Quantum mechanical effects have enabled the construction of cryptographic primitives that are impossible classically. For example, quantum copy-protection allows for a program to be encoded in a quantum state in such a way that the program can be evaluated, but not copied. Many of these cryptographic primitives are two-party protocols, where one party, Bob, has full quantum computational capabilities, and the other party, Alice, is only required to send random BB84 states to Bob. In this work, we show how such protocols can generically be converted to ones where Alice is fully classical, assuming that Bob cannot efficiently solve the LWE problem. In particular, this means that all communication between (classical) Alice and (quantum) Bob is classical, yet they can still make use of cryptographic primitives that would be impossible if both parties were classical. We apply this conversion procedure to obtain quantum cryptographic protocols with classical communication for unclonable encryption, copy-protection, computing on encrypted data, and verifiable blind delegated computation. The key technical ingredient for our result is a protocol for classically-instructed parallel remote state preparation of BB84 states. This is a multi-round protocol between (classical) Alice and (quantum polynomial-time) Bob that allows Alice to certify that Bob must have prepared $n$ uniformly random BB84 states (up to a change of basis on his space). Furthermore, Alice knows which specific BB84 states Bob has prepared, while Bob himself does not. Hence, the situation at the end of this protocol is (almost) equivalent to one where Alice sent $n$ random BB84 states to Bob. This allows us to replace the step of preparing and sending BB84 states in existing protocols by our remote-state preparation protocol in a generic and modular way.
Consider a protocol in which Belinda seals a (classical) message. She gives the resulting sealed message to Charlie, who can either unseal and read the message or return it unopened to Belinda. If he returns it unopened, Belinda should be able to verify that Charlie neither read the message nor made a copy that would allow him to read it later. Such a protocol is impossible with classical cryptography: Charlie can copy a message and do anything he likes to that copy without damaging the original. With quantum cryptography, on the other hand, the no cloning theorem implies that Charlie cannot s…
The no-cloning theorem asserts that, unlike classical information, quantum information cannot be copied. This seemingly undesirable phenomenon is harnessed in quantum cryptography. Uncloneable cryptography studies settings in which the impossibility of copying is a desired property, and achieves forms of security that are classically unattainable. The first example discovered and analyzed was in the context of cash. On the one hand, we want users to hold the cash; on the other hand, the cash should be hard to counterfeit. Quantum money uses variants of the no-cloning theorem to make counterfei…
Cryptography without Long-Term Quantum Memory and Global Entanglement: Classical Setups for One-Time Programs, Copy Protection, and Stateful Obfuscation
In this note we consider the problem of preparing a {\em single} copy of an arbitrary two-qubit mixed state $ρ$ starting from an entangled pure state $ψ$ and using only local operations assisted with classical communication. We present an analytical expression for the minimal amount of pure state entanglement required, and describe the corresponding local strategy. We also examine optimal probabilistic generalizations of the previous process.
In principle, quantum key distribution (QKD) offers unconditional security based on the laws of physics. In practice, flaws in the state preparation undermine the security of QKD systems, as standard theoretical approaches to deal with state preparation flaws are not loss-tolerant. An eavesdropper can enhance and exploit such imperfections through quantum channel loss, thus dramatically lowering the key generation rate. Crucially, the security analyses of most existing QKD experiments are rather unrealistic as they typically neglect this effect. Here, we propose a novel and general approach th…
Quantum copy-protection, introduced by Aaronson (CCC'09), uses the no-cloning principle of quantum mechanics to protect software from being illegally distributed. Constructing copy-protection has been an important problem in quantum cryptography. Since copy-protection is shown to be impossible to achieve in the plain model, we investigate the question of constructing copy-protection for arbitrary classes of unlearnable functions in the random oracle model. We present an impossibility result that rules out a class of copy-protection schemes in the random oracle model assuming the existence of q…
We consider the security of continuous-variable quantum cryptography as we approach the classical-limit, i.e., when the unknown preparation noise at the sender's station becomes significantly noisy or thermal (even by as much as 10,000 times the variance of the vacuum mode). We show that, provided the channel transmission losses do not exceed 50%, the security of quantum cryptography is not dependent on the channel transmission, and is therefore, incredibly robust against significant amounts of excess preparation noise. We extend these results to consider for the first time quantum cryptograph…
Formulating cryptographic definitions to protect against software piracy is an important research direction that has not received much attention. Since natural definitions using classical cryptography are impossible to achieve (as classical programs can always be copied), this directs us towards using techniques from quantum computing. The seminal work of Aaronson [CCC'09] introduced the notion of quantum copy-protection precisely to address the problem of software anti-piracy. However, despite being one of the most important problems in quantum cryptography, there are no provably secure solut…
Collective Quantum State Preparation Is Nonadditive
The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；Quantum Science Center of Guangdong–Hong Kong–Macao Greater Bay Area（粤港澳大湾区量子科学中心）
Quantum discord is the minimal bipartite resource which is needed for a secure quantum key distribution, being a cryptographic primitive equivalent to non-orthogonality. Its role becomes crucial in device-dependent quantum cryptography, where the presence of preparation and detection noise (inaccessible to all parties) may be so strong to prevent the distribution and distillation of entanglement. The necessity of entanglement is re-affirmed in the stronger scenario of device-independent quantum cryptography, where all sources of noise are ascribed to the eavesdropper.
