1 / 38

Noisy-storage model Protocols and Techniques

Noisy-storage model Protocols and Techniques. Stephanie Wehner. Based on joint work with: Robert Koenig and Juerg Wullschleger (arXiv:0906.1030) Marcos Curty , Christian Schaffner , Hoi- Kwong Lo (arXiv:0911.2302). Outline. Results Weak string erasure Protocol Proof sketch

nusa
Download Presentation

Noisy-storage model Protocols and Techniques

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Noisy-storagemodelProtocols and Techniques Stephanie Wehner • Based on joint work with: • Robert Koenig and JuergWullschleger (arXiv:0906.1030) • Marcos Curty, Christian Schaffner, Hoi-Kwong Lo (arXiv:0911.2302)

  2. Outline • Results • Weak string erasure • Protocol • Proof sketch • Bit commitment from weak string erasure • Oblivious transfer from weak string erasure • Open questions

  3. Sending information through storage Noisy quantum storage Encode Decode guess Random string Success probability

  4. Security vs. sending classical information through • General Result: Supposethedecodingprobabilitydecreasesexponentiallyfor large enough • Thenbitcommitment and oblivioustransfercanbeachieved • usingbits of communication • with exponential security (in )

  5. Tensor product noise: To obtain for the capacity of the noisy channel must be small But this is not enough!

  6. Tensor product noise: Can be achieved if has strong converse property If sending at rate above capacity the success probability decays exponentially. To obtain for the capacity of the noisy channel must be small KW’09 at arXiv:0903.2838 But this is not enough!

  7. Security for storage noise • Result: For where has thestrongconverseproperty, and • Bit commitment and Oblivioustransfercanbeachieved. • Examples of channels: • Depolarizing channel • Unitalqubit channels

  8. Comparison to bounded storage Qubit depolarizing channel: How much noise do we need to ensure storage bound? r • Advantages: • Needlessnoise to besecure • Securityformanyotherchannels Noisy storage model Bounded storage model Storage rate

  9. Outline • Results • Weak string erasure • Protocol • Proof sketch • Bit commitment from weak string erasure • Oblivious transfer from weak string erasure • Open questions

  10. Quantum Classical post-processing

  11. Protocol for weak string erasure Repeat n times (for 1·i· n): 1 Pick basis { , } Pick Pick basis{ , } No storage needed for honest parties! If then add index to the set 2 Output substring

  12. Dishonest Alice Learn index set ! 1 Easy, since Bob never sends any information to Alice. (Can show that Bob’s view is consistent with Alice having chosen an )

  13. Learn a lot about the string x! Dishonest Bob Encoding Attack NoisyStorage Quantum Classical K Basis information guess State before measurement Measure

  14. Proof sketch Lemma: Uncertainty relation determines rate at which adversary has to send information Use an uncertainty relation to bound the min-entropy without Bob’s quantum information DFRSS’06, MU ‘89 Use the strong converse property Uncertainty relation determines the rate at which the adversary needs to send information through the channel Done!

  15. An example Qubit depolarizing noise Qutrit depolarizing noise

  16. Outline • Results • Weak string erasure • Protocol • Proof sketch • Bit commitment from weak string erasure • Oblivious transfer from weak string erasure • Open questions

  17. Randomized commitment Commit “Committed!” Open and a flag If both parties are honest, then If Bob is honest, then (w.h.p) If Alice is honest, then (w.h.p.) Bob cannot learn anything about before Open phase

  18. String commitment from weak string erasure

  19. String commitment from weak string erasure

  20. Protocol Ingredients • Two-universal hashing • The function is called two-universal if for all and chosen uniformly at random Some knowledge X (almost) No knowledge Ext(X,R)

  21. Protocol If both parties are honest, Bob accepts and outputs Commit Weak string erasure Syndrome of Chooses for hashing Outputs Open If syndrome doesn’t match or then reject!

  22. Dishonest Alice Bob should accept Commit Weak string erasure Syndrome of Chooses for hashing Outputs • From weak string easure, Alice does not learn which bits of Bob learned • From error correcting code she needs to cheat on many bits of to change Open If syndrome doesn’t match or then reject!

  23. Dishonest Bob Learn Before Open! Commit Weak string erasure Syndrome of Chooses for hashing Outputs Commitment rate • From weak string easure, Bob’s knowledge about is limited • Using privacy amplification, we then have that Bob knows (almost) nothing about Open If syndrome doesn’t match or then reject!

  24. Outline • Results • Weak string erasure • Protocol • Proof sketch • Bit commitment from weak string erasure • Oblivious transfer from weak string erasure • Open questions

  25. Oblivious transfer (OT) from weak string erasure

  26. Oblivious transfer (OT) from weak string erasure

  27. Min-entropy sampling Interactive Hashing IH If Bob is honest, Alice learns nothing about C. If Alice is honest, then Bob has little control over

  28. Protocol (simplified) Weak stringerasure 0 0 1 1 1 0 ? 1 1 ? Select subset of Known bits 0 1 IH 0 1 0 1 ? 1 Two universal hashing using randomly chosen ?

  29. Dishonest Alice Weak stringerasure Alice doesn’t learn which bits Bob knows 0 0 1 1 1 0 ? 1 1 ? Select subset of Known bits W Alice doesn’t learn which set of bits Bob knows 0 1 IH ? 1 0 1 0 1 Two universal hashing using randomly chosen Alice doesn’t learn which string Bob knows ?

  30. Dishonest Bob Weak stringerasure Bob has limited knowledge about the string 0 0 1 1 1 0 ? 1 1 ? Select subset of Known bits W 0 1 IH Bob has little control over the choice of the other set ? 1 0 1 0 1 Two universal hashing using randomly chosen Since he only has some knowledge about the other string, he has no knowledge about the hash ?

  31. Outline • Results • Weak string erasure • Protocol • Proof sketch • Bit commitment from weak string erasure • Oblivious transfer from weak string erasure • Summary and Open questions

  32. Summary and open questions • Bit commitment and oblivious transfer from the sole assumption of noisy quantum storage • Security can be obtained for realistic experimental parameters (WCSL ‘09, arXiv:0911.2302) • Robust against real world errors

  33. Open questions • Can we obtain interesting security parameters for other channels? • Channels with memory • Channels with large classical capacity (dephasing noise) New approach needed! • What are realistic error models for quantum memories?

  34. Open questions • What are the real limits on security? Noise ??? Secure Storage rate Using different encodings: e.g. 3 mubs

  35. Open questions • Bounds on the maximal achievable rates in terms of • Weak string erasure • Bit commitment • Oblivious transfer

  36. Open questions • What other protocols are possible? • What other assumptions are reasonable?

  37. Open questions • How to make the protocol more efficient? • Use constant round interactive hashing (Ding et al. ‘07) • For a large amount of noise, use exact uncertainty relations • Better understanding of min-entropy sampling and extractors • Need to find a composability framework • Classical environment (Fehr, Schaffner ‘08) • Previous OT protocols in quantum environment (W, Wullschleger ’08)

  38. Open questions • QKD + adversary has noisy storage? • Find an efficient protocol for secure identification and other tasksbased directly on weak string erasure. • Practical implementation • Outlook • Unlike in QKD, our applications are especially interesting at a short distance • Desirable to have a small, low-power, device for Alice Thank you! ssarXiv:0807ssss Chris Ervens arXiv:0906.1030 arXiv:0911.2302

More Related