device-independent security in quantum key distribution lluis masanes icfo-the institute of photonic...
TRANSCRIPT
![Page 1: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/1.jpg)
Device-independent security in quantum key distribution
Lluis Masanes ICFO-The Institute of Photonic Sciences
arXiv:0807.2158
![Page 2: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/2.jpg)
Outline
1. Why violation of Bell inequalities plus no-signaling imply secure key distribution?
2. Description of the key distribution protocol3. The security definition4. Main result (security of privacy amplification)5. Analogy between Bell-violation and the min entropy6. The device-independent-security model7. Imposing quantum mechanics8. Estimation without de-Finetti9. Sketch of the proof10. Conclusions
![Page 3: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/3.jpg)
No-signaling plus Bell-violation implies privacy
• Forget quantum mechanics• Consider 2 parties (Alice and Bob)
![Page 4: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/4.jpg)
No-signaling plus Bell-violation implies privacy
• Suppose a third party (Eve) knows the outcome of Alice’s
are compatible The correlations do not violate any Bell inequality
![Page 5: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/5.jpg)
No-signaling plus Bell-violation implies privacy
• CONCLUSION: If a Bell inequality is violated the outcomes cannot be perfectly known by a third party
• Relation between the amount of Bell inequality violation and the degree of privacy
![Page 6: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/6.jpg)
A key distribution protocol
1. Distribute N pairs of systems
![Page 7: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/7.jpg)
A key distribution protocol
1. Distribute N pairs of systems
2. Measure all systems with the observable x=y=0
3. Error correction
![Page 8: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/8.jpg)
A key distribution protocol
1. Distribute N pairs of systems
2. Measure all systems with the observable x=y=0
3. Error correction
4. Privacy amplification (with a constant function)
![Page 9: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/9.jpg)
A key distribution protocol
1. Distribute N pairs of systems
2. Measure all systems with the observable x=y=0
3. Error correction
4. Privacy amplification (with a constant function)
![Page 10: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/10.jpg)
A key distribution protocol
• If the numbers are well chosen the 2 keys are identical and secure
• To decide we need an estimation step (latter)
![Page 11: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/11.jpg)
The no-signaling assumption
• Alice, Bob and Eve share a distribution
• None of the systems can signal the rest
![Page 12: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/12.jpg)
The security definition
• Consider Alice’s key when M=0• Ideal secret key:• Real secret key (result of the protocol):• Security definition: the real and the ideal distributions
are indistinguishable, even if Alice and Eve cooperate for this purpose
![Page 13: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/13.jpg)
The security definition
• Consider Alice’s key when M=0• Ideal secret key:• Real secret key (result of the protocol):• Security definition: the real and the ideal distributions
are indistinguishable, even if Alice and Eve cooperate for this purpose
• Any use of the the real key will give the same results as the ideal key (Universally-composable security)
![Page 14: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/14.jpg)
Main result: security of privacy amplification
For any nonsignaling distribution
let with all x=0, then
where
PR-box Quantum ClassicalCHSH
![Page 15: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/15.jpg)
Main result: security of privacy amplification
For any nonsignaling distribution
let with all x=0, then
where
![Page 16: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/16.jpg)
Main result: security of privacy amplification
For any nonsignaling distribution
let then
where
Quantum ClassicalPR-box Quantum ClassicalCHSHBC
![Page 17: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/17.jpg)
Bell violation is analogous to the min entropy
• Define
• Min entropy is the central quantity in standard QKD
• allows for deterministic randomness extraction, while needs random hashing
![Page 18: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/18.jpg)
Incorporating public communication
• If Alice publishes M bits during the protocol
• Efficiency
![Page 19: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/19.jpg)
Secret key rates
No-signG obs
6 states
![Page 20: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/20.jpg)
The device-independent security model
Untrusted device: a physical system plus the measurement apparatus
For each system, we can ignore the dimension of the Hilbert space, the operators that correspond to the observables 0 and 1, etc.
![Page 21: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/21.jpg)
The device-independent security model
Untrusted device: a physical system plus the measurement apparatus
Trusted device: classical computer, random number generator, etc
![Page 22: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/22.jpg)
Physical meaning of the no-signaling constrains
• Systems must not signal Eve • Systems must not signal the other party• Signaling among Alice’s systems must not occur• Signaling among Bob’s systems is allowed
![Page 23: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/23.jpg)
The device-independent security model
• The simplest implementation of QKD is through a sequential distribution of pairs of systems
• All systems in one side are observed with the same detector
• In this set up, the assumption of full no-signaling in Alice’s side seems unjustified
![Page 24: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/24.jpg)
The device-independent security model
• Total relaxation• If we allow signaling between Alice’s systems, privacy
amplification is impossible• Although it is fair to assume something stronger
![Page 25: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/25.jpg)
The sequential no-signaling model
time
• We call these constraints sequential no-signaling
• If the function used for hashing is XOR or MAJORITY, there is a sequential no-signaling attack (E. Hanggi, Ll. Masanes)
• Does this happen with any function?
![Page 26: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/26.jpg)
Let’s assume quantum mechanics
• Let us impose
• Or something weaker
![Page 27: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/27.jpg)
Let’s assume quantum mechanics
• Let us impose
• Or something weaker
• We obtain the same expressions with
![Page 28: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/28.jpg)
Secret key rates
No-signG obs
No-sign + QM2 obs
6 states
![Page 29: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/29.jpg)
Estimation of and
• In the unconditional security scenario, Alice and Bob have no idea about nor
• There is no known exponential de Finetti-like theorem• Instead
![Page 30: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/30.jpg)
A problem with the estimation
• With this method we do not get the above rates[singlets give: rate = 0.26 < 1!]
• Can we find an estimation procedure which gives the expected rates?
• Is this something fundamental?
![Page 31: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/31.jpg)
Sketch of the proof
![Page 32: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/32.jpg)
Sketch of the proof
![Page 33: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/33.jpg)
Conclusions
1. Key distribution from Bell-violating correlations is secure, with the sole assumption of no-signaling
2. According to the strongest notion of security (universally-composable)
3. Analogy between Bell-violation and the min entropy4. The security of the scheme is device independent5. Rates can be improved by assuming QM6. Deterministic randomness extraction is possible7. Thanks for your attention
![Page 34: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/34.jpg)
Smooth Bell-inequality violation
• Define
• Bell-inequality violation is asymptotically discontinuous
![Page 35: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/35.jpg)
Analogy with the smooth min entropy
• Min entropy is the central quantity in standard QKD
• allows for deterministic randomness extraction, while needs random hash
![Page 36: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/36.jpg)
Incorporating public communication
• If Alice publishes M bits during the protocol
• Efficiency
![Page 37: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/37.jpg)
Sketch of the proof
![Page 38: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/38.jpg)
Sketch of the proof
![Page 39: Device-independent security in quantum key distribution Lluis Masanes ICFO-The Institute of Photonic Sciences arXiv:0807.2158](https://reader035.vdocuments.site/reader035/viewer/2022062422/56649ee65503460f94bf64ec/html5/thumbnails/39.jpg)
Assuming quantum mechanics
• Let us impose
• Or something weaker