Imaginary time evolution and ground state preparation using unitary multi-copy protocols
ITAMP, Center for Astrophysics | Harvard & Smithsonian（哈佛大学与史密森尼天体物理中心）；Institute for Quantum Optics and Quantum Information, Austrian Academy of Sciences（奥地利科学院量子光学与量子信息研究所）；Institute for Theoretical Physics, University of Innsbruck（因斯布鲁克大学理论物理研究所）
Nonlinear modifications to the laws of quantum mechanics have been proposed as a possible way to consistently describe information processing in the presence of closed timelike curves. These have recently generated controversy due to possible exotic information-theoretic effects, including breaking quantum cryptography and radically speeding up both classical and quantum computers. The physical interpretation of such theories, however, is still unclear. We consider a large class of operationally-defined theories that contain "nonlinear boxes" and show that operational verifiability without sup…
Multiple-copy state discrimination is a fundamental task in quantum information processing. If there are two, pure, non-orthogonal states then both local and collective schemes are known to reach the Helstrom bound, the maximum probability of successful discrimination allowed by quantum theory. For mixed states, it is known that only collective schemes can perform optimally, so it might be expected that these schemes are more resilient to preparation noise. We calculate the probability of success for two schemes, one local and one collective, in the regime of imperfect preparation fidelity. We…
We study the impact of finite-size effects on the security of thermal one-way quantum cryptography. Our approach considers coherent/squeezed states at the preparation stage, on the top of which the sender adds trusted thermal noise. We compute the key rate incorporating finite-size effects, and we obtain the security threshold at different frequencies. As expected finite-size effects deteriorate the performance of thermal quantum cryptography. Our analysis is useful to quantify the impact of this degradation on relevant parameters like tolerable attenuation, transmission frequencies at which o…
We study a general family of quantum protocols for position verification and present a new class of attacks based on the Clifford hierarchy. These attacks outperform current strategies based on port-based teleportation for a large class of practical protocols. We then introduce the Interleaved Product protocol, a new scheme for position verification involving only the preparation and measurement of single-qubit states for which the best available attacks have a complexity exponential in the number of classical bits transmitted.
We study the security of two-way quantum cryptography at different wavelengths of the electromagnetic spectrum, from the optical range down to the microwave range. In particular, we consider a two-way quantum communication protocol where Gaussian-modulated thermal states are subject to random Gaussian displacements and finally homodyned. We show how its security threshold (in reverse reconciliation) is extremely robust with respect to the preparation noise and able to outperform the security thresholds of one-way protocols at any wavelength. As a result, improved security distances are now acc…
Squeezed states of light have been improving the sensitivity of gravitational-wave observatories and are nonclassical resources of quantum cryptography and envisioned photonic quantum computers. The higher the squeeze factor is, the higher is the quantum advantage. Almost all applications of squeezed light require multi-path optical interference, whose unavoidable imperfections introduce optical loss, degrade the squeeze factor, as well as the quantum advantage. Here, for the first time, we experimentally demonstrate the distillation of Gaussian squeezed states that suffered from Gaussian phot…
The promise of secure cryptographic quantum key distribution schemes is based on the use of quantum effects in the spin space. We point out that in fact in many current quantum cryptography protocols the space part of the wave function is neglected. However exactly the space part of the wave function describes the behaviour of particles in ordinary real three-dimensional space. As a result such schemes can be secure against eavesdropping attacks in the abstract spin space but could be insecure in the real three-dimensional space. We discuss an approach to the security of quantum key distributi…
Mixed states of a quantum system, represented by density operators, can be decomposed as a statistical mixture of pure states in a number of ways where each decomposition can be viewed as a different preparation recipe. However the fact that the density matrix contains full information about the ensemble makes it impossible to estimate the preparation basis for the quantum system. Here we present a measurement scheme to (seemingly) improve the performance of unsharp measurements. We argue that in some situations this scheme is capable of providing statistics from a single copy of the quantum s…
We implement experimentally a deterministic method to prepare and measure so called single-photon two-qubit entangled states or single-photon Bell-states, in which the polarization and the spatial modes of a single-photon each represent a quantum bit. All four single-photon Bell-states can be easily prepared and measured deterministically using linear optical elements alone. We also discuss how this method can be used for recently proposed single-photon two-qubit quantum cryptography protocol.
