Existing quantum cryptographic schemes are not, as they stand, operable in the presence of noise on the quantum communication channel. Although they become operable if they are supplemented by classical privacy-amplification techniques, the resulting schemes are difficult to analyse and have not been proved secure. We introduce the concept of quantum privacy amplification and a cryptographic scheme incorporating it which is provably secure over a noisy channel. The scheme uses an `entanglement purification' procedure which, because it requires only a few quantum Controlled-Not and single-qubit operations, could be implemented using technology that is currently being developed. The scheme allows an arbitrarily small bound to be placed on the information that any eavesdropper may extract from the encrypted message.
Privacy amplification is the key step to guarantee the security of quantum communication. The existing security proofs require accumulating a large number of raw key bits for privacy amplification. This is similar to block ciphers in classical cryptography that would delay the final key generation since an entire block must be accumulated before privacy amplification. Moreover, any leftover errors after information reconciliation would corrupt the entire block. By modifying the security proof based on quantum error correction, we develop a stream privacy amplification scheme, which resembles t…
We suggest that the randomness of the choices of measurement basis by Alice and Bob provides an additional important resource for quantum cryptography. As a specific application, we present a novel protocol for quantum key distribution (QKD) which enhances the BB84 scheme by encrypting the information sent over the classical channel during key sifting. We show that, in the limit of long keys, this process prevents an eavesdropper from reproducing the sifting process carried out by the legitimate users. The inability of the eavesdropper to sift the information gathered by tapping the quantum ch…
We provide a complete proof of the security of quantum cryptography against any eavesdropping attack including coherent measurements even in the presence of noise. Polarization-based cryptographic schemes are shown to be equivalent to EPR-based schemes. We also show that the performance of a noisy channel approaches that of a noiseless one as the error rate tends to zero. (i.e., the secrecy capacity $C_s (ε) \to C_s (0)$ as $ε\to 0$.) One implication of our results is that one can {\it double} the efficiency of a most well-known quantum cryptographic scheme proposed by Bennett and Brassard sim…
When the 4-state or the 6-state protocol of quantum cryptography is carried out on a noisy (i.e. realistic) quantum channel, then the raw key has to be processed to reduce the information of an adversary Eve down to an arbitrarily low value, providing Alice and Bob with a secret key. In principle, quantum algorithms as well as classical algorithms can be used for this processing. A natural question is: up to which error rate on the raw key is a secret-key agreement at all possible? Under the assumption of incoherent eavesdropping, we find that the quantum and classical limits are precisely the…
Noise causes severe difficulties in implementing quantum computing and quantum cryptography. Several schemes have been suggested to reduce this problem, mainly focusing on quantum computation. Motivated by quantum cryptography, we suggest a coding which uses $N$ quantum bits ($N=n^2$) to encode one quantum bit, and reduces the error exponentially with $n$. Our result suggests the possibility of distributing a secure key over very long distances, and maintaining quantum states for very long times. It also provides a new quantum privacy amplification against a strong adversary.
In this article we deal with the security of the BB84 quantum cryptography protocol over noisy channels using generalized privacy amplification. For this we estimate the fraction of bits needed to be discarded during the privacy amplification step. This estimate is given for two scenarios, both of which assume the eavesdropper to access each of the signals independently and take error correction into account. One scenario does not allow a delay of the eavesdropper's measurement of a measurement probe until he receives additional classical information. In this scenario we achieve a sharp bound.…
Quantum cryptography has attracted much recent attention due to its potential for providing secret communications that cannot be decrypted by any amount of computational effort. This is the first analysis of the secrecy of a practical implementation of the BB84 protocol that simultaneously takes into account and presents the {\it full} set of complete analytical expressions for effects due to the presence of pulses containing multiple photons in the attenuated output of the laser, the finite length of individual blocks of key material, losses due to error correction, privacy amplification, con…
We have improved the hardware and software of our autocompensating system for quantum key distribution by replacing bulk optical components at the end stations with fiber-optic equivalents and implementing software that synchronizes end-station activities, communicates basis choices, corrects errors and performs privacy amplification over a local area network. The all fiber-optic arrangement provides stable, efficient and high-contrast routing of the photons. The low bit error rate leads to high error correction efficiency and minimizes data sacrifice during privacy amplification. Characteriza…
We give a proof that entanglement purification, even with noisy apparatus, is sufficient to disentangle an eavesdropper (Eve) from the communication channel. In the security regime, the purification process factorises the overall initial state into a tensor-product state of Alice and Bob, on one side, and Eve on the other side, thus establishing a completely private, albeit noisy, quantum communication channel between Alice and Bob. The security regime is found to coincide for all practical purposes with the purification regime of a two-way recurrence protocol. This makes two-way entanglement …
It was shown in [WST08] that cryptographic primitives can be implemented based on the assumption that quantum storage of qubits is noisy. In this work we analyze a protocol for the universal task of oblivious transfer that can be implemented using quantum-key-distribution (QKD) hardware in the practical setting where honest participants are unable to perform noise-free operations. We derive trade-offs between the amount of storage noise, the amount of noise in the operations performed by the honest participants and the security of oblivious transfer which are greatly improved compared to the r…
Quantum-limited amplifiers increase the amplitude of quantum signals at the price of introducing additional noise. Quantum purification protocols operate in the reverse way, by reducing the noise while attenuating the signal. Here we investigate a scenario that interpolates between these two extremes. We search for the optimal physical process that generates $M$ approximate copies of pure and amplified coherent state, starting from $N$ copies of a noisy coherent state with Gaussian modulation. We prove that the optimal deterministic processes are always Gaussian, whereas non-Gaussianity powers…
[Shortened abstract:] This thesis investigates the importance of quantum memory in quantum cryptography, concentrating on quantum key distribution schemes. In the hands of an eavesdropper -- a quantum memory is a powerful tool, putting in question the security of quantum cryptography; Classical privacy amplification techniques, used to prove security against less powerful eavesdroppers, might not be effective when the eavesdropper can keep quantum states for a long time. In this work we suggest a possible direction for approaching this problem. We define strong attacks of this type, and show s…
Privacy amplification is the art of shrinking a partially secret string Z to a highly secret key S. We show that, even if an adversary holds quantum information about the initial string Z, the key S obtained by two-universal hashing is secure, according to a universally composable security definition. Additionally, we give an asymptotically optimal lower bound on the length of the extractable key S in terms of the adversary's (quantum) knowledge about Z. Our result has applications in quantum cryptography. In particular, it implies that many of the known quantum key distribution protocols are …
We show how to implement cryptographic primitives based on the realistic assumption that quantum storage of qubits is noisy. We thereby consider individual-storage attacks, i.e. the dishonest party attempts to store each incoming qubit separately. Our model is similar to the model of bounded-quantum storage, however, we consider an explicit noise model inspired by present-day technology. To illustrate the power of this new model, we show that a protocol for oblivious transfer (OT) is secure for any amount of quantum-storage noise, as long as honest players can perform perfect quantum operation…
All incoherent as well as 2- and 3-qubit coherent eavesdropping strategies on the 6 state protocol of quantum cryptography are classified. For a disturbance of 1/6, the optimal incoherent eavesdropping strategy reduces to the universal quantum cloning machine. Coherent eavesdropping cannot increase Eve's Shannon information, neither on the entire string of bits, nor on the set of bits received undisturbed by Bob. However, coherent eavesdropping can increase as well Eve's Renyi information as her probability of guessing correctly all bits. The case that Eve delays the measurement of her probe u…
A number of questions associated with practical implementations of quantum cryptography systems having to do with unconditional secrecy, computational loads and effective secrecy rates in the presence of perfect and imperfect sources are discussed. The different types of unconditional secrecy, and their relationship to general communications security, are discussed in the context of quantum cryptography. In order to actually carry out a quantum cryptography protocol it is necessary that sufficient computational resources be available to perform the various processing steps, such as sifting, er…
We consider the security of continuous-variable quantum cryptography as we approach the classical-limit, i.e., when the unknown preparation noise at the sender's station becomes significantly noisy or thermal (even by as much as 10,000 times the variance of the vacuum mode). We show that, provided the channel transmission losses do not exceed 50%, the security of quantum cryptography is not dependent on the channel transmission, and is therefore, incredibly robust against significant amounts of excess preparation noise. We extend these results to consider for the first time quantum cryptograph…
The goal of two-party cryptography is to enable two parties, Alice and Bob, to solve common tasks without the need for mutual trust. Examples of such tasks are private access to a database, and secure identification. Quantum communication enables security for all of these problems in the noisy-storage model by sending more signals than the adversary can store in a certain time frame. Here, we initiate the study of device-independent protocols for two-party cryptography in the noisy-storage model. Specifically, we present a relatively easy to implement protocol for a cryptographic building bloc…
We give an exponential separation between one-way quantum and classical communication protocols for a partial Boolean function (a variant of the Boolean Hidden Matching Problem of Bar-Yossef et al.) Earlier such an exponential separation was known only for a relational problem. The communication problem corresponds to a \emph{strong extractor} that fails against a small amount of \emph{quantum} information about its random source. Our proof uses the Fourier coefficients inequality of Kahn, Kalai, and Linial. We also give a number of applications of this separation. In particular, we show that …
The security of a cryptographic key that is generated by communication through a noisy quantum channel relies on the ability to distill a shorter secure key sequence from a longer insecure one. For an important class of protocols, which exploit tomographically complete measurements on entangled pairs of any dimension, we show that the noise threshold for classical advantage distillation is identical with the threshold for quantum entanglement distillation. As a consequence, the two distillation procedures are equivalent: neither offers a security advantage over the other.
A universal deterministic noiseless quantum amplifier has been shown to be impossible. However, probabilistic noiseless amplification of a certain set of states is physically permissible. Regarding quantum state amplification as quantum state transformation, we show that deterministic noiseless amplification of coherent states chosen from a proper set is possible. The relation between input coherent states and gain of amplification for deterministic noiseless amplification is thus derived. Besides, the potential applications of amplification of coherent states in quantum key distribution (QKD)…
Classical and quantum information theory are simply explained. To be more specific it is clarified why Shannon entropy is used as measure of classical information and after a brief review of quantum mechanics it is possible to demonstrate why the density matrix is the main tool of quantum information theory. Then von Neumann entropy is introduced and with its help a great difference between classical and quantum information theory is presented: quantum entanglement. Moreover an information theoretic interpretation of quantum measurement is discussed. Data compression, error correction and nois…
We give a security proof of quantum cryptography based entirely on entanglement purification. Our proof applies to all possible attacks (individual and coherent). It implies the security of cryptographic keys distributed with the help of entanglement-based quantum repeaters. We prove the security of the obtained quantum channel which may not only be used for quantum key distribution, but also for secure, albeit noisy, transmission of quantum information.
We present a continuous variable (CV) quantum key distribution (QKD) scheme based on the CV quantum teleportation of coherent states that yields a raw secret key made up of discrete variables for both Alice and Bob. This protocol preserves the efficient detection schemes of current CV technology (no single-photon detection techniques) and, at the same time, has efficient error correction and privacy amplification schemes due to the binary modulation of the key. We show that for a certain type of incoherent attack it is secure for almost any value of the transmittance of the optical line used b…
We extend the security proof for continuous variable quantum key distribution protocols using post selection to account for arbitrary eavesdropping attacks by employing the concept of an equivalent protocol where the post-selection is implemented as a series of quantum operations including a virtual distillation. We introduce a particular `Gaussian' post selection and demonstrate that the security can be calculated using only experimentally accessible quantities. Finally we explicitly evaluate the performance for the case of a noisy Gaussian channel in the limit of unbounded key length and fin…
The impossibility of perfectly copying (or cloning) an arbitrary quantum state is one of the basic rules governing the physics of quantum systems. The processes that perform the optimal approximate cloning have been found in many cases. These "quantum cloning machines" are important tools for studying a wide variety of tasks, e.g. state estimation and eavesdropping on quantum cryptography. This paper provides a comprehensive review of quantum cloning machines (both for discrete-dimensional and for continuous-variable quantum systems); in addition, it presents the role of cloning in quantum cry…
The security of a cryptographic key that is generated by communication through a noisy quantum channel relies on the ability to distill a shorter secure key sequence from a longer insecure one. We show that -- for protocols that use quantum channels of any dimension and completely characterize them by state tomography -- the noise threshold for classical advantage distillation is substantially lower than the threshold for quantum entanglement distillation because the eavesdropper can perform powerful coherent attacks. The earlier claims that the two noise thresholds are identical, which were b…
The optimal mean photon number (mu) for quantum cryptography is the average photon number per transmitted pulse that results in the highest delivery rate of distilled cryptographic key bits, given a specific system scenario and set of assumptions about Eve's capabilities. Although many experimental systems have employed a mean photon number (mu) of 0.1 in practice, several research teams have pointed out that this value is somewhat arbitrary. In fact, various optimal values for mu have been described in the literature. In this paper we offer a detailed analytic model for an experimental, fiber…
Reliable Entropy Estimation from Observed Statistics for Device-Independent Quantum Cryptography
Institute for Quantum Information, RWTH Aachen University（亚琛工业大学量子信息研究所）；Institut für Theoretische Physik, Leibniz Universität Hannover（汉诺威莱布尼茨大学理论物理研究所）
We show that optimal protocols for noisy channel coding of public or private information over either classical or quantum channels can be directly constructed from two more primitive information-theoretic tools: privacy amplification and information reconciliation, also known as data compression with side information. We do this in the one-shot scenario of structureless resources, and formulate our results in terms of the smooth min- and max-entropy. In the context of classical information theory, this shows that essentially all two-terminal protocols can be reduced to these two primitives, wh…
Basic techniques to prove the unconditional security of quantum cryptography are described. They are applied to a quantum key distribution protocol proposed by Bennett and Brassard in 1984. The proof considers a practical variation on the protocol in which the channel is noisy and photons may be lost during the transmission. The initial coding into the channel must be perfect (i.e., exactly as described in the protocol). No restriction is imposed on the detector used at the receiving side of the channel, except that whether or not the received system is detected must be independent of the basi…
Using quantum mechanics, secure direct communication between distant parties can be performed. Over a noisy quantum channel, quantum privacy amplification is a necessary step to ensure the security of the message. In this paper, we present a quantum privacy amplification scheme for quantum secure direct communication using single photons. The quantum privacy amplification procedure contains two control-not gates and a Hadamard gate. After the unitary gate operations, a measurement is performed and one photon is retained. The retained photon carries the state information of the discarded photon…
We study the stability under quantum noise effects of the quantum privacy amplification protocol for the purification of entanglement in quantum cryptography. We assume that the E91 protocol is used by two communicating parties (Alice and Bob) and that the eavesdropper Eve uses the isotropic Bužek-Hillery quantum copying machine to extract information. Entanglement purification is then operated by Alice and Bob by means of the quantum privacy amplification protocol and we present a systematic numerical study of the impact of all possible single-qubit noise channels on this protocol. We find th…
A general framework of quantum state amplification using the language of quantum state transformation is given systematically for the first time. The concept of amplification of quantum states is defined specifically and the amplification of a set of quantum states is formulated generally as the transformation of quantum states. Three different kinds of important quantum amplifications, i.e., deterministic noisy quantum amplification, probabilistic noiseless quantum amplification, and deterministic noiseless quantum amplification are identified and discussed. For deterministic quan- tum amplif…
The present thesis deals with various methods of quantum error correction. It is divided into two parts. In the first part, dynamical decoupling methods are considered which have the task of suppressing the influence of residual imperfections in a quantum memory. The suppression is achieved by altering the dynamics of an imperfect quantum memory with the help of a sequence of local unitary operations applied to the qudits. Whereas up to now the operations of such decoupling sequences have been constructed in a deterministic fashion, strategies are developed in this thesis which construct the o…
A set of schemes for secure quantum communication are analyzed under the influence of non-Markovian channels. By comparing with the corresponding Markovian cases, it is seen that the average fidelity in all these schemes can be maintained for relatively longer periods of time. The effects of non-Markovian noise on a number of facets of quantum cryptography, such as quantum secure direct communication, deterministic secure quantum communication and their controlled counterparts, quantum dialogue, quantum key distribution, quantum key agreement, etc., have been extensively investigated. Specific…
Speeding up the dynamics of a quantum system is of paramount importance for quantum technologies. However, in finite dimensions and without full knowledge of the details of the system, it is easily shown to be impossible. In contrast we show that continuous variable systems described by a certain class of quadratic Hamiltonians can be sped up without such detailed knowledge. We call the resultant procedure Hamiltonian amplification (HA). The HA method relies on the application of local squeezing operations allowing for amplifying even unknown or noisy couplings and frequencies by acting on ind…
We report free-space distribution of entangled photon pairs over a noisy ground atmosphere of 13km. It is shown that the desired entanglement can still survive after the two entangled photons have passed through the noisy ground atmosphere. This is confirmed by observing a space-like separated violation of Bell inequality of $2.45 \pm 0.09$. On this basis, we exploit the distributed entangled photon source to demonstrate the BB84 quantum cryptography scheme. The distribution distance of entangled photon pairs achieved in the experiment is for the first time well beyond the effective thickness …
In order to be practically useful, quantum cryptography must not only provide a guarantee of secrecy, but it must provide this guarantee with a useful, sufficiently large throughput value. The standard result of generalized privacy amplification yields an upper bound only on the average value of the mutual information available to an eavesdropper. Unfortunately this result by itself is inadequate for cryptographic applications. A naive application of the standard result leads one to incorrectly conclude that an acceptable upper bound on the mutual information has been achieved. It is the point…
Recently, Takeoka, Guha and Wilde have established a new (loose) upper bound on the secret key capacity of a pure-loss bosonic channel that is several times larger than an error-free BB84 QKD channel with same transmittance. This suggests that new QKD protocols may exist with higher secret key rates and effective ranges larger than the metro-area limits of BB84 QKD over optical fiber. In this paper we illustrate such a possibility with a new protocol called Amplified Quantum Key Distribution (AQKD), which will be compatible with the optical amplification typically encountered on inter-city fib…
Device-independent quantum cryptography allows security even if the devices used to execute the protocol are untrusted - whether this is due to unknown imperfections in the implementation, or because the adversary himself constructed them to subvert the security of the protocol. While device-independence has seen much attention in the domain of quantum key distribution, relatively little is known for general protocols. Here we introduce a new model for device-independence for two-party protocols and position verification in the noisy-storage model. For the first time, we show that such protoco…
The employ of a noiseless linear amplifier (NLA) has been proven as a useful tool for mitigating imperfections in quantum channels. Its analysis is usually conducted within specific frameworks, for which the set of input states for a given protocol is fixed. Here we obtain a more general description by showing that a noisy and lossy Gaussian channel followed by a NLA has a general description in terms of effective channels. This has the advantage of offering a simpler mathematical description, best suitable for mixed states, both Gaussian and non-Gaussian. We investigate the main properties of…
Device-Independent (DI) security is the best form of quantum cryptography, providing information-theoretic security based on the very laws of nature. In its highest form, security is guaranteed against adversaries limited only by the no-superluminal signalling rule of relativity. The task of randomness amplification, to generate secure fully uniform bits starting from weakly random seeds, is of both cryptographic and foundational interest, being important for the generation of cryptographically secure random numbers as well as bringing deep connections to the existence of free-will. DI no-sign…
Cryptography's importance in our everyday lives continues to grow in our increasingly digital world. Oblivious transfer (OT) has long been a fundamental and important cryptographic primitive since it is known that general two-party cryptographic tasks can be built from this basic building block. Here we show the experimental implementation of a 1-2 random oblivious transfer (ROT) protocol by performing measurements on polarization-entangled photon pairs in a modified entangled quantum key distribution system, followed by all of the necessary classical post-processing including one-way error co…
Quantum cryptography was proposed as a counter to the capacity of quantum computers to break classical cryptosystems. A broad subclass of quantum cryptography, called quantum key distribution (QKD), relies on quantum mechanical process for secure distribution of the keys. Quantum channels are inherently noisy, and therefore these protocols will be susceptible to noise as well. In this paper, we study the performance of two QKD protocols - BB84 and E91 under thermal relaxation error. We show that while E91 protocol loses its security immediately due to loss of entanglement, the performance of B…
Privacy amplification (PA) is an indispensable component in classical and quantum cryptography. Error correction (EC) and data compression (DC) algorithms are also indispensable in classical and quantum information theory. We here study these three algorithms (PA, EC, and DC) in the presence of quantum side information, and show that they all become equivalent in the one-shot scenario. As an application of this equivalence, we take previously known security bounds of PA, and translate them into coding theorems for EC and DC which have not been obtained previously. Further, we apply these resul…
We report the first demonstration of quantum key distribution over a standard telecom fiber exceeding 100 km in length. Through careful optimisation of the interferometer and single photon detector, we achieve a quantum bit error ratio of 8.9% for a 122km link, allowing a secure shared key to be formed after error correction and privacy amplification. Key formation rates of up to 1.9 kbit/sec are achieved depending upon fiber length. We discuss the factors limiting the maximum fiber length in quantum cryptography.
