Serge Fehr & Christian Schaffner CWI Amsterdam, The Netherlands 1 Randomness Extraction via ± -Biased Masking in the Presence of a Quantum Attacker TCC 2008, 21/3/2008 New York, USA TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: A A AAAA A A A A

Agenda 2 Motivation Main Result Applications Related Work

3 X= … Z =10011… Key K X= … random source Motivating Example

4 X= … Z =10011… Key K X= … F(X)= H 1 (X|KZ) ¸ m Key K 2-universal F(X)=? Left-Over Hash Lemma F(X)= m F Key K can be reused!

5 Z =10011… imperfect random source X= … Key K X’= … Imperfect Source

Information Reconciliation 6 X= … Key K X’= … Z =10011… F(X)= decode C’ = Y © X’ Y = X © C F(X)=? C 2 R C X= … Key K H 1 (X|KZ) ¸ m + |syn(X)|

Reusability Problem 7 X= … Key K X’= … Z =10011… F(X)= decode C’ = Y © X’ Y = X © C F(X)=? C 2 R C X= … Key K H 1 (X|KZ) ¸ m + |syn(X)| Problem: K cannot be reused!

Solution 8 X= … Key K X’= … Z =10011… decode C’ = Y © X’ Y = X © C C 2 R C X= … Key K H 1 (X|KZ) ¸ m + |syn(X)| K can be safely reused! Y = ? [Dodis, Smith 05]

The Quantum Case 9 ρZρZ imperfect random source X= … Key K X’= … 101…

Two-Universal Hashing 10 X= … Key K X’= … F(X)= decode C’ = Y © X’ Y = X © C F(X)=? C 2 R C X= … Key K H 1 (X|K ρ Z ) ¸ m + |syn(X)| ρZρZ 101…

Problem 11 X= … Key K X’= … decode C’ = Y © X’ Y = X © C C 2 R C X= … Key K H 1 (X|K ρ Z ) ¸ m + |syn(X)| K can be safely reused! Y = ? [Dodis, Smith 05] ρZρZ ? 101…

Agenda 12 Motivation Main Result Applications Related Work

Classical Theorem 13 random variable A in {0,1} n is ± -biased if for all {A i } ± -biased family over {0,1} n joint distribution P XZ where X in {0,1} n and Z some side information Then, for uniform I [Dodis, Smith 05] {0,1} n © = Z I,I, A I © X = ?

Main Theorem 14 random variable A in {0,1} n is ± -biased if for all {A i } ± -biased family over {0,1} n joint quantum-state ρ XZ where X in {0,1} n and Z some quantum side information Then, for uniform I I, ρ Z © = A I © X = ? {0,1} n

Proof Technique 15 random variable A in {0,1} n is ± -biased if for all {A i } ± -biased family over {0,1} n Joint quantum-state ρ XZ where X in {0,1} n and Z some quantum side information Then, for uniform I I, ρ Z A I © X = ? Proof: quantum-information theory Fourier-analysis of matrix-valued functions over {0,1} n {0,1} n

16 [Alon, Goldreich, Håstad, Peralta 90] ± -biased set K over {0,1} n of size |K|=O(n 2 / ± 2 ) joint quantum-state ρ XZ where X n-bit message and Z some quantum side information ρZρZ K © X=? Application: Entropic Encryption Then, for uniform I if H 1 ( ρ XZ |Z) ¸ t, then a key size of log |K|= n - t +2 log(n)+2 log(1/ ² ) + O(1) suffices to encrypt X

17 For any ε ¸ 0 and 0 · t · n, there exists a (t,ε)-weak quantum extractor with n-bit output and seed length n - t +2 log(n)+2 log(1/ε) + O(1) ρZρZ K © X=? Weak Extractor Then, for uniform I if H 1 ( ρ XZ |Z) ¸ t, then a key size of log |K|= n - t +2 log(n)+2 log(1/ ² ) + O(1) suffices to encrypt X

Application: Private Error Correction 18 [Dodis, Smith 05] for every 0 < λ < 1, there is a family of binary linear codes {C i } of length n, correcting a linear fraction of errors, and {C i } is δ < 2 -λn/2 -biased Joint quantum-state ρ XZ where X in {0,1} n and Z some quantum side information with H 1 (ρ XZ |Z) ¸ t Then, for uniform I I, ρ Z C I © X =?

Agenda 19 Motivation Main Result Applications Related Work

Randomness Extraction against Q-Memory 20 [König, Renner, Maurer 03] 2-universal hashing [König, Terhal 06] 1-bit-output extractors [this work 06] ± -biased masking [Smith 07] Srinivasan-Zuckerman extractors [König, Renner 07] Sampling min-entropy relative to quantum knowledge F Ext C I © X = ? || ρ XZ || 2 H 1 (X 1 X 2 … X n |ρ Z ) = α ) H 1 (X r 1 X r 2 … X r s |ρ Z ) ¸ α s/n

Related work 21 [Gavinsky, Kempe, Kerenidis, Raz, de Wolf 06] counterexample: strong extractor which is classically “secure”, but completely insecure against q-memory of similar size [Ambainis, Smith 04] encrypting quantum messages with ± -biased masking [Desrosiers, Dupuis 07] quantum entropic security Quantum Schemes

Conclusions 22 randomness extraction via ± -biased masking is secure in the presence of quantum attacker entropic security Error Correction without Leaking Partial Information Applications in the Bounded-(Quantum-)Storage Model Thanks to you!

Strong Extractor 23 Let {C i } be a δ-biased family of binary linear [n,k,d] 2 codes. {H i } the parity-check matrix. Then, Ext: (i,x)  H i x is a (t, ε)-strong quantum extractor with with (n-k)-bit output, ε= δ 2 (n-t)/2 Seed length must be linear in n Then, I, ρ Z C I © X =?