A simplified eavesdropping-strategy for BB84 protocol in quantum cryptography (refer to quant-ph/9812022) is proposed. This scheme implements by the `indirect copying' technology. Under this scheme, eavesdropper can exactly obtain the exchanged information between the legitimate users without being detected.
We present theoretical and experimental study of preparing maximally entangled two-photon polarization states, or Bell states, using femtosecond pulse pumped spontaneous parametric down-conversion (SPDC). First, we show how the inherent distinguishability in femtosecond pulse pumped type-II SPDC can be removed by using an interferometric technique without spectral and amplitude post-selection. We then analyze the recently introduced Bell state preparation scheme using type-I SPDC. Theoretically, both methods offer the same results, however, type-I SPDC provides experimentally superior methods …
A recurring problem in quantum mechanics is to estimate either the state of a quantum system or the measurement operator applied to it. If we wish to estimate both, then the difficulty is that the state and the measurement always appear together: to estimate the state, we must use a measurement; to estimate the measurement operator, we must use a state. The data of such quantum estimation experiments come in the form of measurement frequencies. Ideally, the measured average frequencies can be attributed to an average state and an average measurement operator. If this is not the case, we have c…
We expand the recently discussed continuous-variable quantum key distribution scheme of Heid and Luetkenhaus (2006) to qudits with a lossy but noiseless quantum channel. Postselection methods are used. Secret key rates are calculated in the presence of loss for the direct and the reverse reconciliation method. In the case of reverse reconciliation the secret key rate increases with higher dimensions, in the case of direct reconciliation the result is reverse. Several ways of optimising the amplitude are discussed. In a next step the used states are generalised to squeezed states. Again secret …
We investigate optimal discrimination between two projective quantum measurements on a single qubit. We consider scenario where the measurement that should be identified can be performed twice and we show that adaptive discrimination strategy, entangled probe states, and feed-forward all help to increase the probability of correct identification of the measurement. We also experimentally demonstrate the studied discrimination strategies and test their performance. The employed experimental setup involves projective measurements on polarization states of single photons and preparation of requir…
We consider remote state preparation protocols for a set of pure states whose projectors form a basis for operators acting on the input Hilbert space. If a protocol (1) uses only forward communication and entanglement, (2) deterministically prepares an exact copy of the state, and (3) does so obliviously -- without leaking further information about the state to the receiver -- then the protocol can be modified to require from the sender only a single specimen of the state. Furthermore, the original protocol and the modified protocol use the same amount of classical communication. Thus, under t…
Secure communication is of paramount importance in modern society. Asymmetric cryptography methods such as the widely used RSA method allow secure exchange of information between parties who have not shared secret keys. However, the existing asymmetric cryptographic schemes rely on unproven mathematical assumptions for security. Further, the digital keys used in their implementation are susceptible to copying that might remain unnoticed. Here we introduce a secure communication method that overcomes these two limitations by employing Physical Unclonable Keys (PUKs). Using optical PUKs realized…
Security deficiencies and bugs in the Authentication of SIM cards in Global Systems for Mobile (GSM) have led us to present new protocols for these networks using the principles of quantum cryptography. In this paper first, we provide a protocol for detecting and removing SIM card that has a copy, using three entangle particles source and quantum channel when the original SIM card and its copy simultaneously logging in the mobile network. Then, another protocol based on the use of quantum memory (which is embedded in the SIM card) is presented. Both of these protocols can use to authenticate a…
Nonlocal correlations are a central feature of quantum theory, and understanding why quantum theory has a limited amount of nonlocality is a fundamental problem. Since nonlocality also has technological applications, e.g., for device-independent cryptography, it is useful to understand it as a resource and, in particular, whether and how different types of nonlocality can be interconverted. Here we focus on nonlocality distillation which involves using several copies of a nonlocal resource to generate one with more nonlocality. We introduce several distillation schemes which distil an extended…
The impossibility of perfectly copying (or cloning) an arbitrary quantum state is one of the basic rules governing the physics of quantum systems. The processes that perform the optimal approximate cloning have been found in many cases. These "quantum cloning machines" are important tools for studying a wide variety of tasks, e.g. state estimation and eavesdropping on quantum cryptography. This paper provides a comprehensive review of quantum cloning machines (both for discrete-dimensional and for continuous-variable quantum systems); in addition, it presents the role of cloning in quantum cry…
