Noisy-storage model Protocols and Techniques

Noisy-storagemodelProtocols and Techniques Stephanie Wehner • Based on joint work with: • Robert Koenig and JuergWullschleger (arXiv:0906.1030) • Marcos Curty, Christian Schaffner, Hoi-Kwong Lo (arXiv:0911.2302)

Outline • Results • Weak string erasure • Protocol • Proof sketch • Bit commitment from weak string erasure • Oblivious transfer from weak string erasure • Open questions

Sending information through storage Noisy quantum storage Encode Decode guess Random string Success probability

Security vs. sending classical information through • General Result: Supposethedecodingprobabilitydecreasesexponentiallyfor large enough • Thenbitcommitment and oblivioustransfercanbeachieved • usingbits of communication • with exponential security (in )

Tensor product noise: To obtain for the capacity of the noisy channel must be small But this is not enough!

Tensor product noise: Can be achieved if has strong converse property If sending at rate above capacity the success probability decays exponentially. To obtain for the capacity of the noisy channel must be small KW’09 at arXiv:0903.2838 But this is not enough!

Security for storage noise • Result: For where has thestrongconverseproperty, and • Bit commitment and Oblivioustransfercanbeachieved. • Examples of channels: • Depolarizing channel • Unitalqubit channels

Comparison to bounded storage Qubit depolarizing channel: How much noise do we need to ensure storage bound? r • Advantages: • Needlessnoise to besecure • Securityformanyotherchannels Noisy storage model Bounded storage model Storage rate

Quantum Classical post-processing

Protocol for weak string erasure Repeat n times (for 1·i· n): 1 Pick basis { , } Pick Pick basis{ , } No storage needed for honest parties! If then add index to the set 2 Output substring

Dishonest Alice Learn index set ! 1 Easy, since Bob never sends any information to Alice. (Can show that Bob’s view is consistent with Alice having chosen an )

Learn a lot about the string x! Dishonest Bob Encoding Attack NoisyStorage Quantum Classical K Basis information guess State before measurement Measure

Proof sketch Lemma: Uncertainty relation determines rate at which adversary has to send information Use an uncertainty relation to bound the min-entropy without Bob’s quantum information DFRSS’06, MU ‘89 Use the strong converse property Uncertainty relation determines the rate at which the adversary needs to send information through the channel Done!

An example Qubit depolarizing noise Qutrit depolarizing noise

Randomized commitment Commit “Committed!” Open and a flag If both parties are honest, then If Bob is honest, then (w.h.p) If Alice is honest, then (w.h.p.) Bob cannot learn anything about before Open phase

String commitment from weak string erasure

Protocol Ingredients • Two-universal hashing • The function is called two-universal if for all and chosen uniformly at random Some knowledge X (almost) No knowledge Ext(X,R)

Protocol If both parties are honest, Bob accepts and outputs Commit Weak string erasure Syndrome of Chooses for hashing Outputs Open If syndrome doesn’t match or then reject!

Dishonest Alice Bob should accept Commit Weak string erasure Syndrome of Chooses for hashing Outputs • From weak string easure, Alice does not learn which bits of Bob learned • From error correcting code she needs to cheat on many bits of to change Open If syndrome doesn’t match or then reject!

Dishonest Bob Learn Before Open! Commit Weak string erasure Syndrome of Chooses for hashing Outputs Commitment rate • From weak string easure, Bob’s knowledge about is limited • Using privacy amplification, we then have that Bob knows (almost) nothing about Open If syndrome doesn’t match or then reject!

Oblivious transfer (OT) from weak string erasure

Min-entropy sampling Interactive Hashing IH If Bob is honest, Alice learns nothing about C. If Alice is honest, then Bob has little control over

Protocol (simplified) Weak stringerasure 0 0 1 1 1 0 ? 1 1 ? Select subset of Known bits 0 1 IH 0 1 0 1 ? 1 Two universal hashing using randomly chosen ?

Dishonest Alice Weak stringerasure Alice doesn’t learn which bits Bob knows 0 0 1 1 1 0 ? 1 1 ? Select subset of Known bits W Alice doesn’t learn which set of bits Bob knows 0 1 IH ? 1 0 1 0 1 Two universal hashing using randomly chosen Alice doesn’t learn which string Bob knows ?

Dishonest Bob Weak stringerasure Bob has limited knowledge about the string 0 0 1 1 1 0 ? 1 1 ? Select subset of Known bits W 0 1 IH Bob has little control over the choice of the other set ? 1 0 1 0 1 Two universal hashing using randomly chosen Since he only has some knowledge about the other string, he has no knowledge about the hash ?

Outline • Results • Weak string erasure • Protocol • Proof sketch • Bit commitment from weak string erasure • Oblivious transfer from weak string erasure • Summary and Open questions

Summary and open questions • Bit commitment and oblivious transfer from the sole assumption of noisy quantum storage • Security can be obtained for realistic experimental parameters (WCSL ‘09, arXiv:0911.2302) • Robust against real world errors

Open questions • Can we obtain interesting security parameters for other channels? • Channels with memory • Channels with large classical capacity (dephasing noise) New approach needed! • What are realistic error models for quantum memories?

Open questions • What are the real limits on security? Noise ??? Secure Storage rate Using different encodings: e.g. 3 mubs

Open questions • Bounds on the maximal achievable rates in terms of • Weak string erasure • Bit commitment • Oblivious transfer

Open questions • What other protocols are possible? • What other assumptions are reasonable?

Open questions • How to make the protocol more efficient? • Use constant round interactive hashing (Ding et al. ‘07) • For a large amount of noise, use exact uncertainty relations • Better understanding of min-entropy sampling and extractors • Need to find a composability framework • Classical environment (Fehr, Schaffner ‘08) • Previous OT protocols in quantum environment (W, Wullschleger ’08)

Open questions • QKD + adversary has noisy storage? • Find an efficient protocol for secure identification and other tasksbased directly on weak string erasure. • Practical implementation • Outlook • Unlike in QKD, our applications are especially interesting at a short distance • Desirable to have a small, low-power, device for Alice Thank you! ssarXiv:0807ssss Chris Ervens arXiv:0906.1030 arXiv:0911.2302

Noisy-storage model Protocols and Techniques