Quantum to Classical Randomness Extractors

Transcription

1 Quantum to Classical Randomness Extractors Mario Berta, Omar Fawzi, Stephanie Wehner - Full version preprint available at arxiv: v3 08/23/ CRYPTO University of California, Santa Barbara

2 Outline (Classical to Classical) Randomness Extractors

3 Outline (Classical to Classical) Randomness Extractors Main Contribution: Quantum to Classical Randomness Extractors

4 Outline (Classical to Classical) Randomness Extractors Main Contribution: Quantum to Classical Randomness Extractors Application: Security in the oisy-storage Model

5 Outline (Classical to Classical) Randomness Extractors Main Contribution: Quantum to Classical Randomness Extractors Application: Security in the oisy-storage Model Entropic Uncertainty Relations with Quantum Side Information

6 Outline (Classical to Classical) Randomness Extractors Main Contribution: Quantum to Classical Randomness Extractors Application: Security in the oisy-storage Model Entropic Uncertainty Relations with Quantum Side Information Conclusions / Open Problems

7 Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Source = 1, 2,..., q

8 Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Source = 1, 2,..., q Ex: Pr[ 1 = 0] = , Pr[ 2 = 0] = ,...

9 Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Source = 1, 2,..., q Ex: Pr[ 1 = 0] = , Pr[ 2 = 0] = ,... Function: f( = 1,..., q )=M

10 Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Source = 1, 2,..., q Ex: Pr[ 1 = 0] = , Pr[ 2 = 0] = ,... Function: f( = 1,..., q )=M Ex: Pr[ i = 0] = 2 3 Pr[ i = 1] = 1 3 M = f( )= mod 2 Pr[M = 0] 0.52

11 Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Source = 1, 2,..., q Ex: Pr[ 1 = 0] = , Pr[ 2 = 0] = ,... Function: f( = 1,..., q )=M Ex: Pr[ i = 0] = 2 3 Pr[ i = 1] = 1 3 M = f( )= mod 2 Pr[M = 0] 0.52 Only minimal guarantee about the randomness of the source, high minentropy: H min () P = log max. n P (n) = log p guess () P

12 Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Source = 1, 2,..., q Ex: Pr[ 1 = 0] = , Pr[ 2 = 0] = ,... Function: f( = 1,..., q )=M Ex: Pr[ i = 0] = 2 3 Pr[ i = 1] = 1 3 M = f( )= mod 2 Pr[M = 0] 0.52 Only minimal guarantee about the randomness of the source, high minentropy: H min () P = log max. n P (n) = log p guess () P ot possible to obtain randomness using a deterministic function, invest a small amount of perfect randomness: f Seed M = f ()

13 Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Source = 1, 2,..., q Ex: Pr[ 1 = 0] = , Pr[ 2 = 0] = ,... Function: f( = 1,..., q )=M Ex: Pr[ i = 0] = 2 3 Pr[ i = 1] = 1 3 M = f( )= mod 2 Pr[M = 0] 0.52 Only minimal guarantee about the randomness of the source, high minentropy: H min () P = log max. n P (n) = log p guess () P ot possible to obtain randomness using a deterministic function, invest a small amount of perfect randomness: f Seed Lost randomness? Strong extractors: (M,) are jointly uniform. M = f ()

14 Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Source = 1, 2,..., q Ex: Pr[ 1 = 0] = , Pr[ 2 = 0] = ,... Function: f( = 1,..., q )=M Ex: Pr[ i = 0] = 2 3 Pr[ i = 1] = 1 3 M = f( )= mod 2 Pr[M = 0] 0.52 Only minimal guarantee about the randomness of the source, high minentropy: H min () P = log max. n P (n) = log p guess () P ot possible to obtain randomness using a deterministic function, invest a small amount of perfect randomness: f Seed Lost randomness? Strong extractors: (M,) are jointly uniform. Applications in information theory, cryptography and computational complexity theory [1,2]. M = f () [1] isan and Zuckerman, JCSS 52:43, 1996 [2] Vadhan,

15 Classical to Classical (CC)-Randomness Extractors (II) eal with prior knowledge (trivial for classical side information [3]), in general problematic for quantum side information [4]! Source described by classical-quantum (cq)- state: E = X n p n nihn n E. [3] König and Terhal, IEEE TIT 54:749, 2008 [4] Gavinsky et al., STOC, 2007

