1. Cryptography In the Bounded Quantum-Storage Model
Ivan Damgård, Louis Salvail, Christian Schaffner BRICS, University of Århus, DK
Serge Fehr
CWI, Amsterdam, NL
FOCS Pittsburgh
Tuesday, October 25th 2005

2. Classical 2-party primitives
Rabin Oblivious Transfer b
b / ?
private
oblivious OT
Bit Commitment b Cb
b in Cb? BC
binding
hiding
OT ) BC
OT is complete for two-party cryptography

3. Known Impossibility Results
In the classical unconditionally secure model without further assumptions OT
In the unconditionally secure model with quantum communication
[Mayers97, Lo-Chau97] BC

4. Classical Bounded-Storage Model
random string which players try to store
a memory bound applies at a specified moment
protocol for OT [DHRS, TCC04]: memory size of honest players: k memory of dishonest players: <k2
Tight bound [DM, EC04]
can be improved by allowing quantum communication OT
()  BC

5. Quantum Bounded-Storage Model
quantum memory bound applies at a specified moment. Besides that, players are unbounded (in time and space)
unconditional secure against adversaries with quantum memory of less then half of the transmitted qubits
honest players do not need quantum memory at all
honest players: 0 k dishonest players: <n/2 <k2
ratio: 1 k OT  BC 

6. Agenda
Quantum Bounded-Storage Model
Protocol for Oblivious Transfer
Protocol for Bit Commitment
Practicality Issues

7. Quantum Mechanics (Toy Version)
+ basis
£ basis
Measurements:
with prob. 1 yields 1
with prob. ½ yields 0
with prob. ½ yields 1

8. Quantum Protocol for OT
Alice
Bob
0110…
0110…
memory bound: store < n/2 qubits
h is two-universal and BINARY, maps to one bit
Example: honest players

9. Quantum Protocol for OT II
Alice
Bob
0110…
0011…
memory bound: store < n/2 qubits  
honest players?
private?

10. Obliviousness against dishonest Bob?
Alice
Bob
0110… … …
11…
memory bound: store < n/2 qubits

11. Proof of Obliviousness: Tools
Purification techniques like in the Shor-Preskill security proof of BB84
Privacy Amplification against Quantum Adversaries [RK, TCC05]
new min-entropy based uncertainty relation: OT 
For a n-qubit register A in state A, let P+ and P£ be the probabilities of measuring A in the +-basis respectively £-basis. Then it holds
P+1 + P£1 · 1 + negl(n).

12. Agenda
Quantum Bounded Storage Model
Protocol for Oblivious Transfer
Protocol for Bit Commitment
Practicality Issues

13. Quantum Protocol for Bit Commitment
Verifier
Committer BC
memory bound: store < n/2 qubits

14. Quantum Protocol for Bit Commitment II
Verifier
Committer
memory bound: store < n/2 qubits
one round, non-interactive
commit by receiving!
unconditionally hiding
unconditionally binding as long as Memcommitter < n / 2 BC
) proof uses same tools as for OT !

15. Agenda
Quantum Bounded Storage Model
Protocol for Oblivious Transfer
Protocol for Bit Commitment
Practicality Issues

16. OT BC Practicality Issues With today’s technology, we
can transmit quantum bits encoded in photons
cannot store them for longer than a few milliseconds OT BC
Problems:
imperfect sources (multi-pulse emissions)
transmission errors

17. Practicality Issues II
Our protocols can be modified to
resist attacks based on multi-photon emissions
tolerate (quantum) noise OT  BC
Well within reach of current technology.
makes sense over short distances (in contrast to QKD) 

18. Thank you for your attention!
Summary
Protocols for OT and BC that are
efficient, non-interactive
unconditionally secure against adversaries with bounded quantum memory
practical:
honest players do not need quantum memory
fault-tolerant OT  BC 
Thank you for your attention!

19. Binding Property: Proof Idea
Verifier
Committer BC 
memory bound: store < n/2 qubits

20. Open Problems and Next Steps
Other flavors of OT: e.g. 1-out-of-2 Oblivious Transfer, String-OT, …
Better memory bounds
Composability? What happens to the memory bound?
Better uncertainty relations for more MUB … OT  BC 

21. Quantum 1-2-OT Alice Bob memory bound: store < 0.4n qubits
h is two-universal and BINARY, maps to one bit

22. Three Ways Out
Bound computing power (schemes based on complexity assumptions)
Noisy communication [e.g. CrépeauMorozovWolf04]
Physical limitations OT 
Physical limitations
e.g. bounded memory size BC 

23. Quantum Mechanics II + basis £ basis EPR pairs: prob. ½ : 0
prob. ½ : 0 prob. ½ : 1
prob. 1 : 0

24. Agenda
Quantum Bounded-Storage Model
Protocol for Oblivious Transfer
Protocol for Bit Commitment
Practicality Issues