1 / 29

Implementation of two-party protocols in the noisy-storage model with decoy states

S. Wehner, M. Curty, C. Schaffner, and H.-K. Lo, arXiv: 0911.2302. Implementation of two-party protocols in the noisy-storage model with decoy states. Marcos Curty, S. Wehner, C. Schaffner, H.-K. Lo, T. Moroder, N. L ütkenhaus , X. Ma, B. Qi.

misae
Télécharger la présentation

Implementation of two-party protocols in the noisy-storage model with decoy states

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. S. Wehner, M. Curty, C. Schaffner, and H.-K. Lo, arXiv: 0911.2302 Implementation of two-party protocols in the noisy-storage model with decoy states Marcos Curty, S. Wehner, C. Schaffner, H.-K. Lo, T. Moroder, N. Lütkenhaus, X. Ma, B. Qi M. Curty, T. Moroder, X. Ma, and N. Lütkenhaus, Opt. Lett. 34, 3238 (2009). M. Curty, X. Ma, B. Qi, and T. Moroder, Phys. Rev. A 81, 022310 (2010).

  2. Overview • Weak string erasure • Practical weak string erasure with decoy states • Experimental preparation of decoy states

  3. R. König, S. Wehner, and J. Wullashleger, arXiv: 0906.1030 Weak string erasureBasic Idea Weak string erasure Alice Bob Security

  4. R. König, S. Wehner, and J. Wullashleger, arXiv: 0906.1030 Weak string erasureBasic Idea Weak string erasure + NSM 1-2 Oblivious Transfer Bit commitment Secure identification

  5. 0: 1: R. König, S. Wehner, and J. Wullashleger, arXiv: 0906.1030 Weak string erasurePossible implementation (BB84 signals) Alice: Bob: Alice and Bob wait time t Alice: Sifting (Basis Information) 1 0 1 1

  6. R. König, S. Wehner, and J. Wullashleger, arXiv: 0906.1030 Weak string erasureOptical implementation Ideal scenario Polarization shifter Photons Single photon source BB84 Encoder PB +or × Quantum channel Random number generator Random number generator Bob Alice But Unfortunately a practical implementation looks a bit different….

  7. Weak string erasureOptical implementation (Model) Practical scenario No single photons Losses Noise Phase randomized weak coherent pulses Polarization shifter BB84 Encoder WCP Losses Noise PB +or × Random number generator Random number generator Bob Alice Quantum channel Dark count probability Threshold detectors Detection efficiency Assumption: Both detectors have the same detection efficiency and dark count probability. The dark count probability is independent of the incoming signals.

  8. C. Gobby, Z. L. Yuan, A. J. Shields, Applied Phys. Lett. 84, 3762 (2004). Weak string erasurePractical implementation (Model) Quantum channel: • Losses: Modelled by a beamsplitter of transmittance channel. • Errors: Modelled by a detection error probability edet that a signal sent by Alice produces a click in the erroneous detector on Bob’s side. It characterizes the alignment and stability of the optical system Total losses of the system: Modelled as a beamsplitter of transmittance AchannelBd For short distances, t=AchannelB~1, but det ~0.1 (telecom wavelengths) and det ~0.7 (visible light) (edet=0.033, y =0.85x10-6 ) Total errors of the system: Determined by edet y 

  9. Weak string erasurePractical implementation (Model) Assumptions: • Dishonest party: Can perform perfect quantum operations, has access to a perfect quantum channel, has unlimited classical storage and unlimited (quantum) computational resources. She/he is only restricted by her/his noisy quantum storage. • Honest parties: Have access to a reasonable estimate of the gain and error rate of the system. These parameters are fixed during subsequent executions of the protocol, they can be determined during construction for instance.

  10. 0: 1: S. Wehner, M. Curty, C. Schaffner, and H.-K. Lo, arXiv: 0911.2302 Weak string erasure with errors and losses Alice: Bob: X X X Bob reports to Alice the missing rounds If the missing rounds are like expected: Alice and Bob wait time t Alice: Sifting (Basis Information) 1 1 0

  11. Bob Weak string erasure with lossesSecurity against dishonest Bob N>1 QND Loss ? N=1 Alice N photons N=0 Noisy quantum memory This attack provides dishonest Bob with full information about the part of the string Xm generated with the multi-photon signals. Eavesdropping strategy Security problem N>1 N>1 Full Information N>1 N=1 Quantum storage N=1 N=1 N=0 Report missing N=0 N=0 Just like in QKD

