. This i…
