Xiongfeng Ma Center for Quantum Information

Transcription

1 Xiongfeng Ma Center for Quantum Information 1

2 Outline Background Quantum entanglement and cryptography From EPR to entanglement Quantum cryptography Quantum coherence and randomness Coherence Intrinsic randomness and coherence 2

3 Cryptography 3

4 Information security National security Individual privacy 4

5 Cryptography Cryptography Science of encoding and decoding secret messages Cryptology Public key cryptosystem (such as RSA, Diffie-Hellman) Cryptanalysis Hacking Alice Bob 5

6 Cryptography in history 2000 BC War 6

7 Basic concepts Plaintext Message in its natural format readable by an attacker Ciphertext Message altered to be unreadable by anyone except the intended recipients Key Sequence that controls the operation and behavior of the cryptographic algorithm Cryptosystem Combination of algorithm, key, and key management functions used to perform cryptographic operations 7

8 Objectives Confidentiality Integrity Authenticity Nonrepudiation Access Control 8

9 Cryptographic Methods Symmetric Same key for encryption and decryption Key distribution problem E.g., DES, AES, IDEA, Blowfish, OTP, Asymmetric Mathematically related key pairs for encryption and decryption Public and private keys E.g., Diffie-Hellman, RSA, Hybrid Combines strengths of both methods Asymmetric distributes symmetric key, also known as a session key Symmetric provides bulk encryption Example: SSL negotiates a hybrid method 9

10 Private key cryptosystem One-time pad (OTP): proven secure by Shannon Alice and Bob share two identical keys secretly. Message Key Encode XOR Decode Counter example: like it or not? XOR Code Key Code Message Alice Key Distribution Bob 10

11 Cryptographic Key Identical Faithful decryption Private Secure communication At least as long as the message An efficient way to distribute key 11

12 Cryptanalysis The study of methods to break cryptosystems Often targeted at obtaining a key Attacks may be passive or active Kerckhoff s Principle The only secrecy involved with a cryptosystem should be the key Cryptosystem Strength How hard is it to determine the secret associated with the system? 12

13 Hacking Brute force attack Trying all key values in the keyspace Dictionary attack Find plaintext based on common words Factoring attack Find keys through prime factorization Quantum computer 13

14 Randomness: foundation of security Snowden s documents on random number generator backdoor On the Possibility of a Back Door in the NIST SP Dual Ec Prng We cannot trust Intel and Via s chip-based crypto, FreeBSD developers say Crypto requires information-theoretic randomness! 14

15 Why Quantum Cryptography 15

16 Conventional Cryptography Application framework Military and diplomatic applications E-Commercial Cryptosystem Computational assumptions (e.g., RSA crypto assumes factoring is hard) 16

17 What is wrong with conventional cryptography? Unanticipated Advances in Hardware and Algorithms. Quantum Code-breaking Cryptographers do not sleep well. Cryptography is for the paranoid. In history, every advance in code-making has been defeated by advances in code-breaking with disastrous consequences to users. 17

18 Unanticipated Advances in Hardware and Algorithms Code-breaking of Enigma led to fore-runners of computers German Enigma Machine 10 million billion possible combinations! Looked unbreakable. Allied code-breaking machine bombe Enigma Broken! 18

19 Quantum Code-breaking Shor s algorithm: Factoring is easy with a quantum computer! Quantum computing can efficiently break: RSA Discrete logarithm problem: Diffie-Hellman key exchange Elliptic-curve cryptographic systems If a quantum computer is ever built, much of conventional Cryptography will fall apart! (Brassard) 19

20 Forward security? Trade secrets and government secrets are kept as secrets for decades (say 70 years). A Big Problem RIGHT NOW: If adversary can factor in 2087, she can then decrypt all traffic sent today. (She can save all communications in 2017.) Was there any computer 70 years ago? What will a computer look like 70 years from now? It is ridiculous to think that we know the future 70 years from now. 20

21 ENIAC 1946 The world's first electronic digital computer 21

22 Cell phone

23 Computer in

24 Quantum Cryptography Application framework Military and diplomatic applications E-Commercial Cryptosystem Quantum Mechanics 24

25 Quantum Cryptography Cryptology (QKD): security proof, enhance the performance and security Cryptanalysis (hacking): attack a practical system 25

26 When shall we implement Kept secure: x Quantum crypto implementation: y Quantum computing: z [Mosca, ISACA Journal vol. 5 (2015)] 26

27 Quantum crypto is exciting! 27

28 28

29 Commercial Quantum Crypto Products available on the market a decade ago! MagiQ Tech, ID Quantique, QuantumTrek, QASKY, Very practical field 29

