Device-independent Quantum Key Distribution and Randomness Generation. Stefano Pironio Université Libre de Bruxelles

Transcription

1 Device-independent Quantum Key Distribution and Randomness Generation Stefano Pironio Université Libre de Bruxelles Tropical QKD, Waterloo, June 14-17, 2010

2 Device-independent security proofs establish security without assumptions on internal working of devices. x y a b

3 Device-independent QKD: Post-quantum or no-signalling QKD (BHK PRL 05) + Mayers,Yao 98 Acin et al PRL 07 Pironio et al NJP 09 McKague NJP 09 Masanes, Pironio, Acín, in preparation Valid against collective attacks Restricted to CHSH inequality Device-independent private RNG: Colbeck PhD 06 Pironio, Acín, Massar et al Nature 10

4 QUANTIFYING RANDOMNESS VS BELL VIOLATION

5 Quantifying randomness through min-entropy. x y a P(ab xy) b Given input x, the probability to guess a correctly is P G (x) = max a P(a x) Min-entropy: H min (A x) = -log 2 max a P(a x) If a in {0,1} : 0 H min (AB xy) 1 deterministic uniformly random

6 Quantifying randomness through min-entropy. x y a P(ab xy) b Given inputs (x,y), the probability to guess (a,b) correctly is P G (xy) = max ab P(ab xy) Min-entropy: H min (AB xy) = -log 2 max ab P(ab xy) If a,b in {0,1} : 0 H min (AB xy) 2 deterministic uniformly random

7 We want to find the minimal value of the minentropy compatible with a Bell violation I. x y a b We need to solve the optimization problem: amount of violation I is fixed i.e., No constraints on Hilbert space dimension!

8 The optimization problem can be solved using semidefinite programming. Q Q 3 Q 2 Q 1 Sequence of SDP relaxations Q i that approximate the quantum set Q. In the limit i, Q i Q, but usually convergence at finite i. Navascues, Pironio, Acin PRL 07 NJP 08

9 Bound for the CHSH inequality. Min-entropy Pironio, Acín, Massar et al, Nature 10 H min (A x) X H min (AB xy) Tisrelson bound, uniformly random Local bound, deterministic X CHSH Prohibited by QT!

10 For any Bell inequality, there exists a tradeoff between the violation and the output randomness :

11 APPLICATION TO DEVICE-INDEPENDENT QKD & RNG

12 ALICE x i QKD EVE BOB y i EVE x i RNG ALICE y i a i Repeat N times b i Repeat N times a i Repeat N times b i a=a 1...a n b=b 1...b n a=a 1...a n b=b 1...b n Estimate violation I on subset ( n) that is discarded Estimate violation I on subset ( n) k Error-correction privacy-amplification Key rate: H min (A XE) - H(A B) k Randomness extraction RNG rate: H min (AB XYE) r

13 They are two difficulties: x 1 y 1 a 1 x 2 b 1 y 2 1) Devices may behave differently from one round to the other in a way that depend on previous inputs and outputs (memory inside the devices). a 2 x n b 2 y n 2) We have to condition on the adversary s information E, who may be stored in a quantum memory. E a n b n

14 Current status of security proofs: QKD Masanes, Pironio, Acín, in preparation RNG Pironio, Acín, Massar et al, Nature 10 Devices are memoryless No restriction on adversary No restriction on devices Adversary has no quantum memory.

15 IS DEVICE-INDEPENDENCE PRACTICAL?

16 Device-independent security proofs rely on 3 assumptions. The two devices behave according to quantum theory. The inputs are generated through some initial randomness that is uncorrelated to the devices and unknown to the adversary. Separation/no-communication between devices: Alice s device does not use Bob s input to produce an output, and conversely. It is also implicit that every event is recorded, and thus that the detection loophole is closed. They represent minimal assumptions! (thus need also to be satisfied in usual QKD)

17 Device-independent proofs can be applied to two different adversarial scenarios. 1. The untrusted provider scenario: The devices have been built by the adversary itself! 2. The trusted provider scenario: The provider of the devices is honest. Even in this case, it is difficult to known if implementation is OK as it relies on many idealized assumptions. See work of Lo and Makarov.

18 Requirements for trusted-provider DI RNG. x y Eve a b Alice Security against Eve with quantum memory is not necessary! Existing security proof OK! Input randomness: no need to be crypto; pseudo-random OK. Separation between devices Detection loophole: better to be closed.

19 Current status of security proofs: QKD Masanes, Pironio, Acín, in preparation RNG Pironio, Acín, Massar et al, Nature 10 Devices are memoryless No restriction on adversary No restriction on devices Adversary has no quantum memory.

20 Requirements for trusted-provider DI RNG. x y Eve a b Alice Security against Eve with quantum memory is not necessary! Existing security proof OK! Input randomness: not critical, pseudo-random OK. Separation between devices Detection loophole: better to be closed.

21 Device-independent RNG has been realized in Chris Monroe lab Pironio, Acín, Massar et al, Nature random bits out of 3016 events in 1.5 month.

22 Requirements for trusted-provider DI QKD. Alice x a Eve y b Bob Existing security proof against Eve with quantum memory, but assuming no memory in devices. Is it sufficient? Input randomness: need good source of randomness. Separation between devices Detection loophole: better to be closed.

23 The transmission efficiency of a 5 km long optical fiber at telecom wavelength is roughly of 80%....but it can be overcome with a heralded qubit amplifier Gisin, Pironio, Sangouard, arxiv:

24 Is it OK for a cryptosystem to rely on physical assumptions if there is no test/guarantee that they are satisfied in the practical implementation? We should distinguish two types of assumptions: Assumptions that are absolutely necessary, can be easily tested, or can be satisfied if provider is honest. Focus on these ones Enforce through proper design Assumptions that are difficult to test, need detailed characterization, or may fail even if the provider is honest. (side-channels, detector attacks, errors and imperfections,...) (Experimentalist s job) Forget in the security proof (Theoretist s job)