Michele Mosca Canada Research Chair in Quantum Computation

1. Quantum Computation and the Future Michele Mosca Canada Research Chair in Quantum Computation 13th CACR Information Security Workshop &5th Annual Privacy and Security Workshop 28 October 2004

2. Perimeter Institute is a community of theoretical physicists dedicated to investigating fundamental issues in theoretical physics. www.perimeterinstitute.ca

3. www.iqc.ca

4. Our Research

5. Outline What is quantum information processing? How does quantum mechanics affect computational assumptions? How else does quantum mechanics affect information security? Implementing quantum information processing.

6. Physics and Computation • Information is stored in a physical medium, and manipulated by physical processes. • The laws of physics dictate the capabilities of any information processing device. • Designs of “classical” computers are implicitly based in the classical framework for physics • Classical physics is known to be wrong or incomplete… and has been replaced by a more powerful framework: quantum mechanics.

7. Computer technology is making devices smaller and smaller… …reaching a point where classical physics is no longer a suitable model for the laws of physics.

8. The design of devices on such a small scale will require engineers to control quantum mechanical effects. Allowing computers to take advantage of quantum mechanical behaviour allows us to do more than cram increasingly many microscopic components onto a silicon chip… … it gives us a whole new framework in which information can be processed in fundamentally new ways.

9. A simple experiment in optics …consider a setup involving a photon source, a half-silvered mirror (beamsplitter), and a pairof photon detectors. detectors photon source beamsplitter

10. 50% 50% Now consider what happens when we fire a single photon into the device… Simplest explanation:beam-splitter acts as a classical coin-flip, randomly sending each photon one way or the other.

11. The “weirdness” of quantum mechanics… … consider a modification of the experiment… The simplest explanation for the modified setup would still predict a 50-50 distribution… 100% full mirror The simplest explanation is wrong!

12. 100% Explanation of experiment … consider a modification of the experiment… The simplest explanation for the modified setup would still predict a 50-50 distribution… full mirror

13. Any physical medium capable of representing 0 and 1 is in principle capable of storing any linear combination What does really mean?? Quantum mechanics and information It’s a “mystery”. THE mystery. We don’t understand it, but we can tell you how it works. (Feynman)

14. Any physical medium capable of representing 0 and 1 is in principle capable of storing any linear combination Quantum mechanics and information How does this affect computational complexity? How does this affect communication complexity? How does this affect information security?

15. How does quantum mechanics affect computation?

16. A small ‘classical’ computer NOT

17. A small ‘classical’ computer (negligible coupling to the environment)

18. A small ‘classical’ computer

19. Is this system reliable? • We do have a theory of classical linear error correction. • But before we worry about stabilizing this system, let’s push forward its capabilities.

20. A ‘quantum’ gate NOT NOT

21. A quantum circuit provides an visual representation of a quantum algorithm. initial state quantum gates measurement time

22. Quantum parallelism (cannot be feasibly simulated on a classical computer)

23. Applications • Simulating quantum mechanical systems • Factoring and Discrete Logs • Hidden subgroup problems • Amplitude amplification • and more…

24. Quantum Algorithms Integer Factorization (basis of RSA cryptography): Given N=pq, find p and q. Discrete logarithms (basis of DH crypto, including ECC): a,b G , ak = b , find k

25. Computational Complexity Comparison (in terms of number of group multiplications, for n-bit inputs)

26. Which cryptosystems are threatened by Quantum Computers?? Information security protocols must be studied in the context of quantum information processing. The following cryptosystems are insecure against such quantum attacks: • RSA (factoring) • Rabin-Williams (factoring) • ElGamal (discrete log… including ECC – see Proos and Zalka) • Goldwasser-Micali (factoring) • Buchmann-Williams (principal ideal distance problem) • And others… (see MMath thesis, Michael Brown, IQC)

27. Amplitude Amplification Consider any function f : X  {0,1}. Find x satisfying f(x)=1. Suppose algorithmAsucceeds with probabilityp. With classical methods, we expect to repeat A a total of time before finding a solution, since each application of A “boosts” the probability of finding a solution by roughly

28. Amplitude Amplification A quantum mechanical implementation ofAsucceeds with probability amplitude . With quantum methods, each application of A “boosts” the probability amplitude of finding a solution by roughly i.e. we get a square-root speedup!

