Introduction to Quantum Computation Andris Ambainis University of Latvia

Lecture 1 From basics to quantum key distribution

What is quantum computation? zNew model of computing based on quantum mechanics. zQuantum circuits, quantum Turing machines zMore powerful than conventional models.

Quantum algorithms zFactoring: given N=pq, find p and q. zBest algorithm 2 O(n 1/3 ), n -number of digits. zMany cryptosystems based on hardness of factoring. zO(n 2 ) time quantum algorithm [Shor, 1994] zSimilar quantum algorithm solves discrete log.

Quantum algorithms zFind if there exists i for which x i =1. zQueries: input i, output x i. zClassically, n queries. zQuantum, O(  n) queries [Grover, 1996]. zSpeeds up exhaustive search x1x1 x2x2 xnxn x3x3

Quantum cryptography zKey distribution: two parties want to create a secret shared key by using a channel that can be eavesdropped. zClassically: secure if discrete log hard. zQuantum: secure if quantum mechanics valid [Bennett, Brassard, 1984]. zNo extra assumptions needed.

Quantum communication zDense coding: 1 quantum bit can encode 2 classical bits. zTeleportation: quantum states can be transmitted by sending classical information. zQuantum protocols that send exponentially less bits than classical.

Experiments z~10 different ideas how to implement QC. zNMR, ion traps, optical, semiconductor, etc. z7 quantum bit QC [Knill et.al., 2000]. zQKD has been implemented.

Outline zToday: basic notions, quantum key distribution. zTomorrow: quantum algorithms, factoring. zFriday: current research in quantum cryptography, coin flipping.

Model zQuantum states zUnitary transformations zMeasurements

Quantum bit z 2-dimensional vector of length 1. z Basis states |0>, |1>. z Arbitrary state:  |0>+  |1>, ,  complex, |  | 2 + |  | 2 =1. |1> |0>

Physical quantum bits zNuclear spin = orientation of atom’s nucleus in magnetic field. z  = |0>,  = |1>. zPhotons in a cavity. zNo photon = |0>, one photon = |1>

Physical quantum bits (2) zEnergy states of an atom zPolarization of photon zMany others. |0>|1> ground state excited state

General quantum states zk-dimensional quantum system. zBasis |1>, |2>, …, |k>. zGeneral state  1 |1>+  2 |2>+…+  k |k>, |  1 |^2+…+ |  k |^2=1 z2 k dimensional system can be constructed as a tensor product of k quantum bits.

Unitary transformations zLinear transformations that preserve vector norm. zIn 2 dimensions, linear transformations that preserve unit circle (rotations and reflections).

Examples zBit flip zHamamard transform

Linearity zBit flip |0>  |1> |1>  |0> zBy linearity,  |0>+  |1>   |1>+  |0> zSufficient to specify U|0>, U|1>.

Examples |1> |0>

zMeasuring  |0>+  |1> in basis |0>, |1> gives:  0 with probability |  | 2,  1 with probability |  | 2. zMeasurement changes the state: it becomes |0> or |1>. zRepeating measurement gives the same outcome. Measurements

Probability 1/2 |0> |1>

General measurements zLet |  0 >, |  1 > be two orthogonal one-qubit states. zThen, |  > =  0 |  0 > +  1 |  1 >. zMeasuring |  > gives |  i > with probability |  i | 2. zThis is equivalent to mapping |  0 >, |  1 > to |0>, |1> and then measuring.

Measurements Probability 1

Measurements Probability 1/2 |1>

Measurements zMeasuring  1 |1>+  2 |2>+…+  k |k> in the basis |1>, |2>, …, |k> gives |i> with probability |  i | 2. zAny orthogonal basis can be used.

Partial measurements zExample: two quantum bits, measure first. Result 0 Result 1

Classical vs. Quantum Classical bits: zcan be measured completely, zare not changed by measurement, zcan be copied, zcan be erased. Quantum bits: z can be measured partially, z are changed by measurement, z cannot be copied, z cannot be erased.

Copying One nuclear spin  Two spins Impossible! ? Related to impossiblity of measuring a state perfectly.

No-cloning theorem zImagine we could copy quantum states. zThen, by linearity zNot the same as two copies of |0>+|1>.

Key distribution zAlice and Bob want to create a shared secret key by communicating over an insecure channel. zNeeded for symmetric encryption (one- time pad, DES etc.).

Key distribution zCan be done classically. zNeeds hardness assumptions. zImpossible classically if adversary has unlimited computational power. zQuantum protocols can be secure against any adversary. zThe only assumption: quantum mechanics.

BB84 states |  > = |1> |  > = |0> |  > = |  >=

BB84 QKD... NoYes Alice Bob

BB84 QKD zAlice sends n qubits. zBob chooses the same basis n/2 times. zIf there is no eavesdropping/transmission errors, they share the same n/2 bits.

Eavesdropping zAssume that Eve measures some qubits in , |  basis and resends them. zIf the qubit she measures is |  > or |  >, Eve resends a different state (  or |  ). zIf Bob chooses |  >, |  > basis, he gets each answer with probability 1/2. zWith probability 1/2, Alice and Bob have different bits.

Eavesdropping zTheorem: Impossible to obtain information about non-orthogonal states without disturbing them. zIn this protocol:

Check for eavesdropping zAlice randomly chooses a fraction of the final string and announces it. zBob counts the number of different bits. zIf too many different bits, reject (eavesdropper found). zIf Eve measured many qubits, she gets caught.

Next step zAlice and Bob share a string most of which is unknown to Eve. zEve might know a few bits. zThere could be differences due to transmission errors.

Classical post-processing zInformation reconciliation: Alice and Bob apply error correcting code to correct transmission errors. zThey now have the same string but small number of bits might be known to Eve. zPrivacy amplification: apply a hash function to the string.

QKD summary zAlice and Bob generate a shared bit string by sending qubits and measuring them. zEavesdropping results in different bits. zThat allows to detect Eve. zError correction. zPrivacy amplification (hashing).

Eavesdropping models zSimplest: Eve measures individual qubits. zMost general: coherent measurements. zEve gathers all qubits, performs a joint measurement, resends.

Security proofs zMayers, zLo, Chau, zPreskill, Shor, zBoykin et.al., zBen-Or, 2000.

EPR state First qubit to Alice, second to Bob. If they measure, same answers.  Same for infinitely many bases.

Bell’s theorem zAlice’s basis: zBob’s basis: y instead of x. |0> |1>

Bell’s theorem Pr[b=0] Pr[a=1] Pr[a=0] Pr[b=1]

Classical simulation zAlice and Bob share random variables. zSomeone gives to them x and y. zCan they produce the right distribution without communication?

Bell’s theorem zClassical simulation impossible: zBell’s inequality: constraint satisfied by any result produced by classical randomness.

Ekert’s QKD zAlice generates n states sends 2nd qubits to Bob. zThey use half of states for Bell’s test. zIf test passed, they error-correct/amplify the rest and measure.

Equivalence zIn BB84 protocol, Alice could prepare the state keep the first register and send the second to Bob. 

Ekert and BB84 states   UIUI

QKD summary zKey distribution requires hardness assumptions classically. zQKD based on quantum mechanics. zHigher degree of security. zShowed two protocols for QKD.

QKD implementations zFirst: Bennett et.al., zCurrently: 67km, 1000 bits/second. zCommercially available: Id Quantique, 2002.

Next lectures zTomorrow: quantum algorithms for factoring. zFriday: quantum coin flipping.