Upload
freya
View
22
Download
0
Tags:
Embed Size (px)
DESCRIPTION
Cryptography In the Bounded Quantum-Storage Model. joint work with Ivan Damgård, Serge Fehr and Louis Salvail. Christian Schaffner, BRICS University of Århus, Denmark ECRYPT Autumn School, Bertinoro Wednesday, October 19 th 2005. Agenda. “Known” Results Protocol for Oblivious Transfer - PowerPoint PPT Presentation
Citation preview
Cryptography In theCryptography In theBounded Quantum-Storage Bounded Quantum-Storage
ModelModel
Christian Schaffner, BRICSChristian Schaffner, BRICS
University of University of Århus, DenmarkÅrhus, Denmark
ECRYPT Autumn School, BertinoroECRYPT Autumn School, BertinoroWednesday, October 19Wednesday, October 19thth 2005 2005
joint work with Ivan Damgård, Serge Fehr and Louis Salvailjoint work with Ivan Damgård, Serge Fehr and Louis Salvail
2 / 42
AgendaAgenda
““Known” ResultsKnown” Results Protocol for Oblivious TransferProtocol for Oblivious Transfer Security ProofSecurity Proof Protocol for Bit CommitmentProtocol for Bit Commitment Practicality IssuesPracticality Issues Open ProblemsOpen Problems
3 / 42
Classical 2-party primitives: Classical 2-party primitives: Rabin Oblivious TransferRabin Oblivious Transfer
bb b / ?b / ?
correct:correct: For honest Alice and Bob, Bob gets the For honest Alice and Bob, Bob gets the bit b with probability ½. bit b with probability ½.
oblivious:oblivious: Even if Bob is dishonest, he does not Even if Bob is dishonest, he does not get information about b with probability ½. get information about b with probability ½.
private:private: Even if Alice is dishonest, she does not Even if Alice is dishonest, she does not learn, whether Bob received the bit or not.learn, whether Bob received the bit or not.
OTSenderSender
BobBobAliceAlice
ReceiverReceiver
4 / 42
Classical 2-party primitives:Classical 2-party primitives:Bit CommitmentBit Commitment
correct:correct: BC allows Alice to commit to a bit b. BC allows Alice to commit to a bit b. Later, she can open CLater, she can open Cbb to Bob. to Bob.
hiding:hiding: Even if Bob is dishonest, he does not get Even if Bob is dishonest, he does not get information on b from Cinformation on b from Cbb..
binding:binding: Even if Alice is dishonest, she cannot Even if Alice is dishonest, she cannot open Copen Cb b to another value than b.to another value than b.
CommitterCommitter VerifierVerifierbb CCbb
bb b in Cb in Cbb??
BC
5 / 42
Classical 2-party primitives: RelationsClassical 2-party primitives: Relations
Oblivious TransferOblivious Transfer
bb b / ?b / ? obliviousoblivious privateprivate
hidinghiding bindingbinding
Bit CommitmentBit Commitment
bb CCbb
bb b in Cb in Cbb??
OT
BC
OT OT )) BC, BC, OT OT ¸̧ BC BC OT OT is complete for two-party cryptography
6 / 42
Known Impossibility ResultsKnown Impossibility Results
OT In the classical unconditionally In the classical unconditionally
secure model without further secure model without further assumptionsassumptions
BC
7 / 42
Classical 2-party primitives:Classical 2-party primitives:Bit CommitmentBit Commitment
hiding:hiding: Even if Bob is dishonest, he does not get Even if Bob is dishonest, he does not get information on b from Cinformation on b from Cbb..
binding:binding: Even if Alice is dishonest, she cannot Even if Alice is dishonest, she cannot open Copen Cb b to another value than b.to another value than b.
CommitterCommitter VerifierVerifierbb CCbb
bb b in Cb in Cbb??
