Sampling of min-entropy relative to quantum knowledge Robert König in collaboration with Renato Renner TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: AAAAAAAAAAAAA

random access codes ? ? decoding probability for (random) subset time Ambainis, Nayak, Ta-Shma, Vazirani 99/Nayak 99 Ben-Aroya, Regev, de Wolf 07: measurement adaptive decoding probability for (random) subset ? time m-qubit state storage ? n coin tosses

Sampling min-entropy (pseudo) random subset time vs random access codes Claim: preservation of entropy-rate vs decoding probability (pseudo) random subset time arbitrary quantum state given : bound on entropy vs bounded number of qubits correlation random variables, large alphabet vs coin flips

Min-entropy and secret keys for classical-quantum states equal to extractable key length (also equal to guessing entropy: [K,Schaffner,Renner08]) Privacy amplification generates approximately [BBR88,BBCM95,Renner05] bits of secure key from partially secret raw key X, against adversary holding Q (optimal)

temporarily available Key expansion in the bounded storage model Sample-then-extract [Maurer92,….,Vadhan03] previously only analysed for classical adversary known to work against quantum adversary Source of randomness temporarily available resources insecure channel bits of key bits of key substring (sampled with S) substring (sampled with S) Privacy amplification Quantum storage qubits

Implication for the bounded storage model Sample-then-extract-approach for building locally computable extractors (Vadhan03) works against quantum adversaries! Ingredients: large source of randomness ( bits) short initial shared key ( bits) aim: generate bits of secure key Validity against quantum adversaries cannot be established using classical extractor properties only. [Gavinsky, Kempe, Kerenidis, Raz & de Wolf’06] key Sample: choose random subset Extract: ``standard’’ hashing Claim: seed for “sampler” seed for extractor

Main result: Sampling of min-entropy Sample: choose random subset (classical) (randomly chosen) subset of rephrased: if then large alphabet size c needed! “blockwise sampling” for any e.g., for Main result: for any state where

Why sampling (Shannon) entropy works There is a simple proof for sampling of Shannon entropy. Only uses Subadditivity Chain-rule repeated application of chain-rule splits joint entropy into sum of contributions random subset hits “good” parts with high probability large small

Why sampling (Shannon) entropy works There is a simple proof for sampling of Shannon entropy. Only uses Subadditivity Chain-rule repeated application of chain-rule splits joint entropy into sum of contributions random subset hits “good” parts with high probability large small subadditivity helps to remove dependence on variables not in subset chain-rule shows that is large

(Min)-entropy(-)rules subadditivity: chain-rule (recombination): Not true in general! chain-rule (splitting): Renato’s talk: recursive application of this rule impossible Need three rules for entropy-sampling argument to work. Two of these hold trivially. The third rule has to be replaced for min-entropy.

Entropy-splitting and recombining small large recombining splitting large entropy: distance to original state: Is a probability distribution General strategy for showing lower bound on smooth min-entropy Separate splitting and smooth entropy 1. construct orthogonal decomposition 2. choose high-entropy subset 3. show that is large Additional properties if split states constructed using eigendecomposition of conditional operator

(Min)-entropy(-)rules subadditivity: chain-rule (recombination): Not true in general! chain-rule (splitting): original state split states (Approximate) chain-rule for appropriately chosen (discrete) splitting!

Recursive splitting and recombining small large for a given subset choose high-entropy components

Conclusions/Application to BSM sampling preserves smooth min-entropy rate - application to the BSM: sample-then-hash approach achieves significant key expansion to general key extraction/qkd schemes: building block (aka “condenser”) for constructing randomness-efficient quantum extractors memory bits of shared key bits of shared key against an adversary with qubits

THE END Thank you for your attention!