16 Classical to Classical (CC)-Randomness Extractors (II) eal with prior knowledge (trivial for classical side information [3]), in general problematic for quantum side information [4]! Source described by classical-quantum (cq)- state: E = X n p n nihn n E. f Mix iscard M E E k ME E = X n id p n nihn n E id M M Ek 1 apple " kxk 1 =tr[ p X X] [3] König and Terhal, IEEE TIT 54:749, 2008 [4] Gavinsky et al., STOC, 2007

17 Classical to Classical (CC)-Randomness Extractors (II) eal with prior knowledge (trivial for classical side information [3]), in general problematic for quantum side information [4]! Source described by classical-quantum (cq)- state: E = X n p n nihn n E. f Mix iscard M E E k ME E = X n id p n nihn n E id M M Ek 1 apple " kxk 1 =tr[ p X X] Guarantee about conditional min-entropy of the source: H min ( E) = log p guess ( E). [3] König and Terhal, IEEE TIT 54:749, 2008 [4] Gavinsky et al., STOC, 2007

18 Classical to Classical (CC)-Randomness Extractors (II) eal with prior knowledge (trivial for classical side information [3]), in general problematic for quantum side information [4]! Source described by classical-quantum (cq)- state: E = X n p n nihn n E. f Mix iscard M E E k ME E = X n id p n nihn n E id M M Ek 1 apple " kxk 1 =tr[ p X X] Guarantee about conditional min-entropy of the source: H min ( E) = log p guess ( E). Ex: Two-universal hashing / privacy amplification [5]. For all cq-states E with, we have for M =2 k " 2. id M H min ( E) k k ME M Ek 1 apple " Strong (k, ") extractor (against quantum side information), = O(). [3] König and Terhal, IEEE TIT 54:749, 2008 [4] Gavinsky et al., STOC, 2007 [5] Renner, Ph Thesis, ETHZ, 2005

19 Quantum to Classical (QC)-Randomness Extractors - efinition (I) Motivation: How to get weak randomness at first? How much randomness can be gained from a quantum source?

20 Quantum to Classical (QC)-Randomness Extractors - efinition (I) Motivation: How to get weak randomness at first? How much randomness can be gained from a quantum source? E E Measure M Mix id M Measurement iscard k ME id M M Ek 1 apple " M E

21 Quantum to Classical (QC)-Randomness Extractors - efinition (I) Motivation: How to get weak randomness at first? How much randomness can be gained from a quantum source? E E Measure M Mix id M Measurement iscard k ME id M M Ek 1 apple " M E Idea: Same setup as in the classical case (no control of the source)! Only guarantee about the conditional min-entropy [6]: X H min ( E) = log max E! 0 F ( 0, (id E! 0)( E )) i 0 = 1 p n=1 F (, )=k p p k 2 1 ni ni 0 [6] König et al., IEEE TIT 55:4674, 2009

22 Quantum to Classical (QC)-Randomness Extractors - efinition (I) Motivation: How to get weak randomness at first? How much randomness can be gained from a quantum source? E E Measure M Mix id M Measurement iscard k ME id M M Ek 1 apple " M E Idea: Same setup as in the classical case (no control of the source)! Only guarantee about the conditional min-entropy [6]: X H min ( E) = log max E! 0 F ( 0, (id E! 0)( E )) i 0 = 1 p Can get negative for entangled input states, in fact for MES: H min ( E) = log. [6] König et al., IEEE TIT 55:4674, 2009 n=1 F (, )=k p p k 2 1 ni ni 0

23 Quantum to Classical (QC)-Randomness Extractors - efinition (II) Mix Meas. (M, \M ) isc. M

24 Quantum to Classical (QC)-Randomness Extractors - efinition (II) Mix Meas. (M, \M ) isc. M U d!m (.) = X m2m,j2 \M hmj (.) mji mihm M

25 Quantum to Classical (QC)-Randomness Extractors - efinition (II) Mix Meas. (M, \M ) isc. M U d!m (.) = X m2m,j2 \M hmj (.) mji mihm M efinition: A set of unitaries {U 1,...,U } defines a strong (k, ") qc-extractor (against quantum side information) if for any state E with H min ( E) k, k 1 X!M (U i E U i ) iihi i=1 id M M Ek 1 apple ".

