A Tight High-Order Entropic Quantum Uncertainty Relation with Applications Serge Fehr, Christian Schaffner (CWI Amsterdam, NL) Renato Renner (University of Cambridge, UK) Ivan Damgård, Louis Salvail (University of Århus, DK) Crypto-Workshop Dagstuhl Thursday, September 20 th 2007

2 / :

3 / 24 (Randomized) 1-2 Oblivious Transfer R an d OT S 0 ; S 1 C 2 f 0 ; 1 g complete for 2-party computation impossible in the plain (quantum) model possible in the Bounded-Quantum-Storage Model S C

4 / 24 Outline Motivation and Notation Quantum Uncertainty Relation Contributions

5 / 24 Quantum Mechanics with prob. 1 yields 1 with prob. ½ yields 0 Measurements: with prob. ½ yields 1 + basis £ basis j 0 i + j 1 i + j 1 i £ j 0 i £

6 / 24 ge t X ' Quantum 1-2 OT Protocol j X i £ S 0 ; S 1 F 1 2 R F 1 F 0 2 R F 0 £ ; F 0 ; F 1 S 1 = ? S 0 C = 0 £ 0 = + n £ 2 R X 2 R sen d f + ; £ g n f 0 ; 1 g n Correctness Receiver-Security against Dishonest Alice

7 / 24 Sender-Security? j X i £ S 0 ; S 1 F 1 2 R F 1 F 0 2 R F 0 £ ; F 0 ; F 1 ge t ½ £ 2 R X 2 R sen d f + ; £ g n f 0 ; 1 g n Sender-Security: one of the strings looks completely random to dishonest Bob # qu b i t s < n = 4

8 / 24 Quantum Mechanics II + basis £ basis j 0 i + j 1 i + j 1 i £ j 0 i £ EPR pairs: prob. ½ : 0prob. ½ : 1 prob. ½ : 0 prob. ½ : 1 prob. 1 : 0

9 / 24 ge t Entanglement-Based Protocol S 0 ; S 1 F 1 2 R F 1 F 0 2 R F 0 £ ; F 0 ; F 1 ½ epr ­ n # qu b i t s < n = 4 Sender-Security: One of the strings looks completely random to dishonest Bob £ 2 R X 2 R sen d f + ; £ g n f 0 ; 1 g n ? ? ? ? ?

10 / 24 ge t Entanglement-Based Protocol j X i £ S 0 ; S 1 F 1 2 R F 1 F 0 2 R F 0 £ ; F 0 ; F 1 ½ # qu b i t s < n = 4 Sender-Security: One of the strings looks completely random to dishonest Bob £ 2 R X 2 R sen d f + ; £ g n f 0 ; 1 g n

11 / 24 £ 2 R X 2 R sen d f + ; £ g n f 0 ; 1 g n ? ? ? ? ? Let Bob Act First F 1 2 R F 1 F 0 2 R F 0 ½ £ ; F 0 ; F 1 ge t epr ­ n / /... # qu b i t s < n = 4 Sender-Security: One of the strings looks completely random to dishonest Bob S 0 ; S 1 2 f 0 ; 1 g ` [ R enner K Ä on i g 05, R enner 06 ] PA : 2 ` ¼ H 1 ( X j £ ; ½ )

12 / 24 ge t £ 2 R X 2 R sen d f + ; £ g n f 0 ; 1 g n ? ? ? ? ? Sender-Security  Uncertainty Relation F 1 2 R F 1 F 0 2 R F 0 ½ £ ; F 0 ; F 1 epr ­ n / /... # qu b i t s < n = 4 Sender-Security: One of the strings looks completely random to dishonest Bob S 0 ; S 1 2 f 0 ; 1 g ` [ R enner K Ä on i g 05, R enner 06 ] PA : 2 ` ¼ H 1 ( X j £ ; ½ ) ¸ H 1 ( X j £ ) |{z} ¸ ? ¡ # qu b i t s |{z} < n = 4 H 1 ( X j £ ) ¸ ?

13 / 24 Outline Motivation and Notation Quantum Uncertainty Relation Contributions

14 / 24 Quantum Uncertainty Relation needed j 0 i + j 1 i + j 1 i £ j 0 i £ qu b i t asun i t vec t or i n C 2 ® P r [ X = 0 ] = j ® j 2 P r [ X = 1 ] = 1 ¡ j ® j 2 P r [ X = 0 ] = j ¯ j 2 P r [ X = 1 ] = 1 ¡ j ¯ j 2 ¯

15 / 24 Uncertainty Relation for One Qubit j 0 i + j 1 i + j 1 i £ j 0 i £ P r [ X = 0 ] = 1 P r [ X = 1 ] = 0 P r [ X = 0 ] = 1 = 2 P r [ X = 1 ] = 1 = 2

16 / 24 ) H " 1 ( X n j £ ) n ! 1 ¼ n ¢ H ( X i j £ i ) ¸ n = 2 £ 2 R s t a t e f + ; £ g n ½... Quantum Uncertainty Relation needed / / H 1 ( X j £ ) ¸ ? X i i n d epen d en t X i : = X 1 ;:::; X i X : = X n = X 1 ;:::; X n H ( X i j £ i ) ¸ 1 2 excep t w i t h pro b · "

17 / 24 £ 2 R s t a t e f + ; £ g n ½... Main Result / / H 1 ( X j £ ) ¸ ? X i d epen d en t H ( X i j £ i ) ¸ 1 2 Q uan t um U ncer t a i n t y R e l a t i on: L e t X = ( X 1 ;:::; X n ) b e t h eou t come. T h en, H " 1 ( X j £ ) & n = 2 w i t h "neg l i g i bl e i nn. H ( X i j £ i ; X i ¡ 1 = x i ¡ 1 ; £ i ¡ 1 = µ i ¡ 1 ) ¸ 1 2