Device-independent quantum cryptography allows security even if the devices used to execute the protocol are untrusted - whether this is due to unknown imperfections in the implementation, or because the adversary himself constructed them to subvert the security of the protocol. While device-independence has seen much attention in the domain of quantum key distribution, relatively little is known for general protocols. Here we introduce a new model for device-independence for two-party protocols and position verification in the noisy-storage model. For the first time, we show that such protoco…
The noisy binary linear problem (NBLP) is known as a computationally hard problem, and therefore, it offers primitives for post-quantum cryptography. An efficient quantum NBLP algorithm that exhibits a polynomial quantum sample and time complexities has recently been proposed. However, the algorithm requires a large number of samples to be loaded in a highly entangled state and it is unclear whether such a precondition on the quantum speedup can be obtained efficiently. Here, we present a complete analysis of the quantum solvability of the NBLP by considering the entire algorithm process, name…
The powerful no-cloning principle of quantum mechanics can be leveraged to achieve interesting primitives, referred to as unclonable primitives, that are impossible to achieve classically. In the past few years, we have witnessed a surge of new unclonable primitives. While prior works have mainly focused on establishing feasibility results, another equally important direction, that of understanding the relationship between different unclonable primitives is still in its nascent stages. Moving forward, we need a more systematic study of unclonable primitives. To this end, we introduce a new fra…
Quantum retrodiction involves finding the probabilities for various preparation events given a measurement event. This theory has been studied for some time but mainly as an interesting concept associated with time asymmetry in quantum mechanics. Recent interest in quantum communications and cryptography, however, has provided retrodiction with a potential practical application. For this purpose quantum retrodiction in open systems should be more relevant than in closed systems isolated from the environment. In this paper we study retrodiction in open systems and develop a general master equat…
The ideal Bennett-Brassard 1984 (BB84) quantum key distribution protocol is based on the preparation and measurement of qubits in two alternative bases differing by an angle of pi/2. Any real implementation of the protocol, though, will inevitably introduce misalignments in the preparation of the states and in the alignment of the measurement bases with respect to this ideal situation. Various security proofs take into account (at least partially) such errors, i.e., show how Alice and Bob can still distil a secure key in the presence of these imperfections. Here, we consider the complementary …
Trapdoor Functions with Secure Key Leasing and Copy Protection
NTT Social Informatics Laboratories（NTT社会信息学实验室）；NTT Research Center for Theoretical Quantum Information（NTT理论量子信息中心）；Yukawa Institute for Theoretical Physics, Kyoto University（京都大学汤川理论物理研究所）
Graph states are an important class of multipartite entangled states. Previous experimental generation of graph states and in particular the Greenberger-Horne-Zeilinger (GHZ) states in linear optics quantum information schemes is subjected to an exponential decay in efficiency versus the system size, which limits its large-scale applications in quantum networks. Here we demonstrate an efficient scheme to prepare graph states with only a polynomial overhead using long-lived atomic quantum memories. We generate atom-photon entangled states in two atomic ensembles asynchronously, retrieve the sto…
Publicly verifiable quantum money is a protocol for the preparation of quantum states that can be efficiently verified by any party for authenticity but is computationally infeasible to counterfeit. We develop a cryptographic scheme for publicly verifiable quantum money based on Gaussian superpositions over random lattices. We introduce a verification-of-authenticity procedure based on the lattice discrete Fourier transform, and subsequently prove the unforgeability of our quantum money under the hardness of the short vector problem from lattice-based cryptography.
We address the role of the phase-insensitive trusted preparation and detection noise in the security of a continuous-variable quantum key distribution, considering the Gaussian protocols on the basis of coherent and squeezed states and studying them in the conditions of Gaussian lossy and noisy channels. The influence of such a noise on the security of Gaussian quantum cryptography can be crucial, even despite the fact that a noise is trusted, due to a strongly nonlinear behavior of the quantum entropies involved in the security analysis. We recapitulate the known effect of the preparation noi…
The classical channel remote state preparation (ccRSP) is an important two-party primitive in quantum cryptography. Alice (classical polynomial-time) and Bob (quantum polynomial-time) exchange polynomial rounds of classical messages, and Bob finally gets random single-qubit states while Alice finally gets classical descriptions of the states. In [T. Morimae, arXiv:2003.10712], an information-theoretically-sound non-interactive protocol for the verification of quantum computing was proposed. The verifier of the protocol is classical, but the trusted center is assumed that sends random single-qu…
We introduce a secure hardware device named a QEnclave that can secure the remote execution of quantum operations while only using classical controls. This device extends to quantum computing the classical concept of a secure enclave which isolates a computation from its environment to provide privacy and tamper-resistance. Remarkably, our QEnclave only performs single-qubit rotations, but can nevertheless be used to secure an arbitrary quantum computation even if the qubit source is controlled by an adversary. More precisely, attaching a QEnclave to a quantum computer, a remote client control…