BC
8 / 42
Known Impossibility ResultsKnown Impossibility Results
OT In the classical unconditionally In the classical unconditionally
secure model without further secure model without further assumptionsassumptions
BC In the unconditionally secure model In the unconditionally secure model
with quantum communicationwith quantum communication[Mayers97, Lo-Chau97][Mayers97, Lo-Chau97]
9 / 42
Three Ways OutThree Ways Out
OT Bound computing power (schemes Bound computing power (schemes
based on complexity assumptions)based on complexity assumptions) Noisy communication Noisy communication
[see Ivan’s talk this morning] [see Ivan’s talk this morning] Physical limitationsPhysical limitations
BC
Physical limitationsPhysical limitations
e.g. bounded memory sizee.g. bounded memory size
10 / 42
Classical Bounded-Storage ModelClassical Bounded-Storage Model
OT
BC
()
()
random string which players try to random string which players try to storestore
a memory bound applies at a specified a memory bound applies at a specified momentmoment
protocol for OT [DHRS, TCC04]: protocol for OT [DHRS, TCC04]: memory size of honest players:memory size of honest players: k k memory of dishonest players:memory of dishonest players: <k<k22
Tight bound [DM, EC04]Tight bound [DM, EC04] can be can be improved improved by allowingby allowing
quantum communicationquantum communication
11 / 42
Quantum Bounded-Storage ModelQuantum Bounded-Storage Model
OT
quantum memory bound applies at a quantum memory bound applies at a specified momentspecified moment
besides that, players are unbounded besides that, players are unbounded (in time and space)(in time and space)
unconditional secureunconditional secure against against adversaries with quantum memory of adversaries with quantum memory of less then less then half of the transmitted half of the transmitted qubits qubits (honest players (honest players do not needdo not need quantumquantum memory memory at allat all))
honest players:honest players: 00 kkdishonest players:dishonest players: <n/2<n/2 <k<k22
BC
12 / 42
AgendaAgenda
Known ResultsKnown Results Protocol for Oblivious TransferProtocol for Oblivious Transfer Security ProofSecurity Proof Protocol for Bit CommitmentProtocol for Bit Commitment Practicality IssuesPracticality Issues Open ProblemsOpen Problems
13 / 42
Quantum Mechanics IQuantum Mechanics I
+ basis
£ basis
j i j i
j i£ j i£
with prob. 1 yields 1
with prob. ½ yields 0
Measurements:
with prob. ½ yields 1
14 / 42
Quantum Protocol for OTQuantum Protocol for OT
r; h;sh 2R Hn
s b©hx b s ©hx0 r r0
x0 r0
memory bound: store < n/2 qubits
Alice Bob
Example: honest players
jxi r
r 2R f ;£ gx 2R f ;gn
0110…
0110…
b2 f ;g
15 / 42
Quantum Protocol for OT IIQuantum Protocol for OT II
r; h;sh 2R Hn
s b©hx
x0 r0
memory bound: store < n/2 qubits
Alice Bob
honest players? private?
jxi r
r 2R f ;£ gx 2R f ;gn
0110…
0011…
b s ©hx0 r r0
x 6 x0) hx0 ;hx b
16 / 42
Obliviousness against dishonest Bob?Obliviousness against dishonest Bob?
r; h;sh 2R Hn
s b©hx b s ©hx0 r r0
x0 r0
memory bound: store < n/2 qubits
Alice Bob
jxi r
r 2R f ;£ gx 2R f ;gn
0110…
…
…
11…
17 / 42
Quantum Mechanics IIQuantum Mechanics II
+ basis
£ basis
j i j i
j i£ j i£
EPR pairs:prob. ½ : 0 prob. ½ : 1
prob. ½ : 0prob. ½ : 1prob. 1 : 0
18 / 42
Proof of Obliviousness: PurificationProof of Obliviousness: Purification
r; h;sh 2R Hn
s b©hx b s ©hx0 r r0
memory bound: store < n/2 qubits
Alice Bob
jxi r
x 2R f ;gnr 2R f ;£ g
19 / 42
Proof of Obliviousness: Purification IIProof of Obliviousness: Purification II
r; h;sh 2R Hn
s b©hx b s ©hx0 r r0
memory bound: store < n/2 qubits
Alice Bob
r 2R f ;£ g
0 1 1 0x 2R f ;gn
20 / 42
Proof of Obliviousness: EPR-VersionProof of Obliviousness: EPR-Version
r; h;sh 2R Hn
s b©hx b s ©hx0 r r0
memory bound: store < n/2 qubits
Alice Bob
r 2R f ;£ g
21 / 42
r 2R f ;£ g
Proof of Obliviousness: DistributionsProof of Obliviousness: Distributions
r; h;sh 2R Hn
s b©hx b s ©hx0 r r0
memory bound: store < n/2 qubits
Alice Bob
2-4
000100100011010001010110
…
…
0000000100100011010001010110
…
…
0000
p q
2-4
22 / 42
r 2R f ;£ g
Proof of Obliviousness: ExampleProof of Obliviousness: Example
r; h;sh 2R Hn
s b©hx b s ©hx0 r r0
memory bound: store < n/2 qubits
Alice Bob
0000000100100011010001010110
p
2-4
…
…
0000000100100011010001010110
q
2-4
…
…
23 / 42
r 2R f ;£ g
Proof of Obliviousness: Distributions IIProof of Obliviousness: Distributions II
r; h;sh 2R Hn
s b©hx b s ©hx0 r r0
memory bound: store < n/2 qubits
Alice Bob
001…
2-4
000100100011010001010110
…
…
0000
p
x 0000000100100011010001010110
…
…
q
2-4
x
24 / 42
Proof of Obliviousness: GoalProof of Obliviousness: Goal
However Bob prepares his memory
