quantum data locking (qdl): from theory to...

Overview of QDL Experimental Realization

Quantum Data Locking (QDL): From Theory toExperiment

Thomas E. Williams

Jaggiellonian University

January 21, 2019

Outline for today’s talk

1 Overview of QDLThe Big IdeaMore Specifically...Making it Practical

2 Experimental RealizationA Quantum Enigma MachineSome ResultsComplicating Matters

Thomas E. Williams Jagiellonian University

Quantum Data Locking

The Big Idea

Classically secure encryption

A fundamental result of Classical Information Theory (due toShannon) tells us that secure encryption against an adversarywith infinite computational ability (i.e. information theoreticsecurity) requires the single use of a random secret key atleast the length of the message being encrypted

However, this strict condition may be greatly relaxed if theinformation is encoded in a quantum system.

In particular, certain QDL protocols allow for security (undercertain assumptions) in the case of a key which isexponentially shorter than the message itself

The Big Idea

Basically...

The Big Idea

Basically...

The Big Idea

Mutual Information

Figure: Shannon Mutual Information Venn diagram

The Big Idea

Mutual Information

Figure: Shannon Mutual Information Venn diagram

The Big Idea

Security in QDL

Security in QDL follows by limiting Eve’s classical mutualinformation. I (X ,Y )

While Eve is allowed to have infinite computational ability, weneed to assume she has quantum memory with finite storagetime. (i.e. finite coherence time).

This assumption compensates for the underlying securitycriterion for QDL, accessible information, being in general notcomposable.

This makes it a generally weaker security criterion than thatused in, e.g. QKD. But it is this weakness which turns out tobe a strength for the quantum enigma machine, as well asallows for definition of a secret key generation protocol, therate of which approaches the classical capacity of the channel.

The Big Idea

Security in QDL

The Big Idea

Security in QDL

The Big Idea

Security in QDL

The Big Idea

Security in QDL

The Big Idea

QDL vs. QKD or QSDCs

Unlike Quantum Key Distribution (QKD) protocols (e.g.BB84 or E91), which focus on secure key generation andwhere security is achieved by detecting the presence of Eve,QDL requires a short preshared key and the additionalassumption that Eve has quantum memory with finite storagetime.QDL has many similarities with other Quantum Secure DirectCommunication protocols (QSDCs), however, in them,security is achieve either by detection of the Evesdropper orby strictly denying access to the (entire) correlated quantumstate. In most cases QSDC protocols require multipletransmitions of a single quantum state over the same channel(i.e. Alice to Bob and back again), or a priori sharing of acorrelated (e.g. entangled) quantum state.

The Big Idea

QDL vs. QKD or QSDCsUnlike Quantum Key Distribution (QKD) protocols (e.g.BB84 or E91), which focus on secure key generation andwhere security is achieved by detecting the presence of Eve,QDL requires a short preshared key and the additionalassumption that Eve has quantum memory with finite storagetime.

QDL has many similarities with other Quantum Secure DirectCommunication protocols (QSDCs), however, in them,security is achieve either by detection of the Evesdropper orby strictly denying access to the (entire) correlated quantumstate. In most cases QSDC protocols require multipletransmitions of a single quantum state over the same channel(i.e. Alice to Bob and back again), or a priori sharing of acorrelated (e.g. entangled) quantum state.

The Big Idea

QDL vs. QKD or QSDCsUnlike Quantum Key Distribution (QKD) protocols (e.g.BB84 or E91), which focus on secure key generation andwhere security is achieved by detecting the presence of Eve,QDL requires a short preshared key and the additionalassumption that Eve has quantum memory with finite storagetime.QDL has many similarities with other Quantum Secure DirectCommunication protocols (QSDCs), however, in them,security is achieve either by detection of the Evesdropper orby strictly denying access to the (entire) correlated quantumstate.

In most cases QSDC protocols require multipletransmitions of a single quantum state over the same channel(i.e. Alice to Bob and back again), or a priori sharing of acorrelated (e.g. entangled) quantum state.

The Big Idea

QDL vs. QKD or QSDCsUnlike Quantum Key Distribution (QKD) protocols (e.g.BB84 or E91), which focus on secure key generation andwhere security is achieved by detecting the presence of Eve,QDL requires a short preshared key and the additionalassumption that Eve has quantum memory with finite storagetime.QDL has many similarities with other Quantum Secure DirectCommunication protocols (QSDCs), however, in them,security is achieve either by detection of the Evesdropper orby strictly denying access to the (entire) correlated quantumstate. In most cases QSDC protocols require multipletransmitions of a single quantum state over the same channel(i.e. Alice to Bob and back again), or a priori sharing of acorrelated (e.g. entangled) quantum state.

More Specifically...