30 USA QKD network DARPA Battelle Smartgrid First field test of QKD network (2004) 30

31 Japan: Tokyo network The Tokyo QKD network is constructed in a part of the NICT open test-bed network "Japan Giga Bit Network 2 plus by the project teams consisting of nine research group from Japan and Europe (2015) 31

32 Mitsubishi: Quantum Communication Mobile phone Communication speed : 1 Kb/s Store 2 GB keys It is possible to talk for 10 days (240 hours) 32

33 Europe SECOQC Focused on development of a global network for secure communication based on quantum cryptography (2008) 33

34 Swiss election uses quantum cryptography 34

35 Switzerland Geneva network N. Gisin (2009)

36 South Africa Durban Quantum Network Distance 2.6 km~27 km First Quantum Network in Africa (2009) 36

37 Melbourne Quantum Network Melbourne established commercial Quantum Network Establish the network between space and ground Collaborate with NASA/JPL (2010) 37

38 China s Quantum Secure Backbone project Total Length 2000 km trustable relay nodes 31 fiber links Metropolitan networks Existing: Hefei, Jinan New: Beijing, Shanghai Customer: China Industrial & Commercial Bank; Xinhua News Agency; China Banking Regulatory Commission GDP 35.6% ($3 trillion) Population 25.8% (0.3 billion) Beijing Hefei Jinan Shanghai 38

39 Quantum Satellite First quantum satellite, Mozi 1:40am, August 16,

40 Back to science: Entanglement 40

41 Quantum state and measure State Describe a system: contains a full set of parameters in different degrees of freedoms Wave function (ray), density matrix Measure Observable: tools to obtain information Projection, POVM 41

42 Quantum intrinsic randomness Given a known system and a known measurement device, shall the outcome be predetermined? Einstein, God does not play dice! Bohr, Albert, stop telling God what to do! 42

43 Einstein-Podolsky-Rosen Paradox Is Quantum Mechanics complete? Local hidden variable Entanglement A pair of particles: measure on one particle would instantaneously affect the state of the other Spooky action at a distance 43

44 Bell s inequality Quantum mechanics vs. local hidden variable From wikipedia.org 44

45 Non-local game Two players, Alice and Bob, are space-like separated Alice (B0b) given a random bit, x (y), say, by the referee Alice (B0b) outputs a bit, a (b) They win the game if aa bb = xxxx Classical limit? Sc= Quantum limit? Sq= xx Alice aa yy Bob bb 45

46 EPR pairs in reality Various physical systems Alain Aspect 81: Bell s inequality experiment demo 46

47 Entanglement EPR pair 00>+ 11> = ++>+ --> Non-locality --- Entanglement Local hidden variable: been ruled out by Bell s inequality test Non-local correlation: why quantum mechanics is weird Natural source for secure key Strong correlation Randomness in nature Cannot be eavesdropped --- no local hidden variable EPR pair means perfect key 47

48 Quantum Teleportation Sci-Fi Instant transportation Teleport materials 48

49 Teleportation How to send a quantum state aa 1 + bb 1 faithfully? Classically, the values of aa and b are continuous, so it requires a large amount of information transmission Heisenberg s uncertainty principle What if Alice and Bob have a pre-shared entangled state? Only needs to transfer 2 classical bits 49

50 Quantum key distribution (QKD) 50

51 Quantum key distribution (QKD) BB84 (Bennett & Brassard 1984) Alice Bob X11X0 Eve X10X X11X0 0: 1:

52 A few observations Random keys are distributed via QKD systems Alice does not send messages directly Users can safely discard keys if they feel the channel is insecure without causing any security problem Secure keys are used in later cryptosystems: composable A successful attack by Eve Eve obtains non-trivial amount of information about the final key without Alice and Bob s notice If Alice and Bob do not end up with any secure key, the attack is a failure Channel is totally insecure Classical channel: authentication 52

53 Summary (take home message) QKD systems distribute keys QKD does not replace all the current cryptosystems QKD does not replace current communication systems An ideal private key Identical: Alice and Bob share the same key Private: Eve has no (or up to trivial amount of) information about the final key Post processing Error correction: all classical, e.g., Cascade, LDPC Privacy amplification: shorten the key so that Eve s information is eliminated; the focus of all security proofs 53

54 From entanglement to secure QKD 54

55 A quick review Prepare-and-measure protocols BB84, six-state Entanglement based protocols Ekert91, BBM92 Unconditional security proof Mayers (1996) Lo and Chau (1999) Shor and Preskill (2000) Devetak and Winter (2003), Renner (2005) Security analysis for QKD with imperfect devices E.g. Mayers, Lütkenhaus, ILM Koashi-Preskill Gottesman-Lo-Lütkenhaus-Preskill (GLLP) 55