  12. W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003). H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94, 230504 (2005); X.-B. Wang, Phys. Rev. A 72, 012322 (2005). Using decoy states • The previous attack changes the expected yield of an 1-photon state, but this cannot be detected by Alice. Phase randomized weak coherent pulses Polarization shifter WCP BB84 Encoder PB +or × Quantum channel Random number generator Random number generator Mean photon number … Bob Alice Alice prepares phase-randomized coherent states whose mean photon number is chosen at random for each signal from a set of values l

  13. W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003). H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94, 230504 (2005); X.-B. Wang, Phys. Rev. A 72, 012322 (2005). Using decoy states The gain Gl of setting l is given by: Observed Known Unknown The error rate El of setting l is given by: Observed Known Unknown From the observed data Ql and El, together with the knowledge of the photon number distribution of the source, Alice and Bob can solve these sets of linear equations and estimate the value of Y1. Only a few decoy settings are needed.

  14. S. Wehner, M. Curty, C. Schaffner, and H.-K. Lo, arXiv: 0911.2302 Using decoy states The same idea can be applied even when Bob is dishonest!

  15. X. Ma, B. Qi, Y. Zhao, and H.-K. Lo, Phys. Rev. A 72, 012326 (2005). Using decoy states Parameter estimation: For simplicity, we consider a system with only two decoy states (vacuum and a weak decoy state with mean photon number ). Moreover, we impose  < . Lower bound on Y1: The effect of using decoy states is that dishonest Bob needs to behave roughly the same as honest Bob when it comes to choosing which rounds to report as missing, and leads to a significant increase in the set of detection efficiencies for which one can show security.

  16. Using decoy states Forsimulation purposes: • We assume the adversary’s storage is of the form: with: (number of single-photon emissions that we expect an honest Bob to receive) Security for (r,v) below the lines for =0.3, v=0.05 and detection efficiencies = 0.7, 0.5, 0.4, 0.3, and 0.2

  17. Using decoy states r=0.8 and v=1/5 (solid blue line) and v=1/4 (dashed red line) The WSE rate λ for decoy states in terms of r where  = 0.3, and η: 0.7 (solid black line), 0.6 (dashed red line), 0.5 (dotted blue line), 0.4 (dot dashed yellow line), 0.3 (large dashed magenta line) and 0.2 (larger dashed turquoise line). r=0.8 and v=1/5 (solid blue line) and v=1/4 (dashed red line)

  18. Using decoy states Weak string erasure Interactive hashing of subsets Error correction info The rate l/M of oblivious transfer with decoy states for a large number of valid pulses M for parameters ( = 0.2, η = 0.3, r = 0.1, ν = 1/10, solid blue line), ( = 0.3, η = 0.7, r = 0.1, ν = 1/10, dashed red line), ( = 0.3, η = 0.7, r = 0.7, ν = 1/4, dotted magenta line), ( = 0.3, η = 0.7, r = 0.4, ν = 1/3, light blue line). Two-universal hashing

  19. How should Alice prepare decoy states in practice? The use of decoy states helps…. but:.

  20. Preparation of decoy states Typical experimental preparation of decoy states (active setup): Y. Zhao, B. Qi, X. Ma, H.-K. Lo and L. Qian, Phys. Rev. Lett. 96, 070502 (2006). Y. Zhao, B. Qi, X. Ma, H.-K. Lo and L. Qian, Proc. of IEEE International Symposium on Information Theory (ISIT’06), 2094 (2006). C.-Z. Peng, J. Zhang, D. Yang, W.-B. Gao, H.-X. Ma, H. Yin, H.-P. Zeng, T. Yang, X.-B. Wang and J.-W. Pan, Phys. Rev. Lett. 98, 010505 (2007). D. Rosenberg, J. W. Harrington, P. R. Rice, P. A. Hiskett, C. G. Peterson, R. J. Hughes, A. E. Lita, S. W. Nam and J. E. Nordholt, Phys. Rev. Lett. 98, 010503 (2007). T. Schmitt-Manderbach, H. Weier, M. Fürst, R. Ursin, F. Tiefenbacher, T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, J. G. Rarity, A. Zeilinger and H. Weinfurter, Phys. Rev. Lett. 98, 010504 (2007). Z. L. Yuan, A. W. Sharpe and A. J. Shields, Appl. Phys. Lett. 90, 011118 (2007). Z.-Q. Yin, Z.-F. Han, W. Chen, F.-X. Xu, Q.-L. Wu and G.-C. Guo, Chin. Phys. Lett 25, 3547 (2008). J. Hasegawa, M. Hayashi, T. Hiroshima, A. Tanaka and A. Tomita, Preprint quant-ph/0705.3081. J. F. Dynes, Z. L. Yuan, A. W. Sharpe and A. J. Shields, Optics Express 15, 8465 (2007). Variable Optical attenuator WCP Encoder Random number generator Random number generator But in practice having passive preparation might be desirable. Specially in those setups operating at high transmission rates.