18 / 24 Main Technical Lemma Z 1 ;:::; Z n ( d epen d en t ) ran d omvar i a bl es T h en, H " 1 ( Z ) & n ¢ h w i t h "neg l i g i bl e i nn w i t h H ( Z i j Z i ¡ 1 = z i ¡ 1 ) ¸ h. P roo f : ² i n f orma t i on t h eory ² genera l i ze d C h erno ®b oun d ( A zuma i nequa li t y )

19 / 24 £ 2 R s t a t e f + ; £ g n ½... Proof of Quantum Uncertainty Relation Z i : = ( X i ; £ i ) MU : ½ 1 -qu b i t s t a t e: H ( X 0 j £ 0 ) ¸ 1 2 / / T h m: H ( Z i j Z i ¡ 1 = z ) ¸ h ) H " 1 ( Z n ) & h n Q uan t um U ncer t a i n t y R e l a t i on: L e t X = ( X 1 ;:::; X n ) b e t h eou t come. T h en, H " 1 ( X j £ ) & n = 2 w i t h "neg l i g i bl e i nn. H ( Z i j Z i ¡ 1 = z ) = H ( X i j £ i ; Z i ¡ 1 = z ) + H ( £ i j Z i ¡ 1 = z ) ¸ = : h : H " 1 ( X j £ ) ¼ H " 1 ( Z n ) ¡ H 0 ( £ ) & n = 2 + n ¡ n :

20 / 24 Tight? MU : ½ 1 -qu b i t s t a t e: H ( X 0 j £ 0 ) ¸ 1 2 H ( X j £ ) = 1 2 ¡ H ( X j £ = + ) |{z} = 0 + H ( X j £ = £ ) |{z} = 1 ¢ = 1 2 : £ 2 R s t a t e f + ; £ g n ½... / / Q uan t um U ncer t a i n t y R e l a t i on: L e t X = ( X 1 ;:::; X n ) b e t h eou t come. T h en, H " 1 ( X j £ ) & n = 2 w i t h "neg l i g i bl e i nn. F or t h epures t a t e j 0 i ­ n, t h e X are i n d epen d en t an d we k now t h a t H " 1 ( X j £ ) n ! 1 ¼ H ( X j £ ) = n = 2.

21 / 24 Outline Motivation and Notation Quantum Uncertainty Relation Contributions

22 / 24 conjugate coding / BB84: £ 2 R s t a t e f + ; £ g n ½... classical general lemma: instantiate it for various quantum codings: Contributions I: Uncertainty Relations H ( Z i j Z i ¡ 1 = z ) ¸ h ) H " 1 ( Z n ) & h n / / H " 1 ( X j £ ) ¸ n = 2

23 / 24 conjugate coding / BB84: three bases / six-state: … classical general lemma: instantiate it for various quantum codings: Contributions I: Uncertainty Relations H ( Z i j Z i ¡ 1 = z ) ¸ h ) H " 1 ( Z n ) & h n H " 1 ( X j £ ) ¸ n = 2 / / / / £ 2 R s t a t e f + ; £ ; ª g n ½... H " 1 ( X j £ ) ¸ 2 3 n

24 / 24 Bounded-Quantum-Storage Model: Non-interactive, practical protocols for 1-2 OT and BC secure according new composable security definitions. Quantum Key Distribution: Security proofs in realistic setting of a quantum-memory bounded eavesdropper. Tolerate higher error rates than against unbounded adversaries. Composition of certain Quantum Ciphers: key-uncertainty adds up in terms of min-entropy. Contributions II: Applications

25 / 24 name d e ¯ n i t i on H 0 ( Z ) l og ¯ ¯ f z j P Z ( z ) > 0 g ¯ ¯ n H ( Z ) ¡ P z P Z ( z ) l og ( P Z ( z )) ¼ n H 1 ( Z ) ¡ l og ( max z P Z ( z )) n = 2 Entropies H 1 · H · H 0 … ¼ 2 ¡ n |{z} 2 n ¡ 1 2 ¡ n 2 Z P Z Z ran d omvar i a bl eover f 0 ; 1 g n l ower b oun d on H 6 ) l ower b oun d on H 1

26 / 24 … ¼ 2 ¡ n |{z} 2 n ¡ 1 2 ¡ n 2 Z P Z Smooth Min-Entropy  " f or" = 2 ¡ n 2 Z ran d omvar i a bl eover f 0 ; 1 g n

27 / 24 two-way post processing QKD with more bases in higher-dimensional (non-binary) systems using less randomness: avoid sifting stage Open Questions

28 / 24 Smooth Min-Entropy [ R enner W o lf 05 ] Z i : = Z 1 ;:::; Z i Z ran d omvar i a bl eover f 0 ; 1 g n H " 1 ( Z ) : = max P r [ E ] ¸ 1 ¡ " H 1 ( Z E )

29 / 24 £ 2 R s t a t e f + ; £ g n ½... £ 2 R s t a t e f + n ; £ n g ½ Comparison to Previous Bound / / P rev i ous: T h ereex i s t saneven t E w i t h P r [ E ] & 1 2 suc h t h a t H 1 ( X j E ; £ ) ¸ n = 2 : N ew: H " 1 ( X j £ ) & n = 2 w i t h neg l i g i bl e" 8 µ 2 f + ; £ g n 9 even t E µ w i t h 2 ¡ n P µ P r [ E µ ] ¼ 1 an d H 1 ( X j E µ ; £ = µ ) & n = 2 :