experimental bit string generation
DESCRIPTION
Experimental Bit String Generation. Serge Massar Université Libre de Bruxelles. Plan. Recall earlier work on quantum coin tossing Theory of quantum bit string generation (joint work with Jonathan Barrett, PRA69(2004)022322 and quant-ph0408120) - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/1.jpg)
Experimental Bit String Generation
Serge MassarUniversité Libre de Bruxelles
![Page 2: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/2.jpg)
Plan
• Recall earlier work on quantum coin tossing
• Theory of quantum bit string generation (joint work with Jonathan Barrett, PRA69(2004)022322 and quant-ph0408120)
• Experimental implementation of bit string generation (L.-Ph. Lamoureux, E. Brainis, D. Amans, J. Barrett, S. M., quant-ph/0408121)
![Page 3: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/3.jpg)
Coin Tossing (Blum)
• Two parties dont trust each other.They need to choose a random bit:– « Alice (in the USA) and Bob (in the EU) are
divorcing, they need to decide who keeps the children. They decide to toss a coin. »
Bit String Generation: Tossing many coins
![Page 4: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/4.jpg)
Applications of coin tossing
• Divorce cases
• Cryptographic primitive
• Are there any good applications?– ??Classically certified bit committement
secure against polynomial quantum attack (Kent03)??
![Page 5: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/5.jpg)
How to toss a coin?
• Trusted third party: YES• Classical communication alone: NO• Classical communication plus relativity:
OK. (But each party needs to be in multiple locations)
• Quantum Communication: yes, to some extent.
![Page 6: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/6.jpg)
• Weak coin tossing:– Alice knows the outcome Bob wants– Bob knows the outcome Alice wants
• Strong coin tossing:– Alice and Bob do not know the outcome the
other party wants.• We will be concerned with Strong coin
tossing
![Page 7: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/7.jpg)
Bit commitment implies
Coin Tossing
• Alice chooses a=0,1 at random• Alice commits a to Bob• Bob chooses b=0,1 at random• Bob tells Alice the value of b• Alice reveals the commitment• Coin c=a+b mod 2
![Page 8: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/8.jpg)
Quantum protocol based on imperfect bit commitment
• Alice chooses a=0,1 at random• Commitment:
– Alice sends |ψa> to Bob– <ψ0|ψ1>=cosθ
• Bob chooses b=0,1 at random. • Bob tells Alice the value of b• Alice reveals a• Bob checks:
– measures in basis |ψa>, space orthogonal to |ψa>– If outcome is |ψa>, coin c=a+b mod 2– If outcome orthogonal to |ψa>, Bob aborts
![Page 9: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/9.jpg)
• Wining means getting the outcome you want.• The protocol may abort. If the protocol aborts,
everybody looses
B
A
P
P
21)honest Alice wins,Bobdishonest (
21)honest Bob wins,Alicedishonest (
•Classical communication: either ЄA or ЄB = ½•There exists a quantum protocol with
ЄA = ЄB = ¼ (Ambainis)•For all quantum protocols,
Є> 1/√2 – ½ (Kitaev)
![Page 10: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/10.jpg)
Alice cheats• Alice does not choose a• Commitment:
– Alice sends |ψ>=N(|ψ0> + |ψ1>) to Bob– <ψ0|ψ1>=cosθ
• Bob chooses b=0,1 at random. • Bob tells Alice the value of b• Alice reveals a chosen so that b+a has the desired value• Bob checks:
– measures in basis |ψa>, space orthogonal to |ψa>– Alice hopes outcome is |ψa>, then:
• coin c=a+b mod 2• Alice wins
– If outcome orthogonal to |ψa>, Bob aborts
• It is easy for Alice to cheat if <ψ0|ψ1>=cosθ is SMALL
![Page 11: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/11.jpg)
Bob cheats• Alice chooses a=0,1 at random• Commitment:
– Alice sends |ψa> to Bob– <ψ0|ψ1>=cosθ
• Bob tries to learn whether a=0 or a=1: – He measures the state– He chooses b so that if his measurement outcome
was correct, he wins: b+a has the desired value• Bob tells Alice the value of b• Alice reveals a • Hopefully Bob has won (if his measurement outcome
gave the correct value of a)
• It is easy for Bob to cheat if cosθ is LARGE
![Page 12: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/12.jpg)
• One can choose an optimal value of <ψ0|ψ1>=cosθ=1/√2 so that neither Alice nor Bob can cheat too much.