26 Quantum to Classical (QC)-Randomness Extractors - efinition (II) Mix Meas. (M, \M ) isc. M U d!m (.) = X m2m,j2 \M hmj (.) mji mihm M efinition: A set of unitaries {U 1,...,U } defines a strong (k, ") qc-extractor (against quantum side information) if for any state E with H min ( E) k, k 1 X!M (U i E U i ) iihi i=1 id M M Ek 1 apple ". Without side information, this corresponds to -metric uncertainty relations [7]. " [7] Fawzi et al., STOC, 2011

27 Quantum to Classical (QC)-Randomness Extractors - efinition (II) Mix Meas. (M, \M ) isc. M U d!m (.) = X m2m,j2 \M hmj (.) mji mihm M efinition: A set of unitaries {U 1,...,U } defines a strong (k, ") qc-extractor (against quantum side information) if for any state E with H min ( E) k, k 1 X!M (U i E U i ) iihi i=1 Without side information, this corresponds to -metric uncertainty relations [7]. Fully quantum versions of this: decoupling theorems (quantum coding theory) [8], quantum state randomization [9], quantum extractors [10]: quantum to quantum (qq)-randomness extractors! id M M Ek 1 apple ". " M [7] Fawzi et al., STOC, 2011 [8] upuis, Ph Thesis, McGill, 2009 [9] Hayden et al., CMP 250:371, 2004 [10] Ben-Aroya et al., TOC 6:47, 2010

28 Quantum to Classical (QC)-Randomness Extractors - Parameters Mix Meas. (M, \M ) isc. M U i Probabilistic construction (random unitaries).

29 Quantum to Classical (QC)-Randomness Extractors - Parameters Mix Meas. (M, \M ) isc. M U i Output size: M =min{, 2 k 4 } Seed size: = M log " 4 Probabilistic construction (random unitaries).

30 Quantum to Classical (QC)-Randomness Extractors - Parameters Mix Meas. (M, \M ) isc. M U i Output size: M =min{, 2 k 4 } Seed size: = M log " 4 Converse bounds. Probabilistic construction (random unitaries).

31 Quantum to Classical (QC)-Randomness Extractors - Parameters Mix Meas. (M, \M ) isc. M U i Output size: M =min{, 2 k 4 } Seed size: = M log " 4 Converse bounds. Probabilistic construction (random unitaries). Output size:, where (smooth entropies [5,11]). Seed size: " 1 M apple 2 k " 2 k " = H min( E) " = max H min( E) 2B " ( ) [5] Renner, Ph Thesis, ETHZ, 2005 [11] Tomamichel, Ph Thesis ETHZ, 2012

32 Quantum to Classical (QC)-Randomness Extractors - Parameters Mix Meas. (M, \M ) isc. M U i Output size: M =min{, 2 k 4 } Seed size: = M log " 4 Converse bounds. Probabilistic construction (random unitaries). Output size:, where (smooth entropies [5,11]). Seed size: " 1 M apple 2 k " 2 k " = H min( E) " = max H min( E) 2B " ( ) Huge gap! We know that our proof technique can only yield " 2 min{ 2 k 1,M/4} [12]. [5] Renner, Ph Thesis, ETHZ, 2005 [11] Tomamichel, Ph Thesis ETHZ, 2012 [12] Fawzi, Ph Thesis, McGill, 2012

33 Quantum to Classical (QC)-Randomness Extractors - Parameters Mix Meas. (M, \M ) isc. M U i Output size: M =min{, 2 k 4 } Seed size: = M log " 4 Converse bounds. Probabilistic construction (random unitaries). Output size:, where (smooth entropies [5,11]). Seed size: " 1 M apple 2 k " 2 k " = H min( E) " = max H min( E) 2B " ( ) Find explicit constructions! Huge gap! We know that our proof technique can only yield " 2 min{ 2 k 1,M/4} [12]. [5] Renner, Ph Thesis, ETHZ, 2005 [11] Tomamichel, Ph Thesis ETHZ, 2012 [12] Fawzi, Ph Thesis, McGill, 2012