29. Application of Amplitude Amplification: Searching a key space f (x)=1 if and only if x is the correct n-bit cryptographic key Find an x satisfying f(x)=1. Suppose algorithmAsucceeds with probabilityp=1/2n. We can iterateAandf times to find such anx. i.e. we need to roughly double our key lengths

30. Open problems include: • More non-Abelian HSP, including Graph Automorphism • Graph Isomorphism • Short vectors in a lattice • McEliece cryptosystem (NTRU recently cracked) • NP-complete problems • Several physics simulation problems • Many more…

31. How does quantum mechanics affect information security?

32. “No-cloning” theorem There is no procedure that will copy or “clone” an arbitrary quantum state, i.e. Such an operation is not linear, and is not permitted by quantum mechanics.

33. Eavesdropper detection Any attempts to produce pseudo-clones will be detected with significant probability. In general, any scheme to extract information about the state of a quantum system, will disturb the system in a way that can be detected with some probability. This idea motived Wiesner to invent quantum money around 1970. His work was ignored by the scientific community for a decade, until Bennett and Brassard built on these ideas to create quantum key distribution.

34. Quantum Key Distribution (general idea) quantum bits Alice and Bob measure their qubits Authenticated public channel

35. Quantum Key Distribution (general idea) Authenticated public channel Alice and Bob publicly discuss the information they measured to assess how much information Eve could have obtained. If Eve’s information is very likely to be below a certain constant threshold, they can communicate further and distill out a very private shared key (“privacy amplification”). Otherwise they abandon the key.

38. Wireless Sensor Networks • Injectable Tissue Engineering • Nano Solar Cells • Mechatronics • Grid Computing • Molecular Imaging • Nanoimprint Lithography • Software Assurance • Glycomics • Quantum Cryptography

39. Objections to the plausibility of large scale quantum computation?? “Change is bad”

40. is unpleasant Objections to the plausibility of quantum computation?? A=“Quantum Computers are realistic and are superpolynomially faster than any classical computer for some classical computation problem” B=“classical Strong Church-Turing thesis is false”

41. Implementations?

42. CLASSICAL QUANTUM |0 106 eV 10-6 eV 0 1 |1 • low energy • control of operations • superpositions are very fragile • isolation from environment Quantum Information is Fragile

43. Quantum Error Correction … allows quantum computation in the presence of noise. A quantum computation of any length can be made as accurate as desired, so long as the noise is below some threshold, e.g. P < 10-4. Significance: • imperfections and imprecision are not fundamental obstacles to building quantum computers • gives a criterion for scalability • guide for experimentalists • benchmark for comparing technologies

44. Proposed Devices for Quantum Computing • Atom traps • Cavity QED • Electron floating on helium • Electron trapped by surface acoustic waves • Ion traps • Nuclear magnetic resonance (NMR) • Quantum optics • Quantum dots • Solid state • Spintronics • Superconducting Josephson junctions • Etc…

45. When will these technologies be implemented? Quantum random number generators: now. Quantum key distribution: <10 years; some prototypes already available Small scale quantum computers (e.g. needed for long distance quantum communication): medium term • Large scale quantum computers: medium-long term

46. Conclusions • Quantum mechanics forces us to redefine the notions of information, information processing, and computational complexity. • Large scale quantum information processing seems possible, though technologically very challenging to realize; this is a major focus for experimental physics today

47. Implications for Quantum Information Security We must continually reassess the security of our existing information security infrastructure in light of the capabilities of quantum computers. We can exploit the eavesdropper detection that is intrinsic to quantum systems in order to derive new “unconditionally secure” information security protocols. The security depends only on the laws of physics, and not on computational assumptions. Challenge: Incorporating quantum cryptographic protocols and the prospect of quantum computing into the information security infrastructure.