and the distributions p and q, he cannot guess h(x) in both bases simultaneously ) oblivious
001…
000100100011010001010110
0000
p
x
q
x
0111100010011010
000100100011010001010110
0000
0111100010011010
… …
2R f ;£ g
25 / 42
Privacy AmplificationPrivacy Amplification
…
p
Privacy Amplification against Quantum Adversaries [Renner König, TCC 2005]
X f ;gn
h f ;gn ! f ; g hX
¡ n
SS
< n
… X
X
¡ p1 X H1 X > n
hX
26 / 42
Obliviousness: Uncertainty RelationObliviousness: Uncertainty Relation
…
p
x
…
q
x
¡ n
SS
H n
¡ n
S S
pS qS ¸
27 / 42
Proof of Obliviousness: FinaleProof of Obliviousness: Finale
…
p
x
…
q
x
¡ n
SS
¡ n
S S
E f x 2 Sg
2R f ;£ g
pS qS ¸
) E f pS qSg ¸
28 / 42
Proof of Obliviousness: RecapProof of Obliviousness: Recap
memory bound: store ≤ n/2 qubits
Alice Bob
jxi r
r 2R f ;£ gx 2R f ;gn
r; h;sh 2R Hn
s b©hx b s ©hx0 r r0
29 / 42
Proof of Obliviousness: Recap IIProof of Obliviousness: Recap II
r; h;sh 2R Hn
s b©hx b s ©hx0 r r0
memory bound: store ≤ n/2 qubits
Alice Bob
2R f ;£ g
30 / 42
Proof of Obliviousness: Recap IIIProof of Obliviousness: Recap III
r; h;sh 2R Hn
s b©hx b s ©hx0 r r0
memory bound: store ≤ n/2 qubits
Alice Bob
001…
…
p
x
…
q
x
2R f ;£ g
31 / 42
Proof of Obliviousness: Recap IVProof of Obliviousness: Recap IV
r; h;sh 2R Hn
s b©hx b s ©hx0 r r0
Alice Bob
…
p
x
…
q
x
2R f ;£ g
SS S S
E f x 2 Sg E ¸
32 / 42
AgendaAgenda
Known ResultsKnown Results Protocol for Oblivious TransferProtocol for Oblivious Transfer Security ProofSecurity Proof Protocol forProtocol for Bit CommitmentBit Commitment Practicality IssuesPracticality Issues Open ProblemsOpen Problems
33 / 42
Quantum Protocol for Bit CommitmentQuantum Protocol for Bit Commitment
BC
Verifier Committer
b; x0
x0 b
b2 f ;£ g
jx i r; ::; jxni rn
x 2R f ;gn
r 2R f ;£ gn
xi x0i
ri b
memory bound: store < n/2 qubits
34 / 42
BC
Verifier Committer
b; x0
b2 f ;g
one roundone round non-interactive (commit by receiving)non-interactive (commit by receiving) unconditionally hidingunconditionally hiding unconditionally binding:unconditionally binding:
classically:classically: MemMemdisdis < 2 < 2 ¢¢ Mem Memhonhon
quantum:quantum: MemMemdisdis < n / 2 < n / 2
n
memory bound: store < n/2 qubits
Quantum Protocol for Bit Commitment IIQuantum Protocol for Bit Commitment II
35 / 42
Binding Property: Proof IdeaBinding Property: Proof Idea
BC
Verifier Committer
b; x0
x0 b
b2 f ;£ g
jx i r; ::; jxni rn
x 2R f ;gn
r 2R f ;£ gn
xi x0i
ri b
memory bound: store < n/2 qubits
36 / 42
AgendaAgenda
Known ResultsKnown Results Protocol for Oblivious TransferProtocol for Oblivious Transfer Security ProofSecurity Proof Protocol for Bit CommitmentProtocol for Bit Commitment Practicality IssuesPracticality Issues Open ProblemsOpen Problems
37 / 42
Practicality IssuesPracticality Issues
OT
BC
With today’s technology, weWith today’s technology, we cancan transmit quantum bits transmit quantum bits
encode bits in the correct basisencode bits in the correct basis send them over optical fiberssend them over optical fibers receive and measure themreceive and measure them
cannot storecannot store them for longer than a them for longer than a few millisecondsfew milliseconds
Problems:Problems: imperfect sources (multi-pulse imperfect sources (multi-pulse
emissions)emissions) transmission errorstransmission errors
38 / 42
Practicality Issues IIPracticality Issues II
OT
Our protocols can be modified toOur protocols can be modified to resist resist attacks based onattacks based on multi-photon multi-photon
emissions emissions tolerate (quantum) tolerate (quantum) noisenoise
BC
Well within reach of Well within reach of current current
technology technology and and unconditionally unconditionally securesecure as long as nobody can store as long as nobody can store large amounts of quantum bits.large amounts of quantum bits.
39 / 42
Open Problems and Next StepsOpen Problems and Next Steps
OT
Other flavors of OT:Other flavors of OT:e.g. 1-out-of-2 Oblivious Transfer, String-e.g. 1-out-of-2 Oblivious Transfer, String-OT, …OT, …
Better memory boundsBetter memory bounds
Composability? What happens to the Composability? What happens to the memory bound?memory bound?
Better uncertainty relations for more MUBBetter uncertainty relations for more MUB
……
BC
41 / 42
SummarySummary
OT
Protocols for OT and BC that areProtocols for OT and BC that are efficientefficient non-interactivenon-interactive unconditionally secureunconditionally secure against against
adversaries with bounded quantum adversaries with bounded quantum memorymemory
practical:practical: honest players do not need quantum honest players do not need quantum
memorymemory fault-tolerantfault-tolerant
BC
42 / 42
Questions and Comments?Questions and Comments?
OT
BC