56 Entanglement-based protocols BBM92 Alice (or Eve) prepares an EPR pair Ψ AAAA = Alice and Bob each measures one half of the pair Z basis measure (bit) 0 or 1 X basis measure (phase) or 0 1 Eve 56

57 Lo-Chau security proof I Lo and Chau, 1999 Entanglement distillation Distill perfect EPR pairs from imperfect ones Bell basis: 00>+ 11>, 01>+ 10>, 00>- 11>, 01>- 10> Objective: 00>+ 11> Bit errors (Z) 01>+ 10> Phase errors (X) 00>- 11> Both bit and phase errors (Y) 01>- 10> 57

58 Lo-Chau security proof II Bit error correction (Z: 0,1) Bit errors: 01>+ 10> and 01>- 10> After bit error correction: 00>+ 11> or 00>- 11> Phase error correction (X: +,-) Phase errors: 00>- 11> or 01>- 10> After phase error correction: 00>+ 11> or 01>+ 10> Share (almost) pure EPR pairs 00>+ 11> Measure in Z basis to get final key Almost perfect privacy (randomness) Security: think of teleportation 58

59 Shor-Preskill security proof I Shor and Preskill, 2000 Problem with Lo-Chau proof Requires quantum computers Reduce to prepare-and-measure schemes Put the final key measurement ahead before error corrections Commute operations in quantum mechanics Error correction: classical methods Privacy amplification: key point of all security proofs 59

60 Shor-Preskill security proof II Bit error correction becomes regular error correction Enables Alice and Bob shares identical keys H(bit error rate): Shannon entropy Phase error correction becomes privacy amplification Enables Alice and Bob shares private keys H(phase error rate): Shannon entropy Final key rate 1-H(bit error rate)-h(phase error rate) Symmetry of BB84 Between X and Z basis Basis-independent source: bit error rate=phase error rate 1-2H(QBER) Not optimal: can be enhanced by two-way LOCC 60

61 Post-processing Ma et al.,computers & Security 30, (2011) Fung, Ma, and Chau, Phys. Rev. A 81, (2010) N. Lütkenhaus, Phys. Rev. A 59, 3301 (1999): using error verification to replace error testing. Towards post-processing standard: SECOQC Workshop, Quantum Works QKD Meeting (Waterloo, Canada) Workshop, Finite-Size Effects in QKD (Singapore) 61

62 Quantum coherence and randomness Ma, Yuan, Cao, Qi, and Zhang, Quantum random number generation," npj Quantum Information 2, 16021, (2016) Streltsov, Adesso, and Plenio, Quantum Coherence as a Resource, arxiv: Yuan, Zhou, Cao, and Ma, Intrinsic randomness as a measure of quantum coherence," Phys. Rev. A 92, , (2015) 62

63 What is Coherence? Coherent interference Schrodinger s cat 63

64 Schrodinger s cat: a modern description Classical cat: ρρ cc = 1/2( ) ρρ cc = Quantum cat: ρρ qq (0,0) = 1/2( )( ) ρρ qq = The difference between a quantum and classical cat

65 Measure qubit coherence General quantum cat: ρρ qq αα, ββ = (sin αα 0 + ee iiii cos αα 1 )( 0 sin αα + 1 ee iiii cos αα) ρρ qq (αα, ββ) = 1 sin 2 αα ee iiii sin αα cos αα 2 ee iiii sin αα cos αα cos 2 αα There exists coherence as long as sin αα cos αα 0. A measure for coherence: ee iiii sin αα cos αα? How about mixed quantum state? Generally, CC ρρ = ii jj ρρ iiii?

66 Framework of quantum coherence d-dimensional Hilbert space Classical computational basis: I = Incoherent state is defined by dd δδ = pp ii ii ii ii=1 ii }, ii = 1, 2,, dd. And incoherent operation is defined by incoherent completely positive trace preserving (ICPTP) maps, Φ ICPTP ρρ = KK nn ρρkk nn where nn KK nn KK nn = II and nn KK nn δδkk nn = δδδ T. Baumgratz, M. Cramer, and M. B. Plenio PRL 113, (2014) nn

67 A framework of quantum coherence

68 Coherence measures Relative entropy of coherence CC rel.ent. ρρ = SS ρρ diag Off-diagonal elements (l1-norm): SS ρρ CC ll1 l2-norm: (C2b is violated) CC ll2 Coherence of formation ρρ = min δδ ρρ = min δδ ρρ, δδ ll1 = ii jj ρρ, δδ 2 ll2 = ii jj ρρ iiii ρρ iiii 2 CC CCCC ρρ = min pp ee CC II ( ψψ ee ) {pp ee, ψψ ee } ee where the minimum is runs over all possible decomposition of ρρ

