Quantum cryptography: a practical information security perspective
Kenneth G. Paterson, Fred Piper, Ruediger Schack
备注：
5 pages, new title, published version, minor changes only
发表信息：
Published in Quantum Communication and Security, Proceedings, NATO Advanced Research Workshop, edited by M. Zukowski, S. Kilin and J. Kowalik, p. 175-180 (IOS Press, Amsterdam, 2007)
Quantum Key Exchange (QKE, also known as Quantum Key Distribution or QKD) allows communicating parties to securely establish cryptographic keys. It is a well-established fact that all QKE protocols require that the parties have access to an authentic channel. Without this authenticated link, QKE is vulnerable to man-in-the-middle attacks. Overlooking this fact results in exaggerated claims and/or false expectations about the potential impact of QKE. In this paper we present a systematic comparison of QKE with traditional key establishment protocols in realistic secure communication systems.
We find that the generally accepted security criteria are flawed for a whole class of protocols for quantum cryptography. This is so because a standard assumption of the security analysis, namely that the so-called square-root measurement is optimal for eavesdropping purposes, is not true in general. There are rather large parameter regimes in which the optimal measurement extracts substantially more information than the square-root measurement.
We investigate a new strategy for incoherent eavesdropping in Ekert's entanglement based quantum key distribution protocol. We show that under certain assumptions of symmetry the effectiveness of this strategy reduces to that of the original single qubit protocol of Bennett and Brassard.
Weak coherent states as a photon source for quantum cryptography have limit in secure data rate and transmission distance because of the presence of multi-photon events and loss in transmission line. Two-photon events in a coherent state can be taken out by a two-photon interference scheme. We investigate the security issue of utilizing this modified coherent state in quantum cryptography. A 4 dB improvement in secure data rate or a nearly two-fold increase in transmission distance over the coherent state are found. With a recently proposed and improved encoding strategy, further improvement i…
We present strong attacks against quantum key distribution schemes which use quantum memories and quantum gates to attack directly the final key. We analyze a specific attack of this type, for which we find the density matrices available to the eavesdropper and the optimal information which can be extracted from them. We prove security against this attack and discuss security against any attack allowed by the rules of quantum mechanics.
We investigate the security of continuous-variable (CV) quantum key distribution (QKD) using coherent states in the presence of quadrature excess noise. We consider an eavesdropping attack which uses a linear amplifier and beam splitter. This attack makes a link between beam-splitting attack and intercept-resend attack (classical teleportation attack). We also show how postselection loses its efficiency in a realistic channel.
We discuss a quantum key distribution scheme in which small phase and amplitude modulations of CW light beams carry the key information. The presence of EPR type correlations provides the quantum protection. We identify universal constraints on the level of shared information between the intended receiver (Bob) and any eavesdropper (Eve) and use this to make a general evaluation of security. We identify teleportation as an optimum eavesdropping technique.
Recently, counterfactual quantum cryptography proposed by T. G. Noh [Phys. Rev. Lett. 103, 230501 (2009)] becomes an interesting direction in quantum cryptography, and has been realized by some researchers (such as Y. Liu et al's [Phys. Rev. Lett. 109, 030501 (2012)]). However, we find out that it is insecure in practical high lossy channel setting. We analyze the secret key rates in lossy channel under a polarization-splitting-measurement attack. Analysis indicates that the protocol is insecure when the loss rate of the one-way channel exceeds $50%$.
Methods of quantum mechanics promise information-theoretic security for various protocols in cryptography. However, impossibility of some cryptographic applications such as standard bit commitment, oblivious transfer, multiparty secure computations and ideal coin tossing in quantum regime leaves an obvious question on the completeness of quantum cryptography. Instead of using wide range of rules and techniques for a variety of cryptographic applications, we demonstrate here a unified structure for quantum cryptography based on quantum non-local correlations. The unified framework achieves same…
In this paper we investigate the security of a quantum cryptographic scheme which utilizes balanced homodyne detection and weak coherent pulse (WCP). The performance of the system is mainly characterized by the intensity of the WCP and postselected threshold. Two of the simplest intercept/resend eavesdropping attacks are analyzed. The secure key gain for a given loss is also discussed in terms of the pulse intensity and threshold.
We present two new definitions of security for quantum ciphers which are inspired by the definition of entropic security and entropic indistinguishability defined by Dodis and Smith. We prove the equivalence of these two new definitions. We also propose a generalization of a cipher described by Dodis and Smith and show that it can actually encrypt n qubits using less than n bits of key under reasonable conditions and yet be secure in an information theoretic setting. This cipher also totally closes the gap between the key requirement of quantum ciphers and classical ciphers.
It is well known that Shor's quantum algorithm for integer factorization can break down the RSA public-key cryptosystem, which is widely used in many cryptographic applications. Thus, public-key cryptosystems in the quantum computational setting are longed for cryptology. In order to define the security notions of public-key cryptosystems, we have to model the power of the sender, receiver, adversary and channel. While we may consider a setting where quantum computers are available only to adversaries, we generally discuss what are the right security notions for (quantum) public-key cryptosyst…
Strong attacks against quantum key distribution use quantum memories and quantum gates to attack directly the final key. In this paper we extend a novel security result recently obtained, to demonstrate proofs of security against a wide class of such attacks. To reach this goal we calculate information-dependent reduced density matrices, we study the geometry of quantum mixed states, and we find bounds on the information leaked to an eavesdropper. Our result suggests that quantum cryptography is ultimately secure.
We give a proof that entanglement purification, even with noisy apparatus, is sufficient to disentangle an eavesdropper (Eve) from the communication channel. In the security regime, the purification process factorises the overall initial state into a tensor-product state of Alice and Bob, on one side, and Eve on the other side, thus establishing a completely private, albeit noisy, quantum communication channel between Alice and Bob. The security regime is found to coincide for all practical purposes with the purification regime of a two-way recurrence protocol. This makes two-way entanglement …
Quantum cryptography uses techniques and ideas from physics and computer science. The combination of these ideas makes the security proofs of quantum cryptography a complicated task. To prove that a quantum-cryptography protocol is secure, assumptions are made about the protocol and its devices. If these assumptions are not justified in an implementation then an eavesdropper may break the security of the protocol. Therefore, security is crucially dependent on which assumptions are made and how justified the assumptions are in an implementation of the protocol. This thesis is primarily a review…
Counterfactual quantum cryptography (CQC), recently proposed by Noh, is featured with no transmission of signal particles. This exhibits evident security advantage, such as its immunity to the well known PNS attack. In this paper, the theoretical security of CQC protocol against the general intercept-resend attacks is proved by bounding the information of an eavesdropper Eve more tightly than in Yin's proposal[Phys. Rev. A 82, 042335 (2010)]. It is also showed that practical CQC implementations may be vulnerable when equipped with imperfect apparatuses, by proving that a negative key rate can …
Recently, we have shown the advantages of two-way quantum communications in continuous variable quantum cryptography. Thanks to this new approach, two honest users can achieve a non-trivial security enhancement as long as the Gaussian interactions of an eavesdropper are independent and identical. In this work, we consider asymmetric strategies where the Gaussian interactions can be different and classically correlated. For several attacks of this kind, we prove that the enhancement of security still holds when the two-way protocols are used in direct reconciliation.
We analyze the security of quantum cryptography schemes for $d$-level systems using 2 or $d+1$ maximally conjugated bases, under individual eavesdropping attacks based on cloning machines and measurement after the basis reconciliation. We consider classical advantage distillation protocols, that allow to extract a key even in situations where the mutual information between the honest parties is smaller than the eavesdropper's information. In this scenario, advantage distillation protocols are shown to be as powerful as quantum distillation: key distillation is possible using classical techniqu…
We present the optimal collective attack on a Quantum Key Distribution (QKD) protocol in the "device-independent" security scenario, where no assumptions are made about the way the QKD devices work or on what quantum system they operate. Our main result is a tight bound on the Holevo information between one of the authorized parties and the eavesdropper, as a function of the amount of violation of a Bell-type inequality.
The problem of unconditional security of quantum cryptography (i.e. the security which is guaranteed by the fundamental laws of nature rather than by technical limitations) is one of the central points in quantum information theory. We propose a relativistic quantum cryptosystem and prove its unconditional security against any eavesdropping attempts. Relativistic causality arguments allow to demonstrate the security of the system in a simple way. Since the proposed protocol does not employ collective measurements and quantum codes, the cryptosystem can be experimentally realized with the prese…
We derive a bound for the security of QKD with finite resources under one-way post-processing, based on a definition of security that is composable and has an operational meaning. While our proof relies on the assumption of collective attacks, unconditional security follows immediately for standard protocols like Bennett-Brassard 1984 and six-states. For single-qubit implementations of such protocols, we find that the secret key rate becomes positive when at least N\sim 10^5 signals are exchanged and processed. For any other discrete-variable protocol, unconditional security can be obtained us…
Recently, a "counterfactual" quantum key distribution scheme was proposed by Tae-Gon Noh [1]. In this scheme, two legitimate distant peers may share secret keys even when the information carriers are not traveled in the quantum channel. We find that this protocol is equivalent to an entanglement distillation protocol (EDP). According to this equivalence, a strict security proof and the asymptotic key bit rate are both obtained when perfect single photon source is applied and Trojan-horse attack can be detected. We also find that the security of this scheme is deeply related with not only the b…
The one-way Faraday-Michelson system is a very useful practical quantum cryptography system where Faraday mirrors(FMs) play an important role. In this paper we analyze the security of this system against imperfect FMs. We consider the security loophole caused by the imperfect FMs in Alice's and Bob's security zones. Then we implement a passive Faraday mirror attack in this system. By changing the values of the imperfection parameters of Alice's FMs, we calculate the quantum bit error rate between Alice and Bob induced by Eve and the probability that Eve obtains outcomes successfully. It is sho…
We study the security of two-way quantum cryptography at different wavelengths of the electromagnetic spectrum, from the optical range down to the microwave range. In particular, we consider a two-way quantum communication protocol where Gaussian-modulated thermal states are subject to random Gaussian displacements and finally homodyned. We show how its security threshold (in reverse reconciliation) is extremely robust with respect to the preparation noise and able to outperform the security thresholds of one-way protocols at any wavelength. As a result, improved security distances are now acc…
The Differential-Phase-Shift (DPS) and the Coherent-One-Way (COW) are among the most practical protocols for quantum cryptography, and are therefore the object of fast-paced experimental developments. The assessment of their security is also a challenge for theorists: the existing tools, that allow to prove security against the most general attacks, do not apply to these two protocols in any straightforward way. We present new upper bounds for their security in the limit of large distances ($d \gtrsim 50$km with typical values in optical fibers) by considering a large class of collective attac…
The use of quantum bits (qubits) in cryptography holds the promise of secure cryptographic quantum key distribution schemes. Unfortunately, the implemented schemes can be totally insecure. We provide a thorough investigation of security issues for practical quantum key distribution, taking into account channel losses, a realistic detection process, and modifications of the ``qubits'' sent from the sender to the receiver. We first show that even quantum key distribution with perfect qubits cannot be achieved over long distances when fixed channel losses and fixed dark count errors are taken int…
We prove that the teleportation based quantum cryptography protocol presented in [Opt. Commun. 283, 184 (2010)], which is built using only orthogonal states encoding the classical bits that are teleported from Alice to Bob, is asymptotically secure against all types of individual and collective attacks. We then investigate modifications to that protocol leading to greater secret-key rates and to security against coherent attacks. In other words, we show an unconditional secure quantum key distribution protocol that does not need non-orthogonal quantum states to encode the bits of the secret ke…
We study the impact of finite-size effects on the security of thermal one-way quantum cryptography. Our approach considers coherent/squeezed states at the preparation stage, on the top of which the sender adds trusted thermal noise. We compute the key rate incorporating finite-size effects, and we obtain the security threshold at different frequencies. As expected finite-size effects deteriorate the performance of thermal quantum cryptography. Our analysis is useful to quantify the impact of this degradation on relevant parameters like tolerable attenuation, transmission frequencies at which o…
A simple proof of the unconditional security of a relativistic quantum cryptosystem based on orthogonal states is proposed. Restrictions imposed by special relativity allow to substantially simplify the proof compared with the non-relativistic cryptosystems involving non-orthogonal states. Important for the proposed protocol is the spatio-temporal structure of the quantum states which is actually ignored in the non-relativistic protocols employing only the structure of the state space of the information carriers. As a consequence, the simplification arises because of the inefficiency of collec…
Quantum communication has demonstrated its usefulness for quantum cryptography far beyond quantum key distribution. One domain is two-party cryptography, whose goal is to allow two parties who may not trust each other to solve joint tasks. Another interesting application is position-based cryptography whose goal is to use the geographical location of an entity as its only identifying credential. Unfortunately, security of these protocols is not possible against an all powerful adversary. However, if we impose some realistic physical constraints on the adversary, there exist protocols for which…
The unconditional security of a quantum key distribution protocol is often defined in terms of the accessible information, that is, the maximum mutual information between the distributed key S and the outcome of an optimal measurement on the adversary's (quantum) system. We show that, even if this quantity is small, certain parts of the key S might still be completely insecure when S is used in applications, such as for one-time pad encryption. This flaw is due to a locking property of the accessible information: one additional (physical) bit of information might increase the accessible inform…
Privacy amplification is the key step to guarantee the security of quantum communication. The existing security proofs require accumulating a large number of raw key bits for privacy amplification. This is similar to block ciphers in classical cryptography that would delay the final key generation since an entire block must be accumulated before privacy amplification. Moreover, any leftover errors after information reconciliation would corrupt the entire block. By modifying the security proof based on quantum error correction, we develop a stream privacy amplification scheme, which resembles t…
We consider the security of continuous-variable quantum cryptography as we approach the classical-limit, i.e., when the unknown preparation noise at the sender's station becomes significantly noisy or thermal (even by as much as 10,000 times the variance of the vacuum mode). We show that, provided the channel transmission losses do not exceed 50%, the security of quantum cryptography is not dependent on the channel transmission, and is therefore, incredibly robust against significant amounts of excess preparation noise. We extend these results to consider for the first time quantum cryptograph…
The security of source has become an increasingly important issue in quantum cryptography. Based on the framework of measurement-device-independent quantum-key-distribution (MDI-QKD), the source becomes the only region exploitable by a potential eavesdropper (Eve). Phase randomization is a cornerstone assumption in most discrete-variable (DV-) quantum communication protocols (e.g., QKD, quantum coin tossing, weak coherent state blind quantum computing, and so on), and the violation of such an assumption is thus fatal to the security of those protocols. In this paper, we show a simple quantum h…
A practical quantum key distribution (QKD) protocol necessarily runs in finite time and, hence, only a finite amount of communication is exchanged. This is in contrast to most of the standard results on the security of QKD, which only hold in the limit where the number of transmitted signals approaches infinity. Here, we analyze the security of QKD under the realistic assumption that the amount of communication is finite. At the level of the general formalism, we present new results that help simplifying the actual implementation of QKD protocols: in particular, we show that symmetrization ste…
Quantum cryptography is information-theoretically secure owing to its solid basis in quantum mechanics. However, generally, initial implementations with practical imperfections might open loopholes, allowing an eavesdropper to compromise the security of a quantum cryptographic system. This has been shown to happen for quantum key distribution (QKD). Here we apply experience from implementation security of QKD to several other quantum cryptographic primitives. We survey quantum digital signatures, quantum secret sharing, source-independent quantum random number generation, quantum secure direct…
We derive complementarity relations for arbitrary quantum states of multiparty systems, of arbitrary number of parties and dimensions, between the purity of a part of the system and several correlation quantities, including entanglement and other quantum correlations as well as classical and total correlations, of that part with the remainder of the system. We subsequently use such a complementarity relation, between purity and quantum mutual information in the tripartite scenario, to provide a bound on the secret key rate for individual attacks on a quantum key distribution protocol.
In this article we deal with the security of the BB84 quantum cryptography protocol over noisy channels using generalized privacy amplification. For this we estimate the fraction of bits needed to be discarded during the privacy amplification step. This estimate is given for two scenarios, both of which assume the eavesdropper to access each of the signals independently and take error correction into account. One scenario does not allow a delay of the eavesdropper's measurement of a measurement probe until he receives additional classical information. In this scenario we achieve a sharp bound.…
We consider quantum cryptographic schemes where the carriers of information are 3-state particles. One protocol uses four mutually unbiased bases and appears to provide better security than obtainable with 2-state carriers. Another possible method allows quantum states to belong to more than one basis. The security is not better, but many curious features arise.
Basic techniques to prove the unconditional security of quantum cryptography are described. They are applied to a quantum key distribution protocol proposed by Bennett and Brassard in 1984. The proof considers a practical variation on the protocol in which the channel is noisy and photons may be lost during the transmission. The initial coding into the channel must be perfect (i.e., exactly as described in the protocol). No restriction is imposed on the detector used at the receiving side of the channel, except that whether or not the received system is detected must be independent of the basi…
Despite enormous progress both in theoretical and experimental quantum cryptography, the security of most current implementations of quantum key distribution is still not established rigorously. One of the main problems is that the security of the final key is highly dependent on the number, M, of signals exchanged between the legitimate parties. While, in any practical implementation, M is limited by the available resources, existing security proofs are often only valid asymptotically for unrealistically large values of M. Here, we demonstrate that this gap between theory and practice can be …
Quantum cryptography is the only approach to privacy ever proposed that allows two parties (who do not share a long secret key ahead of time) to communicate with provably perfect secrecy under the nose of an eavesdropper endowed with unlimited computational power and whose technology is limited by nothing but the fundamental laws of nature. This essay provides a personal historical perspective on the field. For the sake of liveliness, the style is purposely that of a spontaneous after-dinner speech.
We investigate the security against collective attacks of a continuous variable quantum key distribution scheme in the asymptotic key limit for a realistic setting. The quantum channel connecting the two honest parties is assumed to be lossy and imposes Gaussian noise on the observed quadrature distributions. Secret key rates are given for direct and reverse reconciliation schemes including postselection in the collective attack scenario. The effect of a non-ideal error correction and two-way communication in the classical post-processing step is also taken into account.
We examine security of a protocol on cryptographic key distribution via classical noise proposed by Yuen and Kim (Phys. Lett. A 241 135 (1998)). Theoretical and experimental analysis in terms of the secure key distribution rate shows that secure key distribution is possible even if the eavesdropper could receive more photons than the legitimate receiver, as long as the signal-to-noise-ratio (SNR) of the receiver is better than -9dB of the eavesdropper's SNR. Secure key distribution was demonstrated at the maximum rate of 0.04 bit per sender's bit and transmission rate of 2 Mb/s in the experime…
It is often claimed that the security of quantum key distribution (QKD) is guaranteed by the laws of physics. However, this claim is content-free if the underlying theoretical definition of QKD is not actually compatible with the laws of physics. This paper observes that (1) the laws of physics pose serious obstacles to the security of QKD and (2) the same laws are ignored in all QKD "security proofs".
We study cryptography based on operator theory, and propose quantum no-key (QNK) protocols from the perspective of operator theory, then present a framework of QNK protocols. The framework is expressed in two forms: trace-preserving quantum operators and natural presentations. Then we defined the information-theoretical security of QNK protocols and the security of identification keys. Two kinds of QNK protocols are also proposed. The first scheme is constructed based on unitary transformation, and the other is constructed based on two multiplicative commutative sets.
We provide a simple description of the most general collective Gaussian attack in continuous-variable quantum cryptography. In the scenario of such general attacks, we analyze the asymptotic secret-key rates which are achievable with coherent states, joint measurements of the quadratures and one-way classical communication.
In continuous-variable quantum information processing detectors are necessarily coarse grained and of finite range. We discuss how especially the latter feature is a bug and may easily lead to overoptimistic estimates of entanglement and of security, when missed data outside the detector range are ignored. We show that entropic separability or security criteria are much superior to variance-based criteria for mitigating the negative effects of this bug.
The laws of physics play a crucial role in the security of quantum key distribution (QKD). This fact has often been misunderstood as if the security of QKD would be based only on the laws of physics. As the experts know well, things are more subtle. We review the progresses in practical QKD focusing on (I) the elements of trust that are common to classical and quantum implementations of key distribution; and (II) some threats to security that have been highlighted recently, none of which is unredeemable (i.e., in principle QKD can be made secure). This leads us to guess that the field, similar…
We present the fundamental principles behind quantum key distribution and discuss a few well-known QKD protocols. Bearing in mind that the majority of our readers are from engineering and experimental optics, we focus more on the experimental implementation of various QKD protocols rather than security analysis. Another important topic that is covered here is the study of the security of practical QKD systems.
The communication protocol of Home and Whitaker [Phys. Rev. A 67, 022306 (2003)] is examined in some detail, and found to work equally well using a separable state. The protocol is in fact completely classical, based on simple post-selection of suitable experimental runs. The quantum cryptography protocol proposed in the same publication is also examined, and is found to indeed need quantum properties for the system to be secure. However, the security test proposed in the mentioned paper is found to be insufficient, and a modification is proposed here that will ensure security.
In this article I present a protocol for quantum cryptography which is secure against attacks on individual signals. It is based on the Bennett-Brassard protocol of 1984 (BB84). The security proof is complete as far as the use of single photons as signal states is concerned. Emphasis is given to the practicability of the resulting protocol. For each run of the quantum key distribution the security statement gives the probability of a successful key generation and the probability for an eavesdropper's knowledge, measured as change in Shannon entropy, to be below a specified maximal value.
In this thesis we explore the benefits of relativistic constraints for cryptography. We first revisit non-communicating models and its applications in the context of interactive proofs and cryptography. We propose bit commitment protocols whose security hinges on communication constraints and investigate its limitations. We explain how some non-communicating models can be justified by special relativity and study the limitations of such models. In particular, we present a framework for analysing security of multiround relativistic protocols. The second part of the thesis is dedicated to analys…
Existing quantum cryptographic schemes are not, as they stand, operable in the presence of noise on the quantum communication channel. Although they become operable if they are supplemented by classical privacy-amplification techniques, the resulting schemes are difficult to analyse and have not been proved secure. We introduce the concept of quantum privacy amplification and a cryptographic scheme incorporating it which is provably secure over a noisy channel. The scheme uses an `entanglement purification' procedure which, because it requires only a few quantum Controlled-Not and single-qubit…
In quantum cryptography, the level of security attainable by a protocol which implements a particular task $N$ times bears no simple relation to the level of security attainable by a protocol implementing the task once. Useful partial security, and even near-perfect security in an appropriate sense, can be obtained for $N$ copies of a task which itself cannot be securely implemented. We illustrate this with protocols for quantum bit string commitment and quantum random number generation between mistrustful parties.
The goal of two-party cryptography is to enable two parties, Alice and Bob, to solve common tasks without the need for mutual trust. Examples of such tasks are private access to a database, and secure identification. Quantum communication enables security for all of these problems in the noisy-storage model by sending more signals than the adversary can store in a certain time frame. Here, we initiate the study of device-independent protocols for two-party cryptography in the noisy-storage model. Specifically, we present a relatively easy to implement protocol for a cryptographic building bloc…
A semi-quantum key distribution (SQKD) protocol allows two users, one of whom is restricted in their quantum capabilities, to establish a shared secret key, secure against an all-powerful adversary. In this paper, we design a new SQKD protocol using high-dimensional quantum states and conduct an information theoretic security analysis. We show that, similar to the fully-quantum key distribution case, high-dimensional systems can increase the noise tolerance in the semi-quantum case. Along the way, we prove several general security results which are applicable to other SQKD protocols (both high…
The phenomenon of quantum erasure has long intrigued physicists, but has surprisingly found limited practical application. Here, we propose an erasure-based protocol for quantum key distribution (QKD) that promises inherent security against detector attacks.