A typical QDL protocol

1 Alice and Bob decide on M possible messages to encode inton quantum states to be sent over n uses of a (possibly noisy)quantum channel. Each message will be l = logM bits long.

2 They privately agree on a k = logK bit key which specifiesone of the K lines in a public code book. Each line gives thesequence of n unitary transformations which Alice used toencode the message. (Note: this gives N = MK possibleenciphered states).

3 Alice transmits the encoded and scrambled quantum state.

4 Bob receives and applies the inverse unitary transformationsto unscramble the message.

Ideally speaking

If Eve knew which of the N states was sent, she could prepareK copies of the transmission and perform the inverse Kunitary transformations on each of them to determine themessage. But even cannot identify the original message fromthe set of N enciphered states from only n � Nmeasurements.

In the strongest QDL protocols to date, a key of constantlength, k = log 1

ε bits allows to encrypt an l bit message insuch a way that Eve cannot (assuming an optimalmeasurement) get more than εl bits of information about themessage.

Ideally speaking

Examples

Let Alice encrypt an l = 32 bit message with a key of lengthk = 3 bits. Then 3 = log2

1ε implies ε = 1

8 , and Eve is limitedto εl = 4 bits of useful information.

Let’s kick this up a notch! Let Alice encrypt an l = 128 bitmessage with a key of length k = 6 bits. Then 6 = log2

implies ε = 164 , and Eve is limited to εl = 2 bits of useful

information.

This seems to good to be true. And, spoiler alert! It is (sort of).We already mentioned the price we must pay (assuming Eve’squantum memory has a finite decoherence time), but tounderstand why this assumption is important, we need to take acloser look at...

Examples

1ε implies ε = 1

information.

Examples

1ε implies ε = 1

information.

Examples

1ε implies ε = 1

information.

Security Criteria

At the heart of QDL’s security is the entropic quantity...

Accessible Infromation (a.i.), which is defined as themaximum classical mutual information (c.m.i.) between themessage Alice is sending (X ) and an optimal measurementmade by Eve (Y ). Recall we said security would be achievedby limiting I (X ,Y ).

In turn, a.i. is used to define the...

Locking Capacity of a quantum channel to be the maximumrate at which information may be reliably and securely(security by a.i. criterion) transmitted.

Security Criteria

Accessible Infromation (a.i.), which is defined as themaximum classical mutual information (c.m.i.) between themessage Alice is sending (X ) and an optimal measurementmade by Eve (Y ).

Recall we said security would be achievedby limiting I (X ,Y ).

Security Criteria

Some Important BoundsIt all seems so simple. But now we hit a mathematical speedbump.Unfortunately, there is no known formula for calculating the a.i. .

Happily though, it is bounded by the well understood, goldstandard information theoretic quantity in quantum cryptography,the...

Holevo Information (H.i.), χ := S(ρ) − ΣipiS(ρi ) whereS(ρ) := −trρ log ρ is the von Nuemann entropy andρ = Σipiρi .

In particular,

Holevo Information ≥ Accessible Information

which implies

Holevo Capacity ≤ Locking Capacity ≤ classical capacity

Some Important BoundsIt all seems so simple. But now we hit a mathematical speedbump.Unfortunately, there is no known formula for calculating the a.i. .Happily though, it is bounded by the well understood, goldstandard information theoretic quantity in quantum cryptography,the...

In particular,

which implies

In particular,

which implies

In particular,

which implies

In particular,

which implies

.Thomas E. Williams Jagiellonian University

Holevo info vs. Accessible info

H.i. obeys total proportionality.If Eve gets n bits of sideinformation about the message,her H.i. cannot increase bymore than n bits.

H.i. is composable.A secure protocol remainssecure when used as asubroutine of a larger protocol.

a.i. doesn’t. n bits of side info mayincrease Eve’s a.i. by adisproportionately large amount.But only if she receives the bitsbefore she measures the quantumstate (or it decoheres!).

a.i. is not. But if Eve receives theadditional bits after making hermeasurement (or decoherenceoccurs), then her a.i. isproportional since c.m.i. is.Furthermore, composable securityis then granted.

H.i. obeys total proportionality.

If Eve gets n bits of sideinformation about the message,her H.i. cannot increase bymore than n bits.

H.i. is composable.

A secure protocol remainssecure when used as asubroutine of a larger protocol.

a.i. doesn’t.

n bits of side info mayincrease Eve’s a.i. by adisproportionately large amount.But only if she receives the bitsbefore she measures the quantumstate (or it decoheres!).

a.i. is not.

But if Eve receives theadditional bits after making hermeasurement (or decoherenceoccurs), then her a.i. isproportional since c.m.i. is.Furthermore, composable securityis then granted.

Making it Practical

Secret Key Consumption and Generation

Just as in the classical theory, security would fail if the secretkey were used more than once. So Alice would like to be ableto send Bob new key bits at a faster rate than he consumesthem.

