The discussion on the insecurity of even non-ideal protocols has been greatly extended. Other technical points are also clarified. Version accepted for publication in Phys. Rev. A
It had been widely claimed that quantum mechanics can protect private information during public decision in for example the so-called two-party secure computation. If this were the case, quantum smart-cards could prevent fake teller machines from learning the PIN (Personal Identification Number) from the customers' input. Although such optimism has been challenged by the recent surprising discovery of the insecurity of the so-called quantum bit commitment, the security of quantum two-party computation itself remains unaddressed. Here I answer this question directly by showing that all ``one-sided'' two-party computations (which allow only one of the two parties to learn the result) are necessarily insecure. As corollaries to my results, quantum one-way oblivious password identification and the so-called quantum one-out-of-two oblivious transfer are impossible. I also construct a class of functions that cannot be computed securely in any ``two-sided'' two-party computation. Nevertheless, quantum cryptography remains useful in key distribution and can still provide partial security in ``quantum money'' proposed by Wiesner.
A fundamental task in modern cryptography is the joint computation of a function which has two inputs, one from Alice and one from Bob, such that neither of the two can learn more about the other's input than what is implied by the value of the function. In this Letter, we show that any quantum protocol for the computation of a classical deterministic function that outputs the result to both parties (two-sided computation) and that is secure against a cheating Bob can be completely broken by a cheating Alice. Whereas it is known that quantum protocols for this task cannot be completely secure,…
The impossibility proof of unconditionally secure quantum bit commitment is crucially dependent on the assertion that Bob is not allowed to generate probability distributions unknown to Alice. This assertion is actually not meaningful, because Bob can always cheat without being detected. In this paper we prove that, for any concealing protocol involving secret probability distributions, there exists a cheating unitary transformation that is known to Alice. Our result closes a gap in the original impossibility proof.
Recently, position-based quantum cryptography has been claimed to be unconditionally secure. In contrary, here we show that the existing proposals for position-based quantum cryptography are, in fact, insecure if entanglement is shared among two adversaries. Specifically, we demonstrate how the adversaries can incorporate ideas of quantum teleportation and quantum secret sharing to compromise the security with certainty. The common flaw to all current protocols is that the Pauli operators always map a codeword to a codeword (up to an irrelevant overall phase). We propose a modified scheme lack…
In a recent paper (Phys. Rev. Lett. 109, 160501 (2012). arXiv:1201.0849), it is claimed that any quantum protocol for classical two-sided computation between Alice and Bob can be proven completely insecure for Alice if it is secure against Bob. Here we show that the proof is not sufficiently general, because the security definition it based on is only a sufficient condition but not a necessary condition.
In this report we discuss the insecurity with present implementations of the Ekert protocol for quantum-key distribution based on the Wigner Inequality. We propose a modified version of this inequality which guarantees safe quantum-key distribution.
We show that the criticism of a recent comment \cite{ch2} on the insecurity of a quantum secret sharing protocol proposed in \cite{v2} is based on a misconception about the meaning of security and hence is invalid. The same misconception also appears in another comment of the authors \cite{ch1} on the security of an entangled-based quantum key distribution protocol \cite{zhang,v1}.
We present attacks that show that unconditionally secure two-party classical computation is impossible for many classes of function. Our analysis applies to both quantum and relativistic protocols. We illustrate our results by showing the impossibility of oblivious transfer.
The oblivious transfer primitive is sufficient to implement secure multiparty computation. However, secure multiparty computation based only on classical cryptography is severely limited by the security and efficiency of the oblivious transfer implementation. We present a method to efficiently and securely generate and distribute oblivious keys by exchanging qubits and by performing commitments using classical hash functions. With the presented hybrid approach, quantum and classical, we obtain a practical and high-speed oblivious transfer protocol, secure even against quantum computer attacks.…
We construct the first constant-round protocols for secure quantum computation in the two-party (2PQC) and multi-party (MPQC) settings with security against malicious adversaries. Our protocols are in the common random string (CRS) model. - Assuming two-message oblivious transfer (OT), we obtain (i) three-message 2PQC, and (ii) five-round MPQC with only three rounds of online (input-dependent) communication; such OT is known from quantum-hard Learning with Errors (QLWE). - Assuming sub-exponential hardness of QLWE, we obtain (i) three-round 2PQC with two online rounds and (ii) four-round MPQC …
The Universal Composability model (UC) by Canetti (FOCS 2001) allows for secure composition of arbitrary protocols. We present a quantum version of the UC model which enjoys the same compositionality guarantees. We prove that in this model statistically secure oblivious transfer protocols can be constructed from commitments. Furthermore, we show that every statistically classically UC secure protocol is also statistically quantum UC secure. Such implications are not known for other quantum security definitions. As a corollary, we get that quantum UC secure protocols for general multi-party com…
The engineering challenges involved in building large scale quantum computers, and the associated infrastructure requirements, mean that when such devices become available it is likely that this will be in limited numbers and in limited geographic locations. It is likely that many users will need to rely on remote access to delegate their computation to the available hardware. In such a scenario, the privacy and reliability of the delegated computations are important concerns. On the other hand, the distributed nature of modern computations has led to a widespread class of applications in whic…
Quantum conference is a process of securely exchanging messages between three or more parties, using quantum resources. A Measurement Device Independent Quantum Dialogue (MDI-QD) protocol, which is secure against information leakage, has been proposed (Quantum Information Processing 16.12 (2017): 305) in 2017, is proven to be insecure against intercept-and-resend attack strategy. We first modify this protocol and generalize this MDI-QD to a three-party quantum conference and then to a multi-party quantum conference. We also propose a protocol for quantum multi-party XOR computation. None of th…
Since the negative result of Lo (Physical Review A, 1997), it has been left open whether there exist some functions that can be securely computed in two-party setting in quantum domain when one of the parties is malicious. In this paper, we for the first time, show that there are some functions for which secure two-party quantum computation is indeed possible for non-simultaneous channel model. This is in sharp contrast with the impossibility result of Ben -Or et al. (FOCS, 2006) in broadcast channel model. The functions we study are of two types - one is any function without an embedded XOR, …
The cryptographic task of secure multi-party (classical) computation has received a lot of attention in the last decades. Even in the extreme case where a computation is performed between $k$ mutually distrustful players, and security is required even for the single honest player if all other players are colluding adversaries, secure protocols are known. For quantum computation, on the other hand, protocols allowing arbitrary dishonest majority have only been proven for $k=2$. In this work, we generalize the approach taken by Dupuis, Nielsen and Salvail (CRYPTO 2012) in the two-party setting t…
Secure multi-party computation (SMPC) protocols allow several parties that distrust each other to collectively compute a function on their inputs. In this paper, we introduce a protocol that lifts classical SMPC to quantum SMPC in a composably and statistically secure way, even for a single honest party. Unlike previous quantum SMPC protocols, our proposal only requires very limited quantum resources from all but one party; it suffices that the weak parties, i.e. the clients, are able to prepare single-qubit states in the X-Y plane. The novel quantum SMPC protocol is constructed in a naturally…
We introduce a secure hardware device named a QEnclave that can secure the remote execution of quantum operations while only using classical controls. This device extends to quantum computing the classical concept of a secure enclave which isolates a computation from its environment to provide privacy and tamper-resistance. Remarkably, our QEnclave only performs single-qubit rotations, but can nevertheless be used to secure an arbitrary quantum computation even if the qubit source is controlled by an adversary. More precisely, attaching a QEnclave to a quantum computer, a remote client control…
Homomorphic encryption is a form of encryption which allows computation to be carried out on the encrypted data without the need for decryption. The success of quantum approaches to related tasks in a delegated computation setting has raised the question of whether quantum mechanics may be used to achieve information theoretically secure fully homomorphic encryption. Here we show, via an information localisation argument, that deterministic fully homomorphic encryption necessarily incurs exponential overhead if perfect security is required.
This paper studies secure multiparty quantum computation (SMQC) without nonlocal measurements. Firstly, this task is reduced to secure two-party quantum computation of nonlocal controlled-NOT (NL-CNOT) gate. Then, in the passive adversaries model, the secure computation of NL-CNOT is reduced to bit commitment. Thus, a SMQC scheme can be constructed based on bit commitment. This scheme does not depend on trusted third party, and is secure in the passive adversaries model. It is also pointed out that a vulnerability exists in any secure two-party quantum computation protocol of NL-CNOT gate.
I construct a secure multi-party scheme to compute a classical function by a succinct use of a specially designed fault-tolerant random polynomial quantum error correction code. This scheme is secure provided that (asymptotically) strictly greater than five-sixths of the players are honest. Moreover, the security of this scheme follows directly from the theory of quantum error correcting code, and hence is valid without any computational assumption. I also discuss the quantum-classical complexity-security tradeoff in secure multi-party computation schemes and argue why a full-blown quantum cod…
We introduce a scheme for secure multi-party computation utilising the quantum correlations of entangled states. First we present a scheme for two-party computation, exploiting the correlations of a Greenberger-Horne-Zeilinger state to provide, with the help of a third party, a near-private computation scheme. We then present a variation of this scheme which is passively secure with threshold t=2, in other words, remaining secure when pairs of players conspire together provided they faithfully follow the protocol. We show that this can be generalised to computations of n-party polynomials of d…
We propose a new composable and information-theoretically secure protocol to verify that a server has the power to sample from a sub-universal quantum machine implementing only commuting gates. By allowing the client to manipulate single qubits, we exploit properties of Measurement based Blind Quantum Computing to prove security against a malicious Server and therefore certify quantum supremacy without the need for a universal quantum computer.
This paper introduces quantum multiparty protocols which allow the use of temporary assumptions. We prove that secure quantum multiparty computations are possible if and only if classical multi party computations work. But these strict assumptions are necessary only during the execution of the protocol and can be loosened after termination of the protocol. We consider two settings: 1. A collusion of players tries to learn the secret inputs of honest players or tries to modify the result of the computation. 2. A collusion of players cheats in the above way or tries to disrupt the protocol, i.e.…
Secure multi-party computing, also called "secure function evaluation", has been extensively studied in classical cryptography. We consider the extension of this task to computation with quantum inputs and circuits. Our protocols are information-theoretically secure, i.e. no assumptions are made on the computational power of the adversary. For the weaker task of verifiable quantum secret sharing, we give a protocol which tolerates any t < n/4 cheating parties (out of n). This is shown to be optimal. We use this new tool to show how to perform any multi-party quantum computation as long as the …
Suppose Alice wants to perform some computation that could be done quickly on a quantum computer, but she cannot do universal quantum computation. Bob can do universal quantum computation and claims he is willing to help, but Alice wants to be sure that Bob cannot learn her input, the result of her calculation, or perhaps even the function she is trying to compute. We describe a simple, efficient protocol by which Bob can help Alice perform the computation, but there is no way for him to learn anything about it. We also discuss techniques for Alice to detect whether Bob is honestly helping her…
We consider the task of secure multi-party distributed quantum computation on a quantum network. We propose a protocol based on quantum error correction which reduces the number of necessary qubits. That is, each of the $n$ nodes in our protocol requires an operational workspace of $n^2+Θ(s) n$ qubits, as opposed to previously shown $Ω\big((n^3+n^2s^2)\log n\big)$ qubits, where $s$ is a security parameter. To achieve universal computation, we develop a distributed procedure for verifying magic states based on magic state distillation and statistical testing of randomly selected states. This al…
Semiquantum key distribution allows a quantum party to share a random key with a "classical" party who only can prepare and measure qubits in the computational basis or reorder some qubits when he has access to a quantum channel. In this work, we present a protocol where a secret key can be established between a quantum user and an almost classical user who only needs the quantum ability to access quantum channels, by securely delegating quantum computation to a quantum server. We show the proposed protocol is robust even when the delegated quantum server is a powerful adversary, and is experi…
To construct a quantum network with many end users, it is critical to have a cost-efficient way to distribute entanglement over different network ends. We demonstrate an entanglement access network, where the expensive resource, the entangled photon source at the telecom wavelength and the core communication channel, is shared by many end users. Using this cost-efficient entanglement access network, we report experimental demonstration of a secure multiparty computation protocol, the privacy-preserving secure sum problem, based on the network quantum cryptography.
Blind quantum computation (BQC) provides an efficient method for the client who does not have enough sophisticated technology and knowledge to perform universal quantum computation. The single-server BQC protocol requires the client to have some minimum quantum ability, while the double-server BQC protocol makes the client's device completely classical, resorting to the pure and clean Bell-state shared by two servers. In this paper, we provide a deterministic entanglement distillation protocol in a practical noisy environment for the double-server BQC protocol. This protocol can obtain the pur…
Extending the functionality and overcoming the performance limitation under which QKD can operate requires either quantum repeaters or new security models. Investigating the latter option, we introduce the \textit{Quantum Computational Hybrid} (QCH) security model, where we assume that computationally secure encryption may only be broken after time much longer than the coherence time of available quantum memories. We propose an explicit $d$-dimensional key distribution protocol, that we call MUB-\textit{Quantum Computational Timelock} (MUB-QCT) where one bit is encoded on a qudit state chosen …
Secret sharing and multiparty computation (also called "secure function evaluation") are fundamental primitives in modern cryptography, allowing a group of mutually distrustful players to perform correct, distributed computations under the sole assumption that some number of them will follow the protocol honestly. This paper investigates how much trust is necessary -- that is, how many players must remain honest -- in order for distributed quantum computations to be possible. We present a verifiable quantum secret sharing (VQSS) protocol, and a general secure multiparty quantum computation (MP…
We present a quantumly-enhanced protocol to achieve unconditionally secure delegated classical computation where the client and the server have both limited classical and quantum computing capacity. We prove the same task cannot be achieved using only classical protocols. This extends the work of Anders and Browne on the computational power of correlations to a security setting. Concretely, we present how a client with access to a non-universal classical gate such as a parity gate could achieve unconditionally secure delegated universal classical computation by exploiting minimal quantum gadge…
Blind quantum computation is a new secure quantum computing protocol where a client, who does not have enough quantum technologies at her disposal, can delegate her quantum computation to a server, who has a fully-fledged quantum computer, in such a way that the server cannot learn anything about client's input, output, and program. If the client interacts with only a single server, the client has to have some minimum quantum power, such as the ability of emitting randomly rotated single-qubit states or the ability of measuring states. If the client interacts with two servers who share Bell pa…
Research Laboratory of Electronics, Massachusetts Institute of Technology（麻省理工学院电子研究实验室）；Physics & Informatics Laboratories, NTT Research, Inc.（NTT研究公司物理与信息学实验室）