Then 221 and B A
![Page 13: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/13.jpg)
Bit String Generation
• Alice and Bob want to generate a string of n bits c1, c2, … , cn– A. Kent (2003) noted that this should be
easier than tossing a single coin. Proposed a protocol based on the parties sharing many singlets. No security analysis.
![Page 14: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/14.jpg)
Present work
• Bit string generation based on n repetitions of above protocol for coin tossing.
• Detailed security analysis.
![Page 15: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/15.jpg)
1) Classical Protocol for bit string generation
• Best classical protocol we have found (optimal for some security criteria)– Alice chooses the value of half the bits– Bob chooses the value of the other half
• Thus if Alice is dishonest, Bob honest, half the bits are random, half are fixed.
![Page 16: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/16.jpg)
• For i=1 to n• Alice chooses ai=0,1 at random• Commitment:
– Alice sends |ψai> to Bob– <ψ0|ψ1>=cosθ
• Bob chooses bi=0,1 at random. • Bob tells Alice the value of bi .• Alice reveals the value of ai to Bob• Bob checks:
– measures in basis |ψai>, space orthogonal to |ψai>– If outcome orthogonal to |ψa>, Bob aborts
• Next i• If Bob has not aborted, ci=ai + bi mod 2
2) Quantum Protocol
![Page 17: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/17.jpg)
Cheating 1
• Cheating Bob:– He must measure the states received from
Alice immediately → Same security analysis than when tossing a single coin.
• Cheating Alice:– She can send an entangled state, measure
her state, then decide on the value of ai depending on the measurement outcome.
– She can correlate/entangle her strategy between rounds
![Page 18: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/18.jpg)
Cheating 2
• For fixed <ψ0|ψ1>=cosθ it is more and more difficult for Alice to cheat when n increases (since Bob carries out n measurements)→ One can decrease θ as n increases
• This makes it more and more difficult for Bob to cheat
• Optimal rate of decrease θ=n- α for some α→Good security both with respect to Alice and Bob
![Page 19: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/19.jpg)
Security Criteria:Average Bias
B
A
:honest Alice dishonest, Bob :honest Bob dishonest, Alice coin? that of bias theisWhat
string. in the randomat coin a Take
1/12-BA
BA
n and :protocolOur
1/2 :Classicaly
![Page 20: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/20.jpg)
Security Criteria:Entropy
o(n)2n:protocol classicalBest :Conjecture
and :Protocol Quantum
honest? Alice dishonest, is Bob if- honest? Bob dishonest, is Alice if- H of aluesmallest v theisWhat
)abort()abortnot |( abort)not () string protocol of outcome()(
A
8/7
B
BA
HH
nnHH
nPcHPHcPcP
![Page 21: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/21.jpg)
Security criteria:Min Entropy
entropymin goodget cannot one ie.1c somefor Hor Heither
protocols, quantum allFor :Conjecture2
Hor HEither :Classicaly
honest? isparty other thedishonest, isparty one when H of valueMinimum
)(logc is stringbit
y that theprobabilit maximum)(cfix
Bmin
Amin
Bmin
Amin
min
0max2min
0
0max
0
cn
n
cPH
cP
![Page 22: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/22.jpg)
Summary
2/??)(2/??4/1Classical????)1(Quantum
0Entropy-Min
0Entropy
2/10Bias Average
min
min
min
nHnonHcnHnnHnnHnH
•Open Questions:•Improve quantum results. (Can entanglement help?)•Obtain Kitaev type bounds for the different security criteria.•Prove classical conjecture.
![Page 23: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/23.jpg)
Experimental Bit String Generation
• Easier than tossing a single coin because some experimental imperfections (detector efficiency, detector dark counts) can be subtracted.– Experiment reported by Zeilinger et al (quant-
ph/0404027) but incomplete security analysis.– Our experiment: we did our best to prove
security against ALL attacks by a dishonest party.
![Page 24: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/24.jpg)
• Experimental imperfections:– Alice’s state preparation may be noisy– The communication line may be noisy– Bob’s measurement apparatus may be imperfect
• A dishonest party can controle everything outside the other party’s lab.
• Thus in the presence of imperfections, the guaranteed bounds on randomness will be worse
Alice’s Lab
Bob’sLab
Communication line
![Page 25: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/25.jpg)
• For i=1 to n• Alice chooses ai=0,1 at random• Commitment:
– Alice sends |ψai> to Bob– <ψ0|ψ1>=cosθ
• Bob chooses bi=0,1 at random. • Bob tells Alice the value of bi .• Alice reveals the value of ai to Bob• Bob checks:
– estimates fidelity of states sent by Alice:measures in basis |ψai>, space orthogonal to |ψai>
• Next i• If fidelity too small, Bob aborts• If fidelity sufficiently large,
Bob does not abort and ci=ai + bi mod 2
Quantum Protocol with imperfections
![Page 26: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/26.jpg)
• Important parameters:– Scalar product <ψ0|ψ1>=cosθ between states
prepared by Alice– Fidelity f of states as estimated by Bob.
• Bounds on εB , HB depend on θ only.
• Bounds on εA , HA depend on f and θ,
for instance:
• Thus choose good compromise between <ψ0|ψ1>=cosθ and fidelity f
)ln(sin1
sin21
22 nnOff
A
Security Analysis
![Page 27: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/27.jpg)
Implementation• |ψ0>=|+α> , |ψ1>=|-α> are
two coherent states(by changing the intensity |α|2, one changes the overlap <ψ0|ψ1>=exp[-2|α|2])
• Bob’s measurement:– displaces the states by D±α – Uses a single photon detector to
check that the state is the vacuum. – If the detector clicks, then Alice could be cheating
Notes: • Displacement is simply realised by an interferometer• No need to restrict Hilbert space to single photon subspace
x
p
|α>|-α>
x
p
|α>|0>=D-α|α>
![Page 28: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/28.jpg)
Experimental setup• All fiber optics• Telecommunication wavelenghts• Based on « plug an play » system for
quantum key distribution (N. Gisin)→suitable for long distance communication (our realisation: table top)
![Page 29: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/29.jpg)
• Security Complication:– Light pulses produced by Bob, then go to
Alice, then reflected back to Bob• Remark: upon attenuation, any state tends
towards a mixture of coherent states
Typically A=104
Attenuation A
Gaussian Noise 1/A
Arbitrary state
Mixture of coherent states(positive P function)
![Page 30: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/30.jpg)
• Security Solution: first measure intensity, then attenuate: this produces a mixture of coherent states of known intensity
A
Classical Detector
Mixture of coherent states of known intensity
Intensity known
![Page 31: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/31.jpg)
Experimental Results•Different choices of |α|, hence of <ψ0|ψ1>=exp[-2|α|2]•Curves assume a visibility v=97% (but it is sometimes worse)•Number of coins tossed n=104
All classical protocols haveεA + εB ≥0.5
All classical protocols have (HA + HB)/n ≤1(conjecture)
![Page 32: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/32.jpg)
Summary• Using quantum communication it is
possible to generate very random strings of bits in the absence of noise.
• In the presence of imperfections the randomness goes down. Nevertheless experimental demonstration of bit strings generation using quantum communication (bits are more random than can be achieved using classical communication, at least according to the average bias criterion).
![Page 33: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/33.jpg)
Outlook
• improve theoretical bounds,• Improve experiment:
– toss a single coin more random than possible using classical communication;
– long distance bit string generation
![Page 34: Experimental Bit String Generation](https://reader036.vdocument.in/reader036/viewer/2022070419/56815cb0550346895dcab01a/html5/thumbnails/34.jpg)
• Collaborators:– Jonathan Barrett– Louis-Philippe Lamoureux– Edouard Brainis– David Amans
• Funding and Support: – Université Libre de Bruxelles (ULB)– Fonds National de la Recherche Scientifique (FNRS)– Communauté Française de Belgique (ARC)– Gouvernement Fédéral Belge (PAI)– European Community (project RESQ)