Cryptography In the Bounded Quantum-Storage Model Christian Schaffner, BRICS University of Århus, Denmark ECRYPT Autumn School, Bertinoro Wednesday, October 19 th 2005 joint work with Ivan Damgård, Serge Fehr and Louis Salvail

2 / 42 Agenda  “Known” Results  Protocol for Oblivious Transfer  Security Proof  Protocol for Bit Commitment  Practicality Issues  Open Problems

3 / 42 Classical 2-party primitives: Rabin Oblivious Transfer b b / ? correct: For honest Alice and Bob, Bob gets the bit b with probability ½. correct: For honest Alice and Bob, Bob gets the bit b with probability ½. oblivious: Even if Bob is dishonest, he does not get information about b with probability ½. oblivious: Even if Bob is dishonest, he does not get information about b with probability ½. private: Even if Alice is dishonest, she does not learn, whether Bob received the bit or not. private: Even if Alice is dishonest, she does not learn, whether Bob received the bit or not. OT Sender Bob Alice Receiver

4 / 42 Classical 2-party primitives: Bit Commitment correct: BC allows Alice to commit to a bit b. Later, she can open C b to Bob. correct: BC allows Alice to commit to a bit b. Later, she can open C b to Bob. hiding: Even if Bob is dishonest, he does not get information on b from C b. hiding: Even if Bob is dishonest, he does not get information on b from C b. binding: Even if Alice is dishonest, she cannot open C b to another value than b. binding: Even if Alice is dishonest, she cannot open C b to another value than b. Committer Verifier b CbCbCbCb b b in C b ? BC

5 / 42 Classical 2-party primitives: Relations Oblivious Transfer b b / ? oblivious oblivious private private hiding hiding binding binding Bit Commitment b CbCbCbCb b b in C b ? OT BC OT ) BC, OT ¸ BC OT ) BC, OT ¸ BC OT OT is complete for two-party cryptography

6 / 42 Known Impossibility Results OT In the classical unconditionally secure model without further assumptions In the classical unconditionally secure model without further assumptions BC

7 / 42 Classical 2-party primitives: Bit Commitment hiding: Even if Bob is dishonest, he does not get information on b from C b. hiding: Even if Bob is dishonest, he does not get information on b from C b. binding: Even if Alice is dishonest, she cannot open C b to another value than b. binding: Even if Alice is dishonest, she cannot open C b to another value than b. Committer Verifier b CbCbCbCb b b in C b ? BC

8 / 42 Known Impossibility Results OT In the classical unconditionally secure model without further assumptions In the classical unconditionally secure model without further assumptions BC In the unconditionally secure model with quantum communication In the unconditionally secure model with quantum communication [Mayers97, Lo-Chau97]

9 / 42 Three Ways Out OT Bound computing power (schemes based on complexity assumptions) Bound computing power (schemes based on complexity assumptions) Noisy communication [see Ivan’s talk this morning] Noisy communication [see Ivan’s talk this morning] Physical limitations Physical limitations BC  Physical limitations e.g. bounded memory size

10 / 42 Classical Bounded-Storage Model OT BC ( ) random string which players try to store random string which players try to store a memory bound applies at a specified moment a memory bound applies at a specified moment protocol for OT [DHRS, TCC04]: memory size of honest players:k memory of dishonest players:<k 2 protocol for OT [DHRS, TCC04]: memory size of honest players:k memory of dishonest players:<k 2 Tight bound [DM, EC04] Tight bound [DM, EC04] can be improved by allowing quantum communication can be improved by allowing quantum communication

11 / 42 Quantum Bounded-Storage Model OT quantum memory bound applies at a specified moment quantum memory bound applies at a specified moment besides that, players are unbounded (in time and space) besides that, players are unbounded (in time and space) unconditional secure against adversaries with quantum memory of less then half of the transmitted qubits (honest players do not need quantum memory at all) unconditional secure against adversaries with quantum memory of less then half of the transmitted qubits (honest players do not need quantum memory at all) honest players:0k dishonest players:<n/2<k 2 honest players:0k dishonest players:<n/2<k 2 BC

12 / 42 Agenda Known Results Known Results  Protocol for Oblivious Transfer  Security Proof  Protocol for Bit Commitment  Practicality Issues  Open Problems

13 / 42 Quantum Mechanics I + basis £ basis with prob. 1 yields 1 with prob. ½ yields 0 Measurements: with prob. ½ yields 1

14 / 42 Quantