This paper presents a prepare-and-measure scheme using $N$-dimensional quantum particles as information carriers where $N$ is a prime power. One of the key ingredients used to resist eavesdropping in this scheme is to depolarize all Pauli errors introduced to the quantum information carriers. Using the Shor-Preskill-type argument, we prove that this scheme is unconditionally secure against all attacks allowed by the laws of quantum physics. For $N = 2^n > 2$, each information carrier can be replaced by $n$ entangled qubits. In this case, there is a family of eavesdropping attacks on which no unentangled-qubit-based prepare-and-measure quantum key distribution scheme known to date can generate a provably secure key. In contrast, under the same family of attacks, our entangled-qubit-based scheme remains secure whenever $2^n \geq 4$. This demonstrates the advantage of using entangled particles as information carriers and of using depolarization of Pauli errors to combat eavesdropping attacks more drastic than those that can be handled by unentangled-qubit-based prepare-and-measure schemes.
This article describes a quantum bit commitment protocol, QBC1, based on entanglement destruction via forced measurements and proves its unconditional security.
An unconditionally secure quantum cion tossing protocol for two remote participants via entangled swapping is presented. The security of this protocol is guaranteed by the nonlocal property of quantum entanglement and the classical complexity.
It is generally believed that unconditionally secure quantum bit commitment (QBC) is proven impossible by a "no-go theorem". We point out that the theorem only establishes the existence of a cheating unitary transformation in any QBC scheme secure against the receiver, but this fact alone is not sufficient to rule out unconditionally secure QBC as a matter of principle, because there exists no proof that the cheating unitary transformation must be known to the cheater in all possible cases. In this work, we show how to circumvent the "no-go theorem" and prove that unconditionally secure QBC is…
We present a quantum-public-key identification protocol and show that it is secure against a computationally-unbounded adversary. This demonstrates for the first time that unconditionally-secure and reusable public-key authentication is possible in principle with (pure-state) public keys.
We demonstrate a weak pulse quantum key distribution system using the BB84 protocol which is secure against all individual attacks, including photon number splitting. By carefully controlling the weak pulse intensity we demonstrate the maximum secure bit rate as a function of the fibre length. Unconditionally secure keys can be formed for standard telecom fibres exceeding 50 km in length.
The ``impossibility proof'' on unconditionally secure quantum bit commitment is examined. It is shown that the possibility of juxtaposing quantum and classical randomness has not been properly taken into account. A specific protocol that beats entanglement cheating with entanglement is proven to be unconditionally secure.
The ``impossibility proof'' on unconditionally secure quantum bit commitment is critically analyzed. Many possibilities for obtaining a secure bit commitment protocol are indicated, purely on the basis of two-way quantum communications, which are not covered by the impossibility proof formulation. They are classified under six new types of protocols, with security proofs for specific examples on four types. Reasons for some previously failed attempts at obtaining secure protocols are also indicated.
A new cryptographic tool, anonymous quantum key technique, is introduced that leads to unconditionally secure key distribution and encryption schemes that can be readily implemented experimentally in a realistic environment. If quantum memory is available, the technique would have many features of public-key cryptography; an identification protocol that does not require a shared secret key is provided as an illustration. The possibility is also indicated for obtaining unconditionally secure quantum bit commitment protocols with this technique.
This paper has been withdrawn by the authors,because the proposed protocol is still coverd by the no-go theorem of Mayers, Lo and Chau. We thank H-K. Lo and HF Chau for helpful correspondences.
This article describes a quantum bit commitment protocol, QBC3, based on entanglement destruction via forced measurements and proves its unconditional security. Some comments on the current status of the field are also made.
Spacetime-constrained oblivious transfer (SCOT) extends the fundamental primitive of oblivious transfer to Minkowski space. SCOT and location oblivious data transfer (LODT) are the only known cryptographic tasks with classical inputs and outputs for which unconditional security needs both quantum theory and relativity. We give an unconditionally secure SCOT protocol that, contrasting previous SCOT and LODT protocols, is practical to implement with current technology, where distant agents need only communicate classical information, while quantum communication occurs at a single location. We al…
Over decades quantum cryptography has been intensively studied for unconditionally secured data transmission in a quantum regime. Due to the quantum loopholes caused by imperfect single photon detectors and/or lossy quantum channels, however, the quantum cryptography is practically inefficient and even vulnerable to eavesdropping. Here, a method of unconditionally secured key distribution potentially compatible with current fiber-optic communications networks is proposed in a classical regime for high-speed optical backbone networks. The unconditional security is due to the quantum superpositi…
By using local quantum teleportation of a fixed state to one qubit of an entangled pair sent from the other party, it is shown how one party can commit a bit with only classical information as evidence that results in an unconditionally secure protocol. The well-known ``impossibility proof'' does not cover such protocols due to its different commitment and opening prescriptions, which necessitate actual quantum measurements among different possible systems that cannot be entangled as a consequence.
We propose an unconditionally secure quantum key distribution (QKD) protocol, which uses a relatively strong signal pulse. While our protocol shares similar security bases as the Bennett 1992 protocol with a strong reference pulse (B92), our scheme uses a smaller number of detectors and it is robust against Rayleigh scattering in an optical fibre. We derive a lower bound of secret key generation rate of our protocol and show that our protocol can cover relatively long distances, assuming precise phase modulations and stable interferometers.
We report here a complete experimental realization of one-way decoy-pulse quantum key distribution, demonstrating an unconditionally secure key rate of 5.51 kbps for a 25.3 km fibre length. This is two orders of magnitudes higher than the value that can be obtained with a non-decoy system. We introduce also a simple test for detecting the photon number splitting attack and highlight that it is essential for the security of the technique to fully characterize the source and detectors used.
Based on the detection loophole-free photon key distribution (PKD) compatible with classical optical systems, an optical key distribution (OKD) protocol is presented for unconditionally secured cryptography in fiber-optic communications networks using addressable continuous phase basis, where each communication channel is composed of paired transmission lines. The unconditional security in OKD lies in quantum superposition between the paired lines of each channel. The continuous phase basis in OKD can be applied for one-time-pad optical cryptography in networks, whose network address capacity …
Bit commitment involves the submission of evidence from one party to another so that the evidence can be used to confirm a later revealed bit value by the first party, while the second party cannot determine the bit value from the evidence alone. It is widely believed that secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. In this paper, the scope of this general impossibility proof is extended and analyzed, and gaps are found. Three specific protocols are described for which the entanglement cheating as given…
Long-distance quantum communication requires quantum repeaters to overcome photon loss in optical fibers. Here we demonstrate a repeater node with two memory atoms in an optical cavity. Both atoms are individually and repeatedly entangled with photons that are distributed until each communication partner has independently received one of them. An atomic Bell-state measurement followed by classical communication serves to establish a key. We demonstrate scaling advantage of the key rate, increase the effective attenuation length by a factor of two, and beat the error-rate threshold of 11\% for …
Using a neutron double-slit setup, we construct a quantum bit commitment scheme in which time development of quantum states plays an essential role. Our scheme evades the widely accepted no-go theorem by the fact that it is neither possible to stop the time evolution of spreading wave packets, nor is it possible to evolve them backward in time. Moreover, for unstable particles such as neutrons, one cannot delay detecting their positions indefinitely, or they would disintegrate spontaneously and escape detection. We find that using non-stationary states instead of stationary ones, unconditional…
We propose a new classical bit commitment protocol using the relativistic constraint that signals cannot travel faster than the speed of light $c$. This protocol is unconditionally secure against both classical or quantum attacks. The sender (Alice) and the receiver (Bob) each controls two secure stations separated by a large distance $d$, and they communicate by exchanging classical information only. Alice commits by sending from her stations two causally independent encrypted messages to the neighboring Bob's stations, after that the protocol is out of her control and she plays no role in th…
We introduce relativistic multi-party biased die rolling protocols, generalizing coin flipping to $M \geq 2$ parties and to $N \geq 2$ outcomes for any chosen outcome biases, and show them unconditionally secure. Our results prove that the most general random secure multi-party computation, where all parties receive the output and there is no secret input by any party, can be implemented with unconditional security. Our protocols extend Kent's [A. Kent, Phys. Rev. Lett. 83, 5382 (1999)] two-party unbiased coin flipping protocol, do not require any quantum communication, are practical to implem…
Unconditionally secure quantum bit commitment (QBC) was considered impossible. But the no-go proofs are based on the Hughston-Jozsa-Wootters (HJW) theorem (a.k.a. the Uhlmann theorem). Recently it was found that in high-dimensional systems, there exist some states which can display a chaos effect in quantum steering, so that the attack strategy based on the HJW theorem has to require the capability of discriminating quantum states with very subtle difference, to the extent that is not allowed by the uncertainty principle. With the help of this finding, here we propose a simple QBC protocol whi…
We introduce a novel form of decoy-state technique to make the single-photon Bennett 1992 protocol robust against losses and noise of a communication channel. Two uninformative states are prepared by the transmitter in order to prevent the unambiguous state discrimination attack and improve the phase-error rate estimation. The presented method does not require strong reference pulses, additional electronics or extra detectors for its implementation.
A new relativistic quantum protocol is proposed allowing to implement the bit commitment scheme. The protocol is based on the idea that in the relativistic case the field propagation to the region of space accessible to measurement requires, contrary to the non-relativistic case, a finite non-zero time which depends on the structure of the particular state of the field. In principle, the secret bit can be stored for arbitrarily long time with the probability arbitrarily close to unit.
In this paper, we prove that the unconditionally secure key can be surprisingly extracted from {\it multi}-photon emission part in the photon polarization-based QKD. One example is shown by explicitly proving that one can indeed generate an unconditionally secure key from Alice's two-photon emission part in ``Quantum cryptography protocols robust against photon number splitting attacks for weak laser pulses implementations'' proposed by V. Scarani {\it et al.,} in Phys. Rev. Lett. {\bf 92}, 057901 (2004), which is called SARG04. This protocol uses the same four states as in BB84 and differs on…
The claim of quantum cryptography has always been that it can provide protocols that are unconditionally secure, that is, for which the security does not depend on any restriction on the time, space or technology available to the cheaters. We show that this claim does not hold for any quantum bit commitment protocol. Since many cryptographic tasks use bit commitment as a basic primitive, this result implies a severe setback for quantum cryptography. The model used encompasses all reasonable implementations of quantum bit commitment protocols in which the participants have not met before, inclu…
Bit commitment is a fundamental cryptographic task that guarantees a secure commitment between two mutually mistrustful parties and is a building block for many cryptographic primitives, including coin tossing, zero-knowledge proofs, oblivious transfer and secure two-party computation. Unconditionally secure bit commitment was thought to be impossible until recent theoretical protocols that combine quantum mechanics and relativity were shown to elude previous impossibility proofs. Here we implement such a bit commitment protocol. In the experiment, the committer performs quantum measurements u…
We prove the unconditional security of the Bennett 1992 protocol, by using a reduction to an entanglement distillation protocol initiated by a local filtering process. The bit errors and the phase errors are correlated after the filtering, and we can bound the amount of phase errors from the observed bit errors by an estimation method involving nonorthogonal measurements. The angle between the two states shows a trade-off between accuracy of the estimation and robustness to noises.
It is shown how the evidence state space in quantum bit commitment may be made to depend on the bit value 0 or 1 with split entangled pairs. As a consequence, one can obtain a protocol that is perfectly concealing, but is also $ε$-binding because the bit-value dependent evidence space prevents the committing party from cheating by means of a local transformation that is independent of the part of evidence state space that has never been in his possession.
The commodity-based cryptography is an alternative approach to realize conventionally impossible cryptographic primitives such as unconditionally secure bit-commitment by consuming pre-established correlation between distrustful participants. A unit of such classical correlation is known as the one-time table (OTT). In this paper, we introduce a new example besides quantum key distribution in which quantum correlation is useful for cryptography. We propose a scheme for unconditionally secure qubit-commitment, a quantum cryptographic primitive forbidden by the recently proven no-masking theorem…
A class of quantum protocols of bit commitment is constructed based on the nonorthogonal states coding and the correlation immunity of some Boolean functions. The binding condition of these protocols is guaranteed mainly by the law of causality and the concealing condition is guaranteed by the indistinguishability between nonorthogonal quantum states and the correlation immunity of Boolean functions. We also give out an oblivious transfer protocol based on two-nonorthogonal states coding and build a bit commitment protocol on top of it. The relationship between these protocols and the well kno…
A new commitment scheme based on position-verification and non-local quantum correlations is presented here for the first time in literature. The only credential for unconditional security is the position of committer and non-local correlations generated; neither receiver has any pre-shared data with the committer nor does receiver require trusted and authenticated quantum/classical channels between him and the committer. In the proposed scheme, receiver trusts the commitment only if the scheme itself verifies position of the committer and validates her commitment through non-local quantum cor…
In search of a quantum key distribution scheme that could stand up for more drastic eavesdropping attack, I discover a prepare-and-measure scheme using $N$-dimensional quantum particles as information carriers where $N$ is a prime power. Using the Shor-Preskill-type argument, I prove that this scheme is unconditional secure against all attacks allowed by the laws of quantum physics. Incidentally, for $N = 2^n > 2$, each information carrier can be replaced by $n$ entangled qubits. And in this case, I discover an eavesdropping attack on which no unentangled-qubit-based prepare-and-measure quantu…
Recently, new physics for unconditional security in a classical key distribution (USCKD) in a frame of a double Mach-Zehnder interferometer has been proposed and demonstrated as a proof of principle, where the unconditional security is unaffected by the no-cloning theorem of quantum key distribution protocols. Due to environmental phase fluctuations caused by temperature variations, atmospheric turbulences, or mechanical vibrations, active phase locking seems to be necessary for the two-channel transmission layout of USCKD. Here, the two-channel layout of USCKD is demonstrated to be an environ…
We describe a new classical bit commitment protocol based on cryptographic constraints imposed by special relativity. The protocol is unconditionally secure against classical or quantum attacks. It evades the no-go results of Mayers, Lo and Chau by requiring from Alice a sequence of communications, including a post-revelation verification, each of which is guaranteed to be independent of its predecessor.
We consider the problem of secure key distribution among $n$ trustful agents: the goal is to distribute an identical random bit-string among the $n$ agents over a noisy channel such that eavesdroppers learn little about it. We study the general situation where the only resources required are secure bipartite key distribution and authenticated classical communication. Accordingly, multipartite quantum key distribution can be proven unconditionally secure by reducing the problem to the biparitite case and invoking the proof of security of bipartite quantum key distribution.
Bit commitment involves the submission of evidence from one party to another so that the evidence can be used to confirm a later revealed bit value by the first party, while the second party cannot determine the bit value from the evidence alone. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. In this paper, the scope of this general impossibility proof is analyzed, and gaps are found. Two variants of a bit commitment scheme utilizing anonymous quantum states and d…
The ability to know and verifiably demonstrate the origins of messages can often be as important as encrypting the message itself. Here we present an experimental demonstration of an unconditionally secure digital signature (USS) protocol implemented for the first time, to the best of our knowledge, on a fully connected quantum network without trusted nodes. Our USS protocol is secure against forging, repudiation and messages are transferrable. We show the feasibility of unconditionally secure signatures using only bi-partite entangled states distributed throughout the network and experimental…
Device-independent quantum key distribution is the task of using uncharacterized quantum devices to establish a shared key between two users. If a protocol is secure regardless of the device behaviour, it can be used to generate a shared key even if the supplier of the devices is malicious. To date, all device-independent quantum key distribution protocols that are known to be secure require separate isolated devices for each entangled pair, which is a significant practical limitation. We introduce a protocol that requires Alice and Bob to have only one device each. Although inefficient, our p…
We propose a new unconditionally secure bit commitment scheme based on Minkowski causality and the properties of quantum information. The receiving party sends a number of randomly chosen BB84 qubits to the committer at a given point in space-time. The committer carries out measurements in one of the two BB84 bases, depending on the committed bit value, and transmits the outcomes securely at light speed in opposite directions to remote agents. These agents unveil the bit by returning the outcomes to adjacent agents of the receiver. The security proofs rely only on simple properties of quantum …
We prove the unconditional security of a quantum key distribution (QKD) protocol on a noisy channel against the most general attack allowed by quantum physics. We use the fact that in a previous paper we have reduced the proof of the unconditionally security of this QKD protocol to a proof that a corresponding Quantum String Oblivious Transfer (String-QOT) protocol would be unconditionally secure against Bob if implemented on top of an unconditionally secure bit commitment scheme. We prove a lemma that extends a security proof given by Yao for a (one bit) QOT protocol to this String-QOT protoc…
Bit commitment (BC) is an important cryptographic primitive for an agent to convince a mutually mistrustful party that she has already made a binding choice of 0 or 1 but only to reveal her choice at a later time. Ideally, a BC protocol should be simple, reliable, easy to implement using existing technologies, and most importantly unconditionally secure in the sense that its security is based on an information-theoretic proof rather than computational complexity assumption or the existence of a trustworthy arbitrator. Here we report such a provably secure scheme involving only one-way classica…
In a secure bit commitment protocol involving only classical physics, A commits either a 0 or a 1 to B. If quantum information is used in the protocol, A may be able to commit a state of the form $α\ket{0} + β\ket{1}$. If so, she can also commit mixed states in which the committed bit is entangled with other quantum states under her control. We introduce here a quantum cryptographic primitive, {\it bit commitment with a certificate of classicality} (BCCC), which differs from standard bit commitment in that it guarantees that the committed state has a fixed classical value. We show that no unco…
Signature schemes, proposed in 1976 by Diffie and Hellman, have become ubiquitous across modern communications. They allow for the exchange of messages from one sender to multiple recipients, with the guarantees that messages cannot be forged or tampered with and that messages also can be forwarded from one recipient to another without compromising their validity. Signatures are different from, but no less important than encryption, which ensures the privacy of a message. Commonly used signature protocols - signatures based on the Rivest-Adleman-Shamir (RSA) algorithm, the digital signature al…
The impossibility proof on unconditionally secure quantum bit commitment is critically reviewed. Different ways of obtaining secure protocols are indicated.
In coin tossing two remote participants want to share a uniformly distributed random bit. At the least in the quantum version, each participant test whether or not the other has attempted to create a bias on this bit. It is requested that, for b = 0,1, the probability that Alice gets bit b and pass the test is smaller than 1/2 whatever she does, and similarly for Bob. If the bound 1/2 holds perfectly against any of the two participants, the task realised is called an exact coin tossing. If the bound is actually $1/2 + ξ$ where the bias $ξ$ vanishes when a security parameter m defined by the pr…
We present a quantumly-enhanced protocol to achieve unconditionally secure delegated classical computation where the client and the server have both limited classical and quantum computing capacity. We prove the same task cannot be achieved using only classical protocols. This extends the work of Anders and Browne on the computational power of correlations to a security setting. Concretely, we present how a client with access to a non-universal classical gate such as a parity gate could achieve unconditionally secure delegated universal classical computation by exploiting minimal quantum gadge…
It was claimed that all quantum string seals are insecure [H. F. Chau, quant-ph/0602099]. However, here it will be shown that for imperfect quantum string seals, the information obtained by the measurement proposed in that reference is trivial. Therefore imperfect quantum string seals can be unconditionally secure.
We consider a setup in which the channel from Alice to Bob is less noisy than the channel from Eve to Bob. We show that there exist encoding and decoding which accomplish error correction and authentication simultaneously; that is, Bob is able to correctly decode a message coming from Alice and reject a message coming from Eve with high probability. The system does not require any secret key shared between Alice and Bob, provides information theoretic security, and can safely be composed with other protocols in an arbitrary context.