  21. Preparation of decoy states Typical active setup: Variable Optical attenuator WCP Encoder Random number generator Random number generator Alternative passive setup: Linear Optical elements WCP Encoder + Random number generator Detector

  22. W. Mauerer, C. Silberhorn, Phys. Rev. A 75, 050305(R) (2007). Y. Adachi, T. Yamamoto, M. Koashi, N. Imoto, Phys. Rev. Lett. 99, 180503 (2007). Y. Adachi et al., New J. Phys. (2009). Preparation of decoy states Known passive schemes rely typically on the use of a parametric down- conversion (PDC) source together with detector. PDC Encoder PNR detector Random number generator • A similar result can be obtained if one substitutes the PNR detector by a threshold detector. • More recently, heralded single-photon source showing non-Poissonian photon number statistics.

  23. Preparation of decoy states With coherent light Main idea: When two phase randomized coherent states interfere at a beam splitter (BS) the photon number statistics of the outcome signals are classically correlated. But with: When two pure coherent states with fixed phase relation interfere at a BS then the photon number statistics of the outcome states is the product of two Poissonian distributions. M. Curty, T. Moroder, X. Ma, and N. Lütkenhaus, Opt. Lett. 34, 3238 (2009).

  24. Preparation of decoy states With coherent light Let us consider a simple threshold detector: Conditional probabilities: Joint probabilities Both distributions, for click and no click events, are non-Poissonian. M. Curty, T. Moroder, X. Ma, and N. Lütkenhaus, Opt. Lett. 34, 3238 (2009).

  25. Preparation of decoy states H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94, 230504 (2005). D. Gottesman, H.-K. Lo, N. Lütkenhaus, and J. Preskill, Quantum Inf. Comput. 4, 325 (2004). C. Gobby, Z. L. Yuan, and A. J. Shields, Appl. Phys. Lett. 84, 3762 (2004). H.-K. Lo, Quantum Inf. Comput. 5, 413 (2005). With coherent light Resulting secret key rate in logarithmic scale (asymptotic case): The cutoff point where the secret key rate drops down to zero is around 147 km (active), 128 km (passive). The experimental parameters are the ones reported by Gobby-Yuan-Shields: Y0=1.7x10-6 d=0.12 ed=0.033  =3.2x10-7 =0.21 dB/km t=1/2 (50:50 BS) sys=Bobchannel=0.045channel R  lRl Security analysis: Rlq{-Glf(El)H(El)+p1lY1[1-H(e1)]+p0lY0} Model channel: Yn=1-(1-Y0)(1-sys)n, Ynen=Y0e0+(Yn-Y0)ed channel=10-d/10 with M. Curty, T. Moroder, X. Ma, and N. Lütkenhaus, Opt. Lett. 34, 3238 (2009).

  26. Preparation of decoy states With coherent light One can improve the secret key rate further by using a passive scheme with more intensity settings. Alice may employ a PNR detector instead of a simple threshold detector, or use more BS in combination with detectors. Do we really need two independent sources of WCP? Alternative active setup: Alternatively, Alice could as well employ, for instance, the scheme illustrated below: Setup with only one laser diode. An intensity monitor (IM) blocks either all the even or all the odd pulses in mode a. The action of the IM guarantees that the signal states that go to Bob are tensor products of mixtures of Fock states. M. Curty, X. Ma, B. Qi, and T. Moroder, Phys. Rev. A 81, 022310 (2010).

  27. Preparation of decoy states With coherent light Passive scheme with strong coherent light and regular photo-detectors: (Threshold) The mean photon number of the signal states  and  is quite high; for instance, around 108 photons. The intensity monitor tells Alice whether the intensity in mode b is below or above a certain threshold value. The analysis can also be adapted to cover measurement devices with several threshold settings. M. Curty, X. Ma, B. Qi, and T. Moroder, Phys. Rev. A 81, 022310 (2009).

  28. Preparation of decoy states With coherent light Original scheme with threshold detectors (finite data size): M. Curty, X. Ma, B. Qi, and T. Moroder, Phys. Rev. A 81, 022310 (2009).

  29. Summary • We have shown that security in the NSM can in principle be obtained in a practical setting. Moreover, our analysis shows that the protocols are well within reach of today’s technology. • We have shown that the use of decoy states can improve the covered distance and rate of the protocols, given a quantum storage available to the cheating party. This method can be use even if Bob is dishonest. • We have briefly presented a simple passive scheme for preparation of decoy states with phase randomized WCPs that might be desirable in some practical scenarios.

More Related