2. Cryptography in the Bounded-Quantum-Storage Model Christian Schaffner BRICS, University of Aarhus PhD Defense Friday, April 27 th 2007

3. 2 / 38 Agenda  Motivation, Bit Commitment (BC)  Classical Protocol for BC  Quantum Effects  Quantum Protocol for BC  Conclusion

4. 3 / 38 Alice & Bob Alice Bob *!¤

5. 4 / 38 Alice Bob who gets the house? *!¤ Divorce Problems

6. 5 / 38 Bad Bob Bob Coin-Flipping over the Telephone Alice [ B l um 82 ] It’s tails, I get the house!

7. 6 / 38 A Coin-Flipping Protocol Alice Bob not random! Bad Bob

8. 7 / 38 The Solution Alice Bob

9. 8 / 38 The Explanation Alice Bad Bob

10. 9 / 38 The Explanation Bob Bad Alice

11. 10 / 38 Bob‘s view Bit-Commitment (BC) Scheme Alice Bob commit open important cryptographic primitive hiding binding Bad Bob Bad Alice

12. 11 / 38 Agenda Motivation, Bit Commitment (BC)  Classical Protocol for BC  Quantum Effects  Quantum Protocol for BC  Conclusion

13. 12 / 38 BC Impossible From Scratch perfectly secure, no assumptions (unbounded time and memory) with classical communication with quantum communication Alice Bob Bob‘s view open commit hiding binding bounded memory! [ M ayers 96, L o C h au 96 ]

14. 13 / 38 Bob‘s view A Classical Bit-Commitment Protocol commit to 0: 011010010…01 Alice Bob bounded memory! (100 GB) commit to 1: 100011001…11 (100 GB each) perfectly hiding: non-interactive! binding? open: a checks correctness 100011001…11

15. 14 / 38 Bob‘s view A Classical Bit-Commitment Protocol commit to 0: 011010010…01 Alice Bob commit to 1: 100011001…11 (n bits each) honest Alice needs n bits of memory Theorem: binding against cheating Alice with less than 2 ¢ n bits of memory bounded memory! open: a checks correctness 100011001…11

16. 15 / 38 Bob‘s view A Classical Bit-Commitment Protocol commit to 0: 011010010…01 Alice Bob commit to 1: 100011001…11 (n bits each) honest Alice needs n bits of memory Theorem: binding against cheating Alice with less than 2 ¢ n bits of memory bounded memory! open: a checks correctness 100011001…11 unrealistic assumption: difficult to store classical bits only twice the honest player’s memory is required to break protocol

17. 16 / 38 Bob‘s view A Quantum Bit-Commitment Protocol Alice Bob commit to 0: 011010010…01 commit to 1: 100011001…11 (n bits each) honest Alice needs n bits of memory Theorem: binding against cheating Alice with less than 2 ¢ n bits of memory bounded memory! open: a checks correctness 100011001…11 n quantum bits bounded quantum memory!

18. 17 / 38 honest Alice needs n bits of memory Theorem: binding against cheating Alice with less than 2 ¢ n bits of memory Bob‘s view Quantum Bit-Commitment Protocol Alice Bob bounded quantum memory! n quantum bits no quantum bits (qubits) n/2 qubits open: a checks correctness 100011001…11

19. 18 / 38 Agenda Motivation, Bit Commitment (BC) Classical Protocol for BC  Quantum Effects  Quantum Protocol for BC  Conclusion

20. 19 / 38 Quantum Bit: e.g. Polarization of Light qu b i t asun i t vec t or i n C 2

21. 20 / 38 j 0 i + j 1 i + qu b i t asun i t vec t or i n C 2 Qubit: Rectilinear Basis j 0 i + j 1 i +

22. 21 / 38 j 0 i + j 1 i + j 0 i + qu b i t asun i t vec t or i n C 2 Detecting a Qubit Alice Bob no photon: 0 j 0 i + j 1 i +

23. 22 / 38 j 0 i + j 1 i + j 0 i + qu b i t asun i t vec t or i n C 2 Measuring a Qubit Alice Bob no photon: 0 photon: 1 with prob. 1 yields 1 Measurement: j 0 i + j 1 i +

24. 23 / 38 qu b i t asun i t vec t or i n C 2 Diagonal Basis j 1 i £ j 0 i £ j 0 i + j 1 i + j 0 i £ with prob. ½ yields 0 with prob. ½ yields 1 j 0 i + j 1 i + j 1 i £ Measurement:

25. 24 / 38 qu b i t asun i t vec t or i n C 2 Quantum Effects j 1 i £ j 0 i £ j 0 i + j 1 i + with prob. ½ yields 0 with prob. ½ yields 1 Measurement:

26. 25 / 38 qu b i t asun i t vec t or i n C 2 Quantum Effects j 1 i £ j 0 i £ j 0 i + j 1 i + with prob. ½ yields 0 with prob. ½ yields 1 Measurement:

27. 26 / 38 Quantum Mechanics with prob. 1 yields 1 Measurements: + basis £ basis j 0 i + j 1 i + j 1 i £ j 0 i £ with prob. ½ yields 0 with prob. ½ yields 1

28. 27 / 38 Agenda Motivation, Bit Commitment (BC) Classical Protocol for BC Quantum Effects  Quantum Protocol for BC  Conclusion

29. 28 / 38 Quantum Bit-Commitment Protocol n quantum bits bounded quantum memory! 01110 picks at random:

30. 29 / 38 Quantum Bit-Commitment Protocol n quantum bits 01110 picks at random: 01100 open: 11010

31. 30 / 38 Quantum Bit-Commitment Protocol n quantum bits 01110 picks at random: 01100 11010 open: 01100 accept

32. 31 / 38 Quantum Bit-Commitment Protocol n quantum bits 01110 picks at random: 01100 11010 open: accept 11010 measurement upon reception honest players need no quantum memory

33. 32 / 38 Bob‘s view Cheating Bob: Hiding? n quantum bits 01110 picks at random: 01100 11010 open: / perfectly hiding: non-interactive!

34. 33 / 38 Cheating Alice: Binding? n quantum bits 01110 picks at random: 01100 open: / measuring destroys information with quantum memory: easy to cheat! 10101 bounded quantum memory!

35. 34 / 38 Cheating Alice: Binding? n quantum bits 01110 picks at random: bad Alice does not know encoding bases needs to compress ) destroys information Theorem: binding as long as # qubits < n/2 open: / [ D amg º ar d F e h r S a l va i l S c h a ® ner 05 ]

36. 35 / 38 Agenda Motivation, Bit Commitment (BC) Classical Protocol for BC Quantum Effects Quantum Protocol for BC  Conclusion

37. 36 / 38 Summary Motivation:  Coin-Flipping over Telephone  Bit Commitment (BC) protocol for BC: perfectly hiding, binding for memory-bounded Alice classical: unpractical assumptions Bounded-Quantum-Storage Model:  showed quantum effects  BC: better parameters, practical!

38. 37 / 38 QUSEP Project: Alice Bob

39. 38 / 38 The End Alice bounded quantum memory! Bob bounded quantum memory! *!¤