We initiate the study of two-party cryptographic primitives with unconditional security, assuming that the adversary's quantum memory is of bounded size. We show that oblivious transfer and bit commitment can be implemented in this model using protocols where honest parties need no quantum memory, whereas an adversarial player needs quantum memory of size at least n/2 in order to break the protocol, where n is the number of qubits transmitted. This is in sharp contrast to the classical bounded-memory model, where we can only tolerate adversaries with memory of size quadratic in honest players' memory size. Our protocols are efficient, non-interactive and can be implemented using today's technology. On the technical side, a new entropic uncertainty relation involving min-entropy is established.
We show how to implement cryptographic primitives based on the realistic assumption that quantum storage of qubits is noisy. We thereby consider individual-storage attacks, i.e. the dishonest party attempts to store each incoming qubit separately. Our model is similar to the model of bounded-quantum storage, however, we consider an explicit noise model inspired by present-day technology. To illustrate the power of this new model, we show that a protocol for oblivious transfer (OT) is secure for any amount of quantum-storage noise, as long as honest players can perform perfect quantum operation…
This thesis initiates the study of cryptographic protocols in the bounded-quantum-storage model. On the practical side, simple protocols for Rabin Oblivious Transfer, 1-2 Oblivious Transfer and Bit Commitment are presented. No quantum memory is required for honest players, whereas the protocols can only be broken by an adversary controlling a large amount of quantum memory. The protocols are efficient, non-interactive and can be implemented with today's technology. On the theoretical side, new entropic uncertainty relations involving min-entropy are established and used to prove the security o…
It was shown in [WST08] that cryptographic primitives can be implemented based on the assumption that quantum storage of qubits is noisy. In this work we analyze a protocol for the universal task of oblivious transfer that can be implemented using quantum-key-distribution (QKD) hardware in the practical setting where honest participants are unable to perform noise-free operations. We derive trade-offs between the amount of storage noise, the amount of noise in the operations performed by the honest participants and the security of oblivious transfer which are greatly improved compared to the r…
Quantum cryptography integrating an optical quantum memory
Laboratoire Kastler Brossel, Sorbonne Université, CNRS, ENS-Université PSL, Collège de France（卡斯勒-布罗塞尔实验室，索邦大学，法国国家科学研究中心，巴黎高等师范学院-巴黎文理研究大学，法兰西公学院）；Welinq（韦尔林克）；ICFO - Institut de Ciencies Fotoniques, The Barcelona Institute of Science and Technology（光子科学研究所，巴塞罗那科学技术研究院）；University of Vienna, Faculty of Physics, Vienna Center for Quantum Science and Technology (VCQ)（维也纳大学物理学院，维也纳量子科学与技术中心）；Université de Paris, CNRS, IRIF（巴黎大学，法国国家科学研究中心，信息与随机研究所）；LIP6, CNRS, Sorbonne Université（LIP6实验室，法国国家科学研究中心，索邦大学）
Relativistic protocols have been proposed to overcome some impossibility results in classical and quantum cryptography. In such a setting, one takes the location of honest players into account, and uses the fact that information cannot travel faster than the speed of light to limit the abilities of dishonest agents. For example, various relativistic bit commitment protocols have been proposed. Although it has been shown that bit commitment is sufficient to construct oblivious transfer and thus multiparty computation, composing specific relativistic protocols in this way is known to be insecure…
It has been suggested that the ability of quantum mechanics to allow secure distribution of secret key together with its inability to allow bit commitment or communicate superluminally might be sufficient to imply the rest of quantum mechanics. I argue using a toy theory as a counterexample that this is not the case. I further discuss whether an additional axiom (key storage) brings back the quantum nature of the theory.
We demonstrate that the framework of bounded quantum reference frames has application to building quantum-public-key cryptographic protocols and proving their security. Thus, the framework we introduce can be seen as a public-key analogue of the framework of Bartlett et al. (Phys. Rev. A 70, 032307), where a private shared reference frame is shown to have cryptographic application. The protocol we present in this paper is an identification scheme, which, like a digital signature scheme, is a type of authentication scheme. We prove that our protocol is both reusable and secure under the honest-…
Secure two-party cryptography is possible if the adversary's quantum storage device suffers imperfections. For example, security can be achieved if the adversary can store strictly less then half of the qubits transmitted during the protocol. This special case is known as the bounded-storage model, and it has long been an open question whether security can still be achieved if the adversary's storage were any larger. Here, we answer this question positively and demonstrate a two-party protocol which is secure as long as the adversary cannot store even a small fraction of the transmitted pulses…
We present a simplified framework for proving sequential composability in the quantum setting. In particular, we give a new, simulation-based, definition for security in the bounded-quantum-storage model, and show that this definition allows for sequential composition of protocols. Damgard et al. (FOCS '05, CRYPTO '07) showed how to securely implement bit commitment and oblivious transfer in the bounded-quantum-storage model, where the adversary is only allowed to store a limited number of qubits. However, their security definitions did only apply to the standalone setting, and it was not clea…
We give an exponential separation between one-way quantum and classical communication protocols for a partial Boolean function (a variant of the Boolean Hidden Matching Problem of Bar-Yossef et al.) Earlier such an exponential separation was known only for a relational problem. The communication problem corresponds to a \emph{strong extractor} that fails against a small amount of \emph{quantum} information about its random source. Our proof uses the Fourier coefficients inequality of Kahn, Kalai, and Linial. We also give a number of applications of this separation. In particular, we show that …
Position-based quantum cryptography (PBQC) allows a party to use its geographical location as its only credential to implement various cryptographic protocols. Such a protocol may lead to important applications in practice. Although it has been shown that any PBQC protocol is breakable if the adversaries pre-share an arbitrarily large entangled state, the security of PBQC in the bounded-quantum-storage model is still an open question. In this paper, we study the performance of various PBQC protocols over a lossy channel under the assumption that no entanglement is pre-shared between adversarie…
An extractor is a function E that is used to extract randomness. Given an imperfect random source X and a uniform seed Y, the output E(X,Y) is close to uniform. We study properties of such functions in the presence of prior quantum information about X, with a particular focus on cryptographic applications. We prove that certain extractors are suitable for key expansion in the bounded storage model where the adversary has a limited amount of quantum memory. For extractors with one-bit output we show that the extracted bit is essentially equally secure as in the case where the adversary has clas…
Coherent control of collective spontaneous emission in an extended atomic ensemble resonantly interacting with single-photon wave packets is analyzed. A scheme for coherent manipulation of collective atomic states is developed such that superradiant states of the atomic system can be converted into subradiant ones and vice versa. Possible applications of such a scheme for optical quantum state storage and single-photon wave packet shaping are discussed. It is shown that also in the absence of inhomogeneous broadening of the resonant line, single-photon wave packets with arbitrary pulse shape m…
We give an exponential separation between one-way quantum and classical communication complexity for a Boolean function. Earlier such a separation was known only for a relation. A very similar result was obtained earlier but independently by Kerenidis and Raz [KR06]. Our version of the result gives an example in the bounded storage model of cryptography, where the key is secure if the adversary has a certain amount of classical storage, but is completely insecure if he has a similar amount of quantum storage.
Device-independent quantum cryptography allows security even if the devices used to execute the protocol are untrusted - whether this is due to unknown imperfections in the implementation, or because the adversary himself constructed them to subvert the security of the protocol. While device-independence has seen much attention in the domain of quantum key distribution, relatively little is known for general protocols. Here we introduce a new model for device-independence for two-party protocols and position verification in the noisy-storage model. For the first time, we show that such protoco…
In this work, we study position-based cryptography in the quantum setting. The aim is to use the geographical position of a party as its only credential. On the negative side, we show that if adversaries are allowed to share an arbitrarily large entangled quantum state, no secure position-verification is possible at all. We show a distributed protocol for computing any unitary operation on a state shared between the different users, using local operations and one round of classical communication. Using this surprising result, we break any position-verification scheme of a very general form. On…
Cryptography's importance in our everyday lives continues to grow in our increasingly digital world. Oblivious transfer (OT) has long been a fundamental and important cryptographic primitive since it is known that general two-party cryptographic tasks can be built from this basic building block. Here we show the experimental implementation of a 1-2 random oblivious transfer (ROT) protocol by performing measurements on polarization-entangled photon pairs in a modified entangled quantum key distribution system, followed by all of the necessary classical post-processing including one-way error co…
Fundamental primitives such as bit commitment and oblivious transfer serve as building blocks for many other two-party protocols. Hence, the secure implementation of such primitives are important in modern cryptography. In this work, we present a bit commitment protocol which is secure as long as the attacker's quantum memory device is imperfect. The latter assumption is known as the noisy-storage model. We experimentally executed this protocol by performing measurements on polarization-entangled photon pairs. Our work includes a full security analysis, accounting for all experimental error ra…
Institute of Quantum Technologies and Advanced Computing, KACST（KACST量子技术与先进计算研究所）；Department of Physics, College of Science, Imam Mohammad Ibn Saud Islamic University (IMSIU)（伊玛目穆罕默德·本·沙特伊斯兰大学理学院物理系）；Department of Physics, College of Science, King Khalid University（国王哈立德大学理学院物理系）；Institute for Quantum Science and Technology and Department of Physics, Shanghai University（上海大学量子科学与技术研究院及物理系）；Shanghai Key Laboratory of High Temperature Superconductors, Shanghai University（上海大学高温超导学重点实验室）；NCQOQI, KACST（KACST国家量子光学与量子信息研究中心）
We consider the problem of secure identification: user U proves to server S that he knows an agreed (possibly low-entropy) password w, while giving away as little information on w as possible, namely the adversary can exclude at most one possible password for each execution of the scheme. We propose a solution in the bounded-quantum-storage model, where U and S may exchange qubits, and a dishonest party is assumed to have limited quantum memory. No other restriction is posed upon the adversary. An improved version of the proposed identification scheme is also secure against a man-in-the-middle…
We consider the implementation of two-party cryptographic primitives based on the sole assumption that no large-scale reliable quantum storage is available to the cheating party. We construct novel protocols for oblivious transfer and bit commitment, and prove that realistic noise levels provide security even against the most general attack. Such unconditional results were previously only known in the so-called bounded-storage model which is a special case of our setting. Our protocols can be implemented with present-day hardware used for quantum key distribution. In particular, no quantum sto…
We consider a game in which two separate laboratories collaborate to prepare a quantum system and are then asked to guess the outcome of a measurement performed by a third party in a random basis on that system. Intuitively, by the uncertainty principle and the monogamy of entanglement, the probability that both players simultaneously succeed in guessing the outcome correctly is bounded. We are interested in the question of how the success probability scales when many such games are performed in parallel. We show that any strategy that maximizes the probability to win every game individually i…
Leonard Shelby, the protagonist of Memento, uses mementos in the form of tattoos and pictures to handle his amnesia. Similar to Leonard, contemporary quantum computers suffer from "quantum amnesia": the inability to store quantum registers for a long duration. Quantum computers can only retain classical "mementos" of quantum registers by measuring them before those vanish. Some quantum skeptics argue that this quantum amnesia is inherent. We point out that this variant of a skeptic world is roughly described by the quantum bounded storage model, and although it is a computational obstacle that…
Besides achieving secure communication between two spatially-separated parties, another important issue in modern cryptography is related to secure communication in time, i.e., the possibility to confidentially store information on a memory for later retrieval. Here we explore this possibility in the setting of quantum reading, which exploits quantum entanglement to efficiently read data from a memory whereas classical strategies (e.g., based on coherent states or their mixtures) cannot retrieve any information. From this point of view, the technique of quantum reading can provide a new form o…
Recent proposals and advances in quantum simulations, quantum cryptography and quantum communications substantially rely on quantum entanglement formation. Contrary to the conventional wisdom that dissipation destroys quantum coherence, coupling with a dissipative environment can also generate entanglement. We consider a system composed of two quantum dot qubits coupled with a common, damped surface plasmon mode; each quantum dot is also coupled to a separate photonic cavity mode. Cavity quantum electrodynamics calculations show that upon optical excitation by a femtosecond laser pulse, entang…
Large-scale quantum-correlated networks could transform technologies ranging from communications and cryptography to computation, metrology, and simulation of novel materials. Critical to achieving such quantum enhancements is distributing high-quality entanglement between distant nodes. This is made possible in the unavoidable presence of decoherence by entanglement distillation. However, current versions of this protocol are prohibitively costly in terms of resources. We introduce a new scheme for continuous-variable entanglement distillation that requires only linear temporal and constant p…
A robust and composable device-independent protocol for oblivious transfer using (fully) untrusted quantum devices in the bounded storage model
Centre for Quantum Technologies, Singapore（新加坡量子技术中心）；Département d’informatique et de recherche opérationnelle (DIRO), Université de Montréal（蒙特利尔大学计算机科学与运筹学系）；Department of Computer Science, National University of Singapore（新加坡国立大学计算机系）；MajuLab, UMI 3654, Singapore（新加坡MAJU实验室）；QUASAR and Department of Mathematics and Statistics, University of Ottawa（渥太华大学QUASAR及数学与统计系）
Photon-based quantum information processing promises new technologies including optical quantum computing, quantum cryptography, and distributed quantum networks. Polarization-encoded photons at telecommunication wavelengths provide a compelling platform for practical realization of these technologies. However, despite important success towards building elementary components compatible with this platform, including sources of entangled photons, efficient single photon detectors, and on-chip quantum circuits, a missing element has been atomic quantum memory that directly allows for reversible m…
Uncertainty relations lie at the very core of quantum mechanics, and form the cornerstone of essentially all quantum cryptographic applications. In particular, they play an important role in cryptographic protocols in the bounded-quantum-storage model, where proving the security of all existing protocols ultimately reduces to bounding such relations. Yet, very little is known about such uncertainty relations for more than two measurements. Here, we prove optimal entropic uncertainty relations for anti-commuting binary observables for the Shannon entropy, and nearly optimal relations for the co…
We ask whether there are fundamental limits on storing quantum information reliably in a bounded volume of space. To investigate this question, we study quantum error correcting codes specified by geometrically local commuting constraints on a 2D lattice of finite-dimensional quantum particles. For these 2D systems, we derive a tradeoff between the number of encoded qubits k, the distance of the code d, and the number of particles n. It is shown that kd^2=O(n) where the coefficient in O(n) depends only on the locality of the constraints and dimension of the Hilbert spaces describing individual…
We show that Trevisan's extractor and its variants \cite{T99,RRV99} are secure against bounded quantum storage adversaries. One instantiation gives the first such extractor to achieve an output length $Θ(K-b)$, where $K$ is the source's entropy and $b$ the adversary's storage, together with a poly-logarithmic seed length. Another instantiation achieves a logarithmic key length, with a slightly smaller output length $Θ((K-b)/K^γ)$ for any $γ>0$. In contrast, the previous best construction \cite{TS09} could only extract $(K/b)^{1/15}$ bits. Some of our constructions have the additional advantage…
Reversible or information-lossless circuits have applications in digital signal processing, communication, computer graphics and cryptography. They are also a fundamental requirement in the emerging field of quantum computation. We investigate the synthesis of reversible circuits that employ a minimum number of gates and contain no redundant input-output line-pairs (temporary storage channels). We prove constructively that every even permutation can be implemented without temporary storage using NOT, CNOT and TOFFOLI gates. We describe an algorithm for the synthesis of optimal circuits and stu…
We study the role of coherence in closed and open quantum batteries. We obtain upper bounds to the work performed or energy exchanged by both closed and open quantum batteries in terms of coherence. Specifically, we show that the energy storage can be bounded by the Hilbert-Schmidt coherence of the density matrix in the spectral basis of the unitary operator that encodes the evolution of the battery. We also show that an analogous bound can be obtained in terms of the battery's Hamiltonian coherence in the basis of the unitary operator by evaluating their commutator. We apply these bounds to a…
The family of hyperbolic surface codes is one of the rare families of quantum LDPC codes with non-zero rate and unbounded minimum distance. First, we introduce a family of hyperbolic color codes. This produces a new family of quantum LDPC codes with non-zero rate and with minimum distance logarithmic in the blocklength. Second, we study the tradeoff between the length n, the number of encoded qubits k and the distance d of surface codes and color codes. We prove that kd^2 is upper bounded by C(log k)^2n, where C is a constant that depends only on the row weight of the parity-check matrix. Our …
We present certain universal bounds on the capacity of quantum information storage and on the time scale of its retrieval for a generic quantum field theoretic system. The capacity, quantified by the microstate entropy, is bounded from above by the surface area of the object measured in units of a Goldstone decay constant. The Goldstone bosons are universally present due to the spontaneous breaking of Poincare and internal symmetries by the information-storing object. Applied to a black hole, the bound reproduces the Bekenstein-Hawking entropy. However, the relation goes beyond gravity. The mi…