Fortunately, it has been shown that QDL allows for a veryhigh secret key generation rate. Just one bit less than thechannel’s classical capacity!

The price to pay for this is precisely that the a.i. securitycriterion does not guarantee unconditional and composablesecurity. (i.e. the decoherence time of Eve’s quantum memoryis the limiting factor)

Making it Practical

Key Generation ProtocolPart 1:

Using a QDL protocol, Alice encodes her share of the raw keyinto a quantum state and sends it to Bob over their(unsecure) quantum channel.Bob measures the output and obtains his share of the raw keywhich must be reconciled with Alice’s.The security in this part of the protocol is gauranteed by theQDL protocol through the a.i. criterion.

Part 2:

Alice sends error correcting information to Bob through apublic channel. (There is no need for additional security sincethe raw key was already secure by QDL)

The important point is that the QDL protocol (i.e. Part 1) is asubroutine of the key generation and distribution protocol.

Making it Practical

Using a QDL protocol, Alice encodes her share of the raw keyinto a quantum state and sends it to Bob over their(unsecure) quantum channel.

Bob measures the output and obtains his share of the raw keywhich must be reconciled with Alice’s.The security in this part of the protocol is gauranteed by theQDL protocol through the a.i. criterion.

Part 2:

Making it Practical

Using a QDL protocol, Alice encodes her share of the raw keyinto a quantum state and sends it to Bob over their(unsecure) quantum channel.Bob measures the output and obtains his share of the raw keywhich must be reconciled with Alice’s.

The security in this part of the protocol is gauranteed by theQDL protocol through the a.i. criterion.

Part 2:

Making it Practical

Part 2:

Making it Practical

Part 2:

Making it Practical

Part 2:

Alice sends error correcting information to Bob through apublic channel.

(There is no need for additional security sincethe raw key was already secure by QDL)

Making it Practical

Part 2:

Making it Practical

Part 2:

Making it Practical

Secure Key Distribution

This means that the total process of key generation, distribution,and reconciliation will only be secure (in the composable sense) ifthe QDL protocol is.As we saw, the sufficient condition for this is for Alice to wait atleast the decoherence time of Eve’s quantum memory beforesending the error correction information to Bob.

Making it Practical

This means that the total process of key generation, distribution,and reconciliation will only be secure (in the composable sense) ifthe QDL protocol is.

As we saw, the sufficient condition for this is for Alice to wait atleast the decoherence time of Eve’s quantum memory beforesending the error correction information to Bob.

Making it Practical

This means that the total process of key generation, distribution,and reconciliation will only be secure (in the composable sense) ifthe QDL protocol is.As we saw, the sufficient condition for this is for Alice to wait atleast the decoherence time of Eve’s quantum memory beforesending the error correction information to Bob.

A Quantum Enigma Machine

Experimental Setup

Procedural Details...

This proof-of-principle of QDL as QSDC encodes 6 bits ofinformation into a single photon while encrypting that informationwith less than 6 bits of secret key.

The laser generates a 325nm photon beam which is downconverted into two 650nm daughter photons, referred to assignal and herald. The herald photon is used to herald thepresence of the signal photon on Bob’s detector.

Alice encodes information in the transverse linear phase of thesignal photon’s wave front and operates with a scramblingunitary operation specified in the code book.

Procedural Details continued...

Each scrambling unitary is composed of zero, and π relativephase shifts.

The data encoding and encryption follows from a principle ofFourier optics; namely, that a linear phase shift on a wavefront corresponds to a linear shift in the focal point of it’sFraunhofer diffraction pattern, whereas a scrambled wavefront has no well-defined focal point.

Finally, Alice adds 1 of the 64 linear phase patterns to ascrambling phase pattern and transmits this photon to Bob.

Procedural Details continued... (again)

Bob receives the photon, applies the appropriate inversescrambling unitaries, and focuses the resulting state onto hisdetector.

If unscrambled properly, the photon will register on thedetector pixel which Alice had intended.

Some Results

Alice encrypted each of the 64 settingsover 600 times, and Bob used the keyso unscramble the wave fronts.

Eve’s optimal quantum distributionwas obtained directly from Bob’sdetector. But lacking the secret key,she could only randomly guess inverseunitaries in an attempt to maximizeher mutual information.

Clearly, Bob’s measurements are highlycorrelated, while Eves follow a highlyuncorrelated flat distribution for theprobability of photodetection.

Some Results

Complicating Matters

Secret Key Generation...

Taking into account Bob’s rate of key consumption, we need tocalculate the necessary key generation and distribution rates.

Start with a key consumption rate of (log2 Kn)/n for n uses ofa d-dimensional quantum channel where the initially agreedupon secret key was Kn bits in length.

In order to satisfy security (according to a.i. criterion), Evemust be limited to Iacc ≤ O(ε log2(dn)) bits of a.i. when usinga channel n times, and where ε grows exponentially small withchannel use, (ε = 2−n

cfor c < 1). This will be the case

provided we require sufficiently many scrambling unitaries.

Secret Key Generation continued

In the spirit of our simple example from earlier, one may computethe necessary key generation rates.

For n = 63, and n = 126, letting d = 650, M = 64n, andε = 2−

√n, one finds key consumption rates of

log2 K63

63≥ 3.757, and

log2 K126

126≥ 3.611

bits per photon, respectively, are enough to limit Eve’s a.i. toonly a few bits compared with having transmitted 378 bitsand 756 bits, respectively.

This seems to leave plenty of room for the message! But maybeone would also like to include...

log2 K63

63≥ 3.757, and

log2 K126

126≥ 3.611

log2 K63

63≥ 3.757, and

log2 K126

126≥ 3.611

log2 K63

63≥ 3.757, and

log2 K126

126≥ 3.611

Forward Error Correction

Reliable transmition of message and key data requires lowenough error rates that Bob can reliably decrypt the datapackets.

Since it is impossible to completely eliminate errors, someform of error correction is warranted.

In this experiment, the overall error is about 10 percent. Thisis low enough to allow the use of forward error correction(FEC) protocols.

However, including FEC means that now the 6 bit photonmust include: message, key, and error correction data.

Furthermore, it must be done so securely. So extra key bitsmust be used to cover up the redundancy in the errorcorrection code. Thereby increasing the key consumption rate.

Reed-Solomon Error Correction Codes (R-S codes)

This method is particularly suited to this particular experiment,because it detects and corrects errors on symbols (i.e. collectionsof bits), rather than on individual bits. This applies here since each6 bit symbol is encoded in a single photon. Important propertiesare,

R-S codes are also transmitted in packets of symbols, thelargest of which may have length 2s − 1 for an s bit alphabet.

Thus, for a 6 bit alphabet, R-S codes for 26 − 1 = 63 symbolsper packet is used. In particular, they use R-S (63, x)protocols where x < 63 is the number of symbols in theoriginal data packet containing message or key. Thus 63 − xsymbols are left to encode the redundant (error correcting)information.

Reed-Solomon Error Correction Codes (R-S codes)This method is particularly suited to this particular experiment,because it detects and corrects errors on symbols (i.e. collectionsof bits), rather than on individual bits. This applies here since each6 bit symbol is encoded in a single photon.

Important propertiesare,

Reed-Solomon Error Correction Codes (R-S codes)This method is particularly suited to this particular experiment,because it detects and corrects errors on symbols (i.e. collectionsof bits), rather than on individual bits. This applies here since each6 bit symbol is encoded in a single photon. Important propertiesare,

Thus, for a 6 bit alphabet, R-S codes for 26 − 1 = 63 symbolsper packet is used.

In particular, they use R-S (63, x)protocols where x < 63 is the number of symbols in theoriginal data packet containing message or key. Thus 63 − xsymbols are left to encode the redundant (error correcting)information.

Thus, for a 6 bit alphabet, R-S codes for 26 − 1 = 63 symbolsper packet is used. In particular, they use R-S (63, x)protocols where x < 63 is the number of symbols in theoriginal data packet containing message or key.

Thus 63 − xsymbols are left to encode the redundant (error correcting)information.

R-S Codes continued

A R-S (63, x) code can correct up to (63− x)/2 symbol errors.

The fractional redundancy of the useful information is(63 − x)/x .

To secure this redundancy, the key must be 1 + (63 − x)/xtimes larger.

Finally, notice that this leaves less space for the encryptedmessage. And because the key consumption rate is larger, thecode book must be made exponentially larger to guaranteesecurity (info-theoretic, in the accessible information sense ).

R-S Codes continued

Experimental conclusions

This experiment securely applied Reed-Solomon (63, 35)protocol and transmitted 420 packets of 63 photons (eachphoton was a 6 bit symbol containing 1 bit of message, 2.3bits of new secret key, and 2.7 bits of redundancy) with asuccess rate of 99.5 percent.

Final thoughts:

Experimental conclusions

This experiment securely applied Reed-Solomon (63, 35)protocol and transmitted 420 packets of 63 photons (eachphoton was a 6 bit symbol containing 1 bit of message, 2.3bits of new secret key, and 2.7 bits of redundancy) with asuccess rate of 99.5 percent.

Final thoughts:

References

(2014)

Quantum-Locked Key Distribution at Nearly the Classical Capacity Rate

Phys. Rev. Lett. 113, 160502.

(2016)

Quantum Enigma Machine: Experimentally Demonstrating QuantumData Locking

Phys. Rev. Lett. A94, 022315

The End

quantum data locking (qdl): from theory to...

Documents