34 Quantum to Classical (QC)-Randomness Extractors - Explicit Constructions Mix Meas. (M, \M ) isc. M U i

35 Quantum to Classical (QC)-Randomness Extractors - Explicit Constructions Mix Meas. (M, \M ) isc. M U i (Almost) unitary two-designs reproduce second moment of random unitaries [8,13]: M =min{, 2 k 2 } = O( 4 ) [8] upuis, Ph Thesis, McGill, 2009 [13] Szehr et al., arxiv: v1

36 Quantum to Classical (QC)-Randomness Extractors - Explicit Constructions Mix Meas. (M, \M ) isc. M U i (Almost) unitary two-designs reproduce second moment of random unitaries [8,13]: M =min{, 2 k 2 } = O( 4 ) Set of unitaries defined by a full set of mutually unbiased bases together with two-wise independent permutations: M =min{, 2 k 2 } = ( + 1) 2 [8] upuis, Ph Thesis, McGill, 2009 [13] Szehr et al., arxiv: v1

37 Quantum to Classical (QC)-Randomness Extractors - Explicit Constructions Mix Meas. (M, \M ) isc. M U i (Almost) unitary two-designs reproduce second moment of random unitaries [8,13]: M =min{, 2 k 2 } = O( 4 ) Set of unitaries defined by a full set of mutually unbiased bases together with two-wise independent permutations: M =min{, 2 k 2 } = ( + 1) 2 Bitwise qc-extractors! Let =2 n,m =2 m. Set of unitaries defined by a full set of mutually unbiased bases for each qubit, { X, Y, Z} n, together with two-wise independent permutations: M = O( log 3 1 " 4 ) min{1, 2 k } = ( 1) 3 log [8] upuis, Ph Thesis, McGill, 2009 [13] Szehr et al., arxiv: v1

38 Application: Two-Party Cryptography Example: secure function evaluation. x y f f(x,y)

39 Application: Two-Party Cryptography Example: secure function evaluation.?????? x y f Should not learn y f(x,y) Should not learn x

40 Application: Two-Party Cryptography Example: secure function evaluation.?????? x y f Should not learn y ot possible to solve without assumptions [17]. f(x,y) Should not learn x [17] Lo, PRA 56:1154, 1997

41 Application: Two-Party Cryptography Example: secure function evaluation.?????? x y f f(x,y) Should not learn x Should not learn y ot possible to solve without assumptions [17]. Classical assumptions are typically computational assumptions (e.g. factoring is hard). [17] Lo, PRA 56:1154, 1997

42 Application: Two-Party Cryptography Example: secure function evaluation.?????? x y f Should not learn y ot possible to solve without assumptions [17]. f(x,y) Should not learn x Classical assumptions are typically computational assumptions (e.g. factoring is hard). Physical assumption: bounded quantum storage [18], secure function evaluation becomes possible [19]. [17] Lo, PRA 56:1154, 1997 [18] amgård et al., CRYPTO, 2007 [19] König et al., IEEE TIT 58:1962, 2012

43 Application: Security in the oisy- Storage Model [20] What the adversary can do: computationally all powerful, unlimited classical storage, actions are instantaneous, BUT noisy (bounded) quantum storage. [20] Wehner et al., PRL 100:220502, 2008

44 Application: Security in the oisy- Storage Model [20] What the adversary can do: computationally all powerful, unlimited classical storage, actions are instantaneous, BUT noisy (bounded) quantum storage. [20] Wehner et al., PRL 100:220502, 2008

45 Application: Security in the oisy- Storage Model [20] What the adversary can do: computationally all powerful, unlimited classical storage, actions are instantaneous, BUT noisy (bounded) quantum storage. Basic idea: protocol will have have waiting times, in which noisy storage must be used! [20] Wehner et al., PRL 100:220502, 2008

46 Application: Security in the oisy- Storage Model [20] What the adversary can do: computationally all powerful, unlimited classical storage, actions are instantaneous, BUT noisy (bounded) quantum storage. Basic idea: protocol will have have waiting times, in which noisy storage must be used! Implement task weak string erasure (sufficient [21]). Using bitwise qc-randomness extractors, we can link security to the entanglement fidelity (quantum capacity) of the noisy quantum storage (improves [19,22])! [20] Wehner et al., PRL 100:220502, 2008 [21] Kilian, STOC, 1998 [19] König et al., IEEE TIT 58:1962, 2012 [22] B. et al., IEEE ISIT, 2012

47 Entropic Uncertainty Relations with Quantum Side Information Review article [14]. Given a quantum state these relations usually take the form (where H(K ) = 1 X H(K i = i) const(k). i=1 {K 1,...,K } H(.) and a set of measurements denotes e.g. the Shannon entropy): [14] Wehner and Winter., JP 12:025009, 2010

48 Entropic Uncertainty Relations with Quantum Side Information Review article [14]. Given a quantum state these relations usually take the form (where H(K ) = 1 {K 1,...,K } H(.) and a set of measurements denotes e.g. the Shannon entropy): Idea of [15]: add quantum side information! Start with a bipartite quantum state and a set of measurements {K 1,...,K } on A: H(K E)= 1 here H(A) = tr[ A log A ], the von eumann entropy, and its conditional version H(A B) = H(AB) X H(K i = i) const(k). i=1 X H(K i E = i) const(k)+h(a E), i=1 H(B) (which can get negative for entangled input states!). AE [14] Wehner and Winter., JP 12:025009, 2010 [15] B. et al., P 6:659, 2010

49 Entropic Uncertainty Relations with Quantum Side Information Review article [14]. Given a quantum state these relations usually take the form (where H(K ) = 1 {K 1,...,K } H(.) and a set of measurements denotes e.g. the Shannon entropy): Idea of [15]: add quantum side information! Start with a bipartite quantum state and a set of measurements {K 1,...,K } on A: H(K E)= 1 here H(A) = tr[ A log A ], the von eumann entropy, and its conditional version H(A B) = H(AB) X H(K i = i) const(k). i=1 X H(K i E = i) const(k)+h(a E), i=1 H(B) (which can get negative for entangled input states!). QC-extractors (against quantum side information) give entropic uncertainty relations with quantum side information! Entropic uncertainty relations with quantum side information together with ccextractors give qc-extractors (against quantum side information) [16]! AE [14] Wehner and Winter., JP 12:025009, 2010 [15] B. et al., P 6:659, 2010 [16] B./Wehner/Coles, unpublished

50 Conclusions / Open Problems efinition of quantum to classical (qc)-randomness extractors. Probabilistic and explicit constructions as well as converse bounds. Security in the noisy-storage model linked to the quantum capacity. Close relation to entropic uncertainty relations with quantum side information.

51 Conclusions / Open Problems efinition of quantum to classical (qc)-randomness extractors. Probabilistic and explicit constructions as well as converse bounds. Security in the noisy-storage model linked to the quantum capacity. Close relation to entropic uncertainty relations with quantum side information. Relation between qq-, qc-, and cc-extractors?

52 Conclusions / Open Problems efinition of quantum to classical (qc)-randomness extractors. Probabilistic and explicit constructions as well as converse bounds. Security in the noisy-storage model linked to the quantum capacity. Close relation to entropic uncertainty relations with quantum side information. Relation between qq-, qc-, and cc-extractors? Seed length:. We believe that at least = polylog() might be possible (cf. cc-extractors against quantum side information [23]). However, our proof technique can only yield " 2 min{ 2 k 1,M/4}[12]. " 1 apple apple M log " 4 [23] Ve et al., arxiv: v3 [12] Fawzi, Ph Thesis, McGill, 2012

53 Conclusions / Open Problems efinition of quantum to classical (qc)-randomness extractors. Probabilistic and explicit constructions as well as converse bounds. Security in the noisy-storage model linked to the quantum capacity. Close relation to entropic uncertainty relations with quantum side information. Relation between qq-, qc-, and cc-extractors? Seed length:. We believe that at least = polylog() might be possible (cf. cc-extractors against quantum side information [23]). However, our proof technique can only yield " 2 min{ 2 k 1,M/4}[12]. " 1 apple apple M log " 4 Bitwise qc-randomness extractor for { X, Z} n (BB84) encoding? Improve bound for { X, Y, Z} n (six-state) encoding for large n? [23] Ve et al., arxiv: v3 [12] Fawzi, Ph Thesis, McGill, 2012