69 Questions What is the operational meaning? From a resource perspective, what does coherence mean? 69

70 Quantum intrinsic randomness Einstein, God does not play dice! Bohr, Albert, stop telling God what to do! 70

71 Intrinsic randomness Debate between Einstein and Bohr Born s rule introduces intrinsic randomness in quantum measurement. Important quantum feature that differs from classical procedures Heisenberg s uncertainty principle Witnessed by Bell s tests 71

72 Intrinsic randomness of a measurement For a given quantum state ρρ, what is the genuine randomness in a fixed projective measurement? Key question in quantum random number generation 72

73 Intrinsic randomness: pure state Pure state: ψψ = ii aa ii ii. Measurement basis: II = ii }, ii = 1, 2,, dd. Probability of obtaining the iith outcome: pp ii = aa ii 2 Define the measurement outcome as random variable A, the output randomness can be quantified by RR II ( ψψ ψψ ) = HH AA = pp ii log 2 pp ii = SS(ρρ diag ) where ρρ diag is the density matrix that has only diagonal terms of in the computational basis I. ii

74 Intrinsic randomness: mixed state For a general mixed state, the measurement outcome randomness is mixed with classical randomness. Examples: ρρ 1 = + +, + = 0 + 1, ρρ diag 2 1 = II ρρ 2 =, = 0 1, ρρ diag 2 2 = II ρρ 3 = , ρρ diag = II SS(ρρ diag ) is not a proper measure for intrinsic randomness

75 Intrinsic randomness: mixed state Measurement outcome of Alice: A System of Eve: ρρ EE Prediction of Eve: E

76 Classical and quantum adversaries (a) Classical adversary, the correlated party perform measurement individually on ρρ EE (b) Quantum adversary: the correlated party perform joint measurement on different runs of her system ρρ EE

77 Intrinsic randomness: classical adversary Yuan, Zhou, Cao, and Ma, PRA 92, (2015)

78 Intrinsic randomness: classical adversary Intrinsic randomness for general quantum states RR II ρρ = min pp ee RR II ( ψψ ee ) {pp ee, ψψ ee } ee where the minimum runs over all possible decompositions of ρρ. (C1) classical states generate no randomness; (C1 ) any non-classical states can always be used to generate intrinsic randomness. (C2a) classical operations should not increase the randomness of a given state; (C2b) requires that the randomness cannot increase on average when probabilistic strategies are considered. (C3) randomness cannot increase on average by statistically mixing several states. Intrinsic randomness RR II ρρ measures the strength of coherence.

79 Intrinsic randomness for qubit states Pure state ψψ = αα 0 + ββ 1 RR zz ( ψψ ) = HH( αα 2 ) = HH( ββ 2 ) nn xx = ψψ σσ xx ψψ = αα ββ + ββ αα, nn yy = ψψ σσ yy ψψ = iiαα ββ + iiββ αα 1+ 1 nn xx 2 nn2 yy RR zz ( ψψ ) = HH 2 Mixed state: similar method of deriving entanglement of formation. RR zz (ρρ) = HH nn xx 2 nn yy 2 2

80 Intrinsic randomness: quantum adversary ψψ AAAA is a purification of ρρ ρρ AAAA = ii pp ii ii ii ρρ EE SS AA EE = CC rel.ent. ρρ = SS ρρ diag SS ρρ Relative entropy measure of coherence CC rel.ent. ρρ = HH nn zz+1 2 HH nn

81 Intrinsic randomness: qubit example Given ρρ vv = vv vv II/2, RR zz (ρρ) = HH 1+ 1 vv2 CC rrrrrr.eeeeee. ρρ = 1 HH vv+1 2 In general, there is a non-zero gap between the two quantum randomness measures, RR zz ρρ CC rrrrrr.eeeeee. ρρ 2 Yuan, Zhao, Girolami, Ma, arxiv.org/abs/

82 Quantum Discord as Quantum Randomness gap The state after Alice s measurement is ρρ AAAA = pp ii ii ii ρρ EE ii For a state ρρ AAAA, the discord is defined as DD BB ρρ AAAA = min SS AA qq qq BB ii BB SS AA, BB ρρ ρρaaaa + SS BB ρρaaaa AAAA ii Then, it is easy to verify that RR zz ρρ CC rrrrrr.eeeeee. ρρ = DD EE ρρ AAEE

83 Thank you! Xiongfeng Ma: *Xiao Yuan, Zhen Zhang, Jiajun Ma Qi Zhao: Hongyi Zhou: You Zhou: Pei Zeng: 83