Quantum Simultaneous Contract Signing

Quantum Simultaneous Contract Signing J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Paunkovic 22. October 2010 Based on work presented on AQIS 2010 J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 1 / 14

Outline Simultaneous Contract Signing - Problem Definition J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 2 / 14

Outline Simultaneous Contract Signing - Problem Definition Classical (Non-quantum) Protocols J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 2 / 14

Outline Simultaneous Contract Signing - Problem Definition Classical (Non-quantum) Protocols Quantum Simultaneous Contract Signing J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 2 / 14

Simultaneous Contract Signing Consider following scenario: Alice wants to buy 1000 bottles of red wine from Bob from this years production J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 3 / 14

Simultaneous Contract Signing Consider following scenario: Alice wants to buy 1000 bottles of red wine from Bob from this years production Traditionally Alice and Bob meet, and both sign two copies of a contract J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 3 / 14

Simultaneous Contract Signing Consider following scenario: Alice wants to buy 1000 bottles of red wine from Bob from this years production Traditionally Alice and Bob meet, and both sign two copies of a contract Each of them has a copy of a contract signed by the other side J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 3 / 14

Simultaneous Contract Signing Consider following scenario: Alice wants to buy 1000 bottles of red wine from Bob from this years production Traditionally Alice and Bob meet, and both sign two copies of a contract Each of them has a copy of a contract signed by the other side When a problem arises, both can contact judge and enforce the contract J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 3 / 14

Simultaneous Contract Signing Using Computers Asynchronous network causes problems: Alice uses signature scheme and sends signed contract to Bob. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 4 / 14

Simultaneous Contract Signing Using Computers Asynchronous network causes problems: Alice uses signature scheme and sends signed contract to Bob Bob uses signature scheme and sends signed contract to Alice. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 4 / 14

Simultaneous Contract Signing Using Computers Asynchronous network causes problems: Alice uses signature scheme and sends signed contract to Bob Bob uses signature scheme and sends signed contract to Alice What if Alice sent her signed contract but, didn t receive Bob s?. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 4 / 14

Simultaneous Contract Signing Using Computers Asynchronous network causes problems: Alice uses signature scheme and sends signed contract to Bob Bob uses signature scheme and sends signed contract to Alice What if Alice sent her signed contract but, didn t receive Bob s? Should Alice buy wine from another producer or wait until spring?. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 4 / 14

Classical Solutions It has been shown that the problem cannot be solved without additional assumptions. Two basic approaches: J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 5 / 14

Classical Solutions It has been shown that the problem cannot be solved without additional assumptions. Two basic approaches: Assume the same computational power J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 5 / 14

Classical Solutions It has been shown that the problem cannot be solved without additional assumptions. Two basic approaches: Assume the same computational power Assume existence of the trusted third party (Judge) Naive Solution: Alice sends signed contract to Judge J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 5 / 14

Classical Solutions It has been shown that the problem cannot be solved without additional assumptions. Two basic approaches: Assume the same computational power Assume existence of the trusted third party (Judge) Naive Solution: Alice sends signed contract to Judge Bob sends signed contract to Judge J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 5 / 14

Classical Solutions It has been shown that the problem cannot be solved without additional assumptions. Two basic approaches: Assume the same computational power Assume existence of the trusted third party (Judge) Naive Solution: Alice sends signed contract to Judge Bob sends signed contract to Judge When Judge collects both signed contracts, he resends them J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 5 / 14

Classical Solutions It has been shown that the problem cannot be solved without additional assumptions. Two basic approaches: Assume the same computational power Assume existence of the trusted third party (Judge) Naive Solution: Alice sends signed contract to Judge Bob sends signed contract to Judge When Judge collects both signed contracts, he resends them How to minimize communication with Judge? J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 5 / 14

Ben-Orr Protocol (simplified) Alice and Bob agree on a contract C. Protocol is probabilistic, message (C, p), (1 p 100) means, I agree with contract C with probability p. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 6 / 14

Ben-Orr Protocol (simplified) Alice and Bob agree on a contract C. Protocol is probabilistic, message (C, p), (1 p 100) means, I agree with contract C with probability p. Alice signs (C, 1) and sends it to Bob J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 6 / 14

Ben-Orr Protocol (simplified) Alice and Bob agree on a contract C. Protocol is probabilistic, message (C, p), (1 p 100) means, I agree with contract C with probability p. Alice signs (C, 1) and sends it to Bob Bob after receiving Alice s message signs (C, 1) and sends to Alice Alice after receiving signed message (C, p) signs (C, p + 1) and sends it to Bob Bob after receiving signed message (C, p) signs (C, p) and sends it to Alice J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 6 / 14

Ben-Orr Protocol (simplified) Alice and Bob agree on a contract C. Protocol is probabilistic, message (C, p), (1 p 100) means, I agree with contract C with probability p. Alice signs (C, 1) and sends it to Bob Bob after receiving Alice s message signs (C, 1) and sends to Alice Alice after receiving signed message (C, p) signs (C, p + 1) and sends it to Bob Bob after receiving signed message (C, p) signs (C, p) and sends it to Alice If Alice doesn t receive Bob s message, she contacts Judge and sends him the last received message (C, p A ). Judge randomly chooses n {1,..., 100}. The contract is valid if n < p A. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 6 / 14

Ben-Orr Protocol - analysis Protocol is optimistic - if everything goes according to the protocol, neither Alice nor Bob need to contact the Judge. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 7 / 14

Ben-Orr Protocol - analysis Protocol is optimistic - if everything goes according to the protocol, neither Alice nor Bob need to contact the Judge. Protocol is fair - At each stage of the protocol, the probability that the Judge will validate the contract after being contacted by either party is almost the same. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 7 / 14

Ben-Orr Protocol - analysis Protocol is optimistic - if everything goes according to the protocol, neither Alice nor Bob need to contact the Judge. Protocol is fair - At each stage of the protocol, the probability that the Judge will validate the contract after being contacted by either party is almost the same. Both Alice and Bob need to sign and send the contract 100 times (computational and communication complexity). J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 7 / 14

Qubit Qubit can be expressed as a vector: ϕ = α 0 + β 1 J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 8 / 14

Qubit Qubit can be expressed as a vector: ϕ = α 0 + β 1 0 and 1 form orthogonal basis and α, β are complex numbers, such that α 2 + β 2 = 1 J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 8 / 14

Qubit Qubit can be expressed as a vector: ϕ = α 0 + β 1 0 and 1 form orthogonal basis and α, β are complex numbers, such that α 2 + β 2 = 1 We can choose a different orthogonal basis, i.e. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 8 / 14

Qubit Qubit can be expressed as a vector: ϕ = α 0 + β 1 0 and 1 form orthogonal basis and α, β are complex numbers, such that α 2 + β 2 = 1 We can choose a different orthogonal basis, i.e. + = 1 2 ( 0 + 1 ) J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 8 / 14

Qubit Qubit can be expressed as a vector: ϕ = α 0 + β 1 0 and 1 form orthogonal basis and α, β are complex numbers, such that α 2 + β 2 = 1 We can choose a different orthogonal basis, i.e. + = 1 2 ( 0 + 1 ) = 1 2 ( 0 1 ) J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 8 / 14

Qubit Qubit can be expressed as a vector: ϕ = α 0 + β 1 0 and 1 form orthogonal basis and α, β are complex numbers, such that α 2 + β 2 = 1 We can choose a different orthogonal basis, i.e. + = 1 2 ( 0 + 1 ) = 1 2 ( 0 1 ) ϕ = α+β 2 + + α β 2 J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 8 / 14

Measurement Each projective measurement is associated with orthogonal basis { B 0, B 1 }. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 9 / 14

Measurement Each projective measurement is associated with orthogonal basis { B 0, B 1 } Projective measurement on a qubit ϕ is a question: Are you in state B 0 or B 1?. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 9 / 14

Measurement Each projective measurement is associated with orthogonal basis { B 0, B 1 } Projective measurement on a qubit ϕ is a question: Are you in state B 0 or B 1? If an arbitrary state ϕ = α B 0 + β B 1 is measured according to { B 0, B 1 }, the probability of the answer B 1 is α 2 and the probability of the answer B 2 is β 2. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 9 / 14

Measurement Each projective measurement is associated with orthogonal basis { B 0, B 1 } Projective measurement on a qubit ϕ is a question: Are you in state B 0 or B 1? If an arbitrary state ϕ = α B 0 + β B 1 is measured according to { B 0, B 1 }, the probability of the answer B 1 is α 2 and the probability of the answer B 2 is β 2 States and measurements used in our protocol:. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 9 / 14

Measurement Each projective measurement is associated with orthogonal basis { B 0, B 1 } Projective measurement on a qubit ϕ is a question: Are you in state B 0 or B 1? If an arbitrary state ϕ = α B 0 + β B 1 is measured according to { B 0, B 1 }, the probability of the answer B 1 is α 2 and the probability of the answer B 2 is β 2 States and measurements used in our protocol: 0 + 1 J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 9 / 14

Our Protocol - Predistribution Judge creates two random strings A, B of qubits from the set { 0, 1, +, } of length N. Then: Judge sends qubits A to Alice together with classical description B A of Bob s string B. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 10 / 14

Our Protocol - Predistribution Judge creates two random strings A, B of qubits from the set { 0, 1, +, } of length N. Then: Judge sends qubits A to Alice together with classical description B A of Bob s string B. Judge sends qubits B to Bob together with classical description A B of Alice s string A. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 10 / 14

Our Protocol - Predistribution Judge creates two random strings A, B of qubits from the set { 0, 1, +, } of length N. Then: Judge sends qubits A to Alice together with classical description B A of Bob s string B. Judge sends qubits B to Bob together with classical description A B of Alice s string A. Let us denote Acc the basis { 0, 1 } and Rej the basis { +, } J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 10 / 14

Our Protocol - Exchange Phase Alice and Bob first negotiate the contract C and agree on sets of qubits (A, B) they received from the Judge. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 11 / 14

Our Protocol - Exchange Phase Alice and Bob first negotiate the contract C and agree on sets of qubits (A, B) they received from the Judge. They exchange signed messages (C, (A, B)). This is to bind the sets of qubits with the contract being signed. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 11 / 14

Our Protocol - Exchange Phase Alice and Bob first negotiate the contract C and agree on sets of qubits (A, B) they received from the Judge. They exchange signed messages (C, (A, B)). This is to bind the sets of qubits with the contract being signed. To begin the signing procedure Alice measures her first qubit a 1 in Acc basis and sends a single bit o a,1 indicating the outcome to Bob. Bob after receiving o a,i from Alice checks, if it could be produced from Alice s qubit a i by Acc measurement. If yes, he measures his qubit b i in Acc basis and sends the outcome to Alice. If not, he remembers i, immediately stops the procedure, measures the rest of his qubits in Rej basis and contacts Judge with message (B, {o b,1,..., o b,n }, i). J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 11 / 14

Our Protocol - Binding Phase Judge after receiving a message (B, {o b,1,..., o b,n }, i B ), checks if all of the Bob s outcomes could be produced by the claimed measurements on Bob s qubits (i B indicates the switch from measuring in Acc basis to measuring Rej basis). If the outcomes are valid, the Judge contacts Alice and asks her for (A, {o a,1,..., o a,n }, i A ) and checks her outcomes.. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 12 / 14

Our Protocol - Binding Phase Judge after receiving a message (B, {o b,1,..., o b,n }, i B ), checks if all of the Bob s outcomes could be produced by the claimed measurements on Bob s qubits (i B indicates the switch from measuring in Acc basis to measuring Rej basis). If the outcomes are valid, the Judge contacts Alice and asks her for (A, {o a,1,..., o a,n }, i A ) and checks her outcomes. Judge generates random number 1 α N.. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 12 / 14

Our Protocol - Binding Phase Judge after receiving a message (B, {o b,1,..., o b,n }, i B ), checks if all of the Bob s outcomes could be produced by the claimed measurements on Bob s qubits (i B indicates the switch from measuring in Acc basis to measuring Rej basis). If the outcomes are valid, the Judge contacts Alice and asks her for (A, {o a,1,..., o a,n }, i A ) and checks her outcomes. Judge generates random number 1 α N. Contract is valid if α min{i A, i B }. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 12 / 14

Our Protocol - Analysis Our protocol is probabilistically optimistic. To cheat, Alice has to be able to provide Bob with valid outcomes of Acc measurement and the Judge with valid outcomes of Rej measurements. The probability that she is able to provide both decreases exponentially. Our protocol is fair. This is trivial, since both parties cooperate in binding phase. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 13 / 14

Our Protocol - Analysis Our protocol is probabilistically optimistic. To cheat, Alice has to be able to provide Bob with valid outcomes of Acc measurement and the Judge with valid outcomes of Rej measurements. The probability that she is able to provide both decreases exponentially. Our protocol is fair. This is trivial, since both parties cooperate in binding phase. Our protocol needs only one signature from both participants. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 13 / 14

Our Protocol - Analysis Our protocol is probabilistically optimistic. To cheat, Alice has to be able to provide Bob with valid outcomes of Acc measurement and the Judge with valid outcomes of Rej measurements. The probability that she is able to provide both decreases exponentially. Our protocol is fair. This is trivial, since both parties cooperate in binding phase. Our protocol needs only one signature from both participants. Each participant needs to send only N one bit messages. J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 13 / 14

Thank you for your attention. Any questions? J. Bouda, M. Pivoluska, L. Caha, P. Mateus, N. Quantum Paunkovic Simultaneous () Contract Signing 22. October 2010 14 / 14