Tutorial: Security of quantum key distribution: approach from - PowerPoint PPT Presentation

QCrypt2020: Aug. 12, 2020 Tutorial: Security of quantum key distribution: approach from complementarity Univ. of Tokyo Masato Koashi

Quantum key distribution (QKD) Public communication Weak light pulses signals measurement Eve tests Bob Alice Optical channel 0100111 Sifted key Sifted key 0100101 Error correction 0100101 0100101 ??0?1?? Estimating the amount of leak from observed test data Privacy amplification Final key 0101 Final key 0101 ???? Shortening the key to remove the leaked portion

Aim of this tutorial Explain how we can prove the security of QKD protocols against general attacks, focusing on the approach with “phase errors,” which dates back to Mayers, Shor and Preskill. PART I: Methodology Step 1: Perfect world (Basic idea) Step 2: Almost perfect world (Composable security) Step 3: Practical world (Privacy amplification) PART II: Protocols BB84 B92 TF-QKD RRDPS DM-CV QKD

STEP 1: Perfect world

Goal of QKD Ideal property of the final key Eve Alice Bob Final key Quantum 𝑨 � 0101 𝑨′ � 0101 Final key System E 𝐿 bits 𝐿 bits 𝜍 � 𝑨 , 𝑨 � � 𝜍 � ∀𝑨 , 𝑨′ ・ Correlation-free 𝑞 𝑨 , 𝑨 � � ∑ 𝑞 𝑨 , 𝑨 � � 2 �� ∑ ・ Uniformly distributed � � � 𝑞 𝑨 , 𝑨 � � 0 whenever 𝑨 � 𝑨′ ・ Error-free Quantum description � � �� ��� , � � � 𝑞�𝑨 , 𝑨 � � 𝑨⟩⟨𝑨 � ⊗ 𝑨′⟩⟨𝑨′ � ⊗ 𝜍 � �𝑨 , 𝑨 � � 𝜍 ��� General state: � , � � �� � � �� ����� , � � � 2 �� 𝑨⟩⟨𝑨 � 𝜍 ��� ⊗ 𝑨⟩⟨𝑨 � ⊗ 𝜍 � Ideal state: ���

Dividing the requirement Ideal property of the final key Eve Alice Bob Final key Quantum 𝑨 � 0101 𝑨′ � 0101 Final key System E 𝐿 bits 𝐿 bits 𝜍 � 𝑨 , 𝑨 � � 𝜍 � ∀𝑨 , 𝑨′ ・ Correlation-free 𝑞 𝑨 , 𝑨 � � ∑ 𝑞 𝑨 , 𝑨 � � 2 �� ∑ ・ Uniformly distributed Overall security � � � 𝑞 𝑨 , 𝑨 � � 0 whenever 𝑨 � 𝑨′ ・ Error-free Secrecy (for Alice) Correctness Prob 𝑨 � 2 �� Prob 𝑨 , 𝑨 � � 0 whenever 𝑨 � 𝑨′ 𝜍 � 𝑨 � 𝜍 � ∀𝑨 ��� , � : � Tr � �𝜍 ��� ��� , � � Property of 𝜍 �� � � �� ��� , � � � 𝑞�𝑨� 𝑨⟩⟨𝑨 � 𝜍 �� ⊗ 𝜍 � �𝑨� General state: ��� � � �� ����� , � � � 2 �� 𝑨⟩⟨𝑨 � Ideal state: 𝜍 �� ⊗ 𝜍 � ���

Starting point: Cases when it is obviously secure In what situation are we sure of achieving the ideal state? � � �� ・ Correlation-free ����� , � � � 2 �� 𝑨⟩⟨𝑨 � 𝜍 �� ⊗ 𝜍 � ・ Uniformly distributed ��� 0 | ＋ ⟩ � � |0 ⟩ � |1 ⟩� / 2 1 X basis eigenstate (a pure state) Z basis measurement Circularly polarized photon H/V polarization Output ports of a half beam splitter A single photon fed to one input port 1/2-Spin particle pointing (+x) direction Z component of spin If system A is in a pure state, it has no correlation to another system. contrapositive If system A has non-zero correlation to another system, it is in a mixed state.

Starting point: Cases when it is obviously secure In what situation are we sure of achieving the ideal state? � � �� ・ Correlation-free ����� , � � � 2 �� 𝑨⟩⟨𝑨 � 𝜍 �� ⊗ 𝜍 � ・ Uniformly distributed ��� | ＋ ⟩ � � |0 ⟩ � |1 ⟩� / 2 0 1 ����� , � 𝜍 �� 0 1 0 0 0 0 Let us define the outcome 0 ‘0000000’ as ‘success’. Any other outcome is a failure. 0

Starting point: Cases when it is obviously secure In what situation are we sure of achieving the ideal state? � � �� ・ Correlation-free ����� , � � � 2 �� 𝑨⟩⟨𝑨 � 𝜍 �� ⊗ 𝜍 � ・ Uniformly distributed ��� 0 ? 1 ? ��� , � 𝜍 �� 0 ? ? 1 ? 0 If there is a promise that 0 the failure probability is zero, 0 ��� , � � 𝜍 �� ����� , � 𝜍 �� 0 Let us define the outcome 0 ‘0000000’ as ‘success’. Any other outcome is a failure. 0

So what? In what situation are we sure of achieving the ideal state? � � �� ����� , � � � 2 �� 𝑨⟩⟨𝑨 � 𝜍 �� ⊗ 𝜍 � ��� | ＋ ⟩ � � |0 ⟩ � |1 ⟩� / 2 0 1 ����� , � 𝜍 �� 0 1 0 Alice: “I am a sender of optical pulses. I see no qubits in my transmitter.” Bob: “Well, I’d be happy to see Alice’s key is secret, but the thing is, I don’t know her key either…”

Converting a sender to a receiver Alice: “I am a sender of optical pulses. I see no qubits in my transmitter.” Actual transmitter 0 A horizontally polaraized photon Probability 50% Probability 50% 1 A vertically polarized photon An entangled state 1 1 + Equivalent = 2 2 0 1 Cases with a larger number of states, mixed states, and different probabilities are the same, except that the size of virtual quantum system may be larger. Then a qubit can be defined in a security proof.

Freedom of Z rotation Bob: “Well, I’d be happy to see Alice’s key is secret, but the thing is, I don’t know her key either…” 0 ? 0 ? Z axis rotations 1 ? 1 ? Operations that ��� , � ��� , � commute with 𝜍 �� 𝜍 �� 0 ? 0 ? 𝑎 ≔ 0 ⟩⟨ 0 � 1 ⟩⟨ 1 1 ? ? 1 for every qubit ? ? 0 “Z-preserving” operations 0 If there is a promise that 0 the failure probability is zero, 0 ��� , � � 𝜍 �� ����� , � 𝜍 �� 0 0 0

Freedom of Z rotation Bob: “Well, I’d be happy to see Alice’s key is secret, but the thing is, I don’t know her key either…” 0 ? 1 ? ��� , � 𝜍 �� 0 ? ? 1 ? 0 If there is a promise that 0 the failure probability is zero, 0 ��� , � � 𝜍 �� ����� , � 𝜍 �� 0 Z axis rotations are freely 0 allowed to decrease the 0 failure probability.

Entanglement 1 1 = + 2 2 1 1 + = Correctness 2 2 Bob 0 0 1 1 ��� , � 𝜍 �� 0 0 1 1 0 0 Secrecy (for Alice) Bob 0 0 1 0 0 0 0 0 0 1 instruction

Security from complementarity 0 0 Bob tries to guess 1 1 Alice’s final key ��� , � 𝜍 �� 0 0 1 1 0 0 ��� , � � 𝜍 �� ����� , � If there is a promise that the failure probability is zero, 𝜍 �� 0 Bob tries to help resetting Alice’s 0 qubits to 0 on X basis 0 0 0

Security from complementarity 0 0 Bob tries to guess 1 1 Alice’s final key ��� , � 𝜍 �� 0 0 1 1 0 0 𝐿 ebits of entanglement Both tasks are perfectly feasible 0 Bob tries to help resetting Alice’s 0 qubits to 0 on X basis 0 0 Classical channel 0 MK, arXiv:0704.3661

Security from complementarity 0 0 Bob tries to guess 1 1 Alice’s final key ��� , � 𝜍 �� 0 0 1 1 0 0 ��� , � � 𝜍 �� ����� , � If there is a promise that the failure probability is zero, 𝜍 �� “Z-preserving” operations 0 Bob tries to help resetting Alice’s 0 qubits to 0 on X basis 0 0 Quantum channel 0 A ′ MK, New J. Phys. , 11 , 045018 (2009); MK, arXiv:0704.3661

Security from complementarity 0 0 Bob tries to guess 1 1 Alice’s final key ��� , � 𝜍 �� 0 0 Learning 1 1 Alice’s final key 0 0 Bob has a choice between a pair of mutually exclusive tasks 0 Bob tries to help resetting Alice’s 0 qubits to 0 on X basis 0 Erasing info on 0 Alice’s final key 0

STEP 2: Almost perfect world

Small imperfection 0 0 Bob tries to guess 1 1 Alice’s final key ��� , � 𝜍 �� 0 0 1 1 0 0 We want a theorem looking like ��� , � is close to 𝜍 �� ����� , � . If there is a promise that the failure probability is � 𝜀 , 𝜍 �� 0 Bob tries to help resetting Alice’s 0 qubits to 0 on X basis 0 0 0 A ′

Measure of imperfection � � �� ��� , � � � 𝑞�𝑨 , 𝑨 � � 𝑨⟩⟨𝑨 � ⊗ 𝑨′⟩⟨𝑨′ � ⊗ 𝜍 � �𝑨 , 𝑨 � � 𝜍 ��� Actual state: � , � � �� Proper measure of closeness? � � �� ����� , � � � 2 �� 𝑨⟩⟨𝑨 � 𝜍 ��� ⊗ 𝑨⟩⟨𝑨 � ⊗ 𝜍 � Ideal state: ��� A standard measure in QKD (Universal composable security) ・ Use of trace distance 1 ��� , � � 𝜍 ��� ����� , � 𝐵 � 𝐵 2 𝜍 ��� 𝐵 � ≔ Tr � Monotonicity: 𝜍 � 𝜏 � � Λ 𝜍 � Λ 𝜏 � for any CPTP map Λ . Triangle inequality: 𝜍 � 𝜏 � � 𝜍 � 𝜐 � � 𝜐 � 𝜏 � ・ Specification of 𝜍 � � � �� ����� , � � Tr �� 𝜍 ��� ��� , � � � 𝑞�𝑨 , 𝑨 � � 𝜍 � �𝑨 , 𝑨 � � 𝜍 � � Tr �� 𝜍 ��� � , � � �� ・ Regard system E as ‘everything’, not just an adversary’s system. (As long as you are proving security against general attacks, you don’t have to worry about this difference.) Ben-Or, M. Horodecki, Leung, Mayers, Oppenheim, in Proc. 2nd Theory Cryptogr. Conf., 3378 , 386 (2005)