Cryptography in the Bounded-Quantum-Storage Model Christian Schaffner BRICS, University of Aarhus PhD Defense Friday, April 27 th 2007

2 / 38 Agenda  Motivation, Bit Commitment (BC)  Classical Protocol for BC  Quantum Effects  Quantum Protocol for BC  Conclusion

3 / 38 Alice & Bob Alice Bob *!¤

4 / 38 Alice Bob who gets the house? *!¤ Divorce Problems

5 / 38 Bad Bob Bob Coin-Flipping over the Telephone Alice [ B l um 82 ] It’s tails, I get the house!

6 / 38 A Coin-Flipping Protocol Alice Bob not random! Bad Bob

7 / 38 The Solution Alice Bob

8 / 38 The Explanation Alice Bad Bob

9 / 38 The Explanation Bob Bad Alice

10 / 38 Bob‘s view Bit-Commitment (BC) Scheme Alice Bob commit open important cryptographic primitive hiding binding Bad Bob Bad Alice

11 / 38 Agenda Motivation, Bit Commitment (BC)  Classical Protocol for BC  Quantum Effects  Quantum Protocol for BC  Conclusion

12 / 38 BC Impossible From Scratch perfectly secure, no assumptions (unbounded time and memory) with classical communication with quantum communication Alice Bob Bob‘s view open commit hiding binding bounded memory! [ M ayers 96, L o C h au 96 ]

13 / 38 Bob‘s view A Classical Bit-Commitment Protocol commit to 0: …01 Alice Bob bounded memory! (100 GB) commit to 1: …11 (100 GB each) perfectly hiding: non-interactive! binding? open: a checks correctness …11

14 / 38 Bob‘s view A Classical Bit-Commitment Protocol commit to 0: …01 Alice Bob commit to 1: …11 (n bits each) honest Alice needs n bits of memory Theorem: binding against cheating Alice with less than 2 ¢ n bits of memory bounded memory! open: a checks correctness …11

15 / 38 Bob‘s view A Classical Bit-Commitment Protocol commit to 0: …01 Alice Bob commit to 1: …11 (n bits each) honest Alice needs n bits of memory Theorem: binding against cheating Alice with less than 2 ¢ n bits of memory bounded memory! open: a checks correctness …11 unrealistic assumption: difficult to store classical bits only twice the honest player’s memory is required to break protocol

16 / 38 Bob‘s view A Quantum Bit-Commitment Protocol Alice Bob commit to 0: …01 commit to 1: …11 (n bits each) honest Alice needs n bits of memory Theorem: binding against cheating Alice with less than 2 ¢ n bits of memory bounded memory! open: a checks correctness …11 n quantum bits bounded quantum memory!

17 / 38 honest Alice needs n bits of memory Theorem: binding against cheating Alice with less than 2 ¢ n bits of memory Bob‘s view Quantum Bit-Commitment Protocol Alice Bob bounded quantum memory! n quantum bits no quantum bits (qubits) n/2 qubits open: a checks correctness …11

18 / 38 Agenda Motivation, Bit Commitment (BC) Classical Protocol for BC  Quantum Effects  Quantum Protocol for BC  Conclusion

19 / 38 Quantum Bit: e.g. Polarization of Light qu b i t asun i t vec t or i n C 2

20 / 38 j 0 i + j 1 i + qu b i t asun i t vec t or i n C 2 Qubit: Rectilinear Basis j 0 i + j 1 i +

21 / 38 j 0 i + j 1 i + j 0 i + qu b i t asun i t vec t or i n C 2 Detecting a Qubit Alice Bob no photon: 0 j 0 i + j 1 i +

22 / 38 j 0 i + j 1 i + j 0 i + qu b i t asun i t vec t or i n C 2 Measuring a Qubit Alice Bob no photon: 0 photon: 1 with prob. 1 yields 1 Measurement: j 0 i + j 1 i +

23 / 38 qu b i t asun i t vec t or i n C 2 Diagonal Basis j 1 i £ j 0 i £ j 0 i + j 1 i + j 0 i £ with prob. ½ yields 0 with prob. ½ yields 1 j 0 i + j 1 i + j 1 i £ Measurement:

24 / 38 qu b i t asun i t vec t or i n C 2 Quantum Effects j 1 i £ j 0 i £ j 0 i + j 1 i + with prob. ½ yields 0 with prob. ½ yields 1 Measurement:

25 / 38 qu b i t asun i t vec t or i n C 2 Quantum Effects j 1 i £ j 0 i £ j 0 i + j 1 i + with prob. ½ yields 0 with prob. ½ yields 1 Measurement:

26 / 38 Quantum Mechanics with prob. 1 yields 1 Measurements: + basis £ basis j 0 i + j 1 i + j 1 i £ j 0 i £ with prob. ½ yields 0 with prob. ½ yields 1

27 / 38 Agenda Motivation, Bit Commitment (BC) Classical Protocol for BC Quantum Effects  Quantum Protocol for BC  Conclusion

28 / 38 Quantum Bit-Commitment Protocol n quantum bits bounded quantum memory! picks at random:

29 / 38 Quantum Bit-Commitment Protocol n quantum bits picks at random: open: 11010

30 / 38 Quantum Bit-Commitment Protocol n quantum bits picks at random: open: accept

31 / 38 Quantum Bit-Commitment Protocol n quantum bits picks at random: open: accept measurement upon reception honest players need no quantum memory

32 / 38 Bob‘s view Cheating Bob: Hiding? n quantum bits picks at random: open: / perfectly hiding: non-interactive!

33 / 38 Cheating Alice: Binding? n quantum bits picks at random: open: / measuring destroys information with quantum memory: easy to cheat! bounded quantum memory!

34 / 38 Cheating Alice: Binding? n quantum bits picks at random: bad Alice does not know encoding bases needs to compress ) destroys information Theorem: binding as long as # qubits < n/2 open: / [ D amg º ar d F e h r S a l va i l S c h a ® ner 05 ]

35 / 38 Agenda Motivation, Bit Commitment (BC) Classical Protocol for BC Quantum Effects Quantum Protocol for BC  Conclusion

36 / 38 Summary Motivation:  Coin-Flipping over Telephone  Bit Commitment (BC) protocol for BC: perfectly hiding, binding for memory-bounded Alice classical: unpractical assumptions Bounded-Quantum-Storage Model:  showed quantum effects  BC: better parameters, practical!

37 / 38 QUSEP Project: Alice Bob

38 / 38 The End Alice bounded quantum memory! Bob bounded quantum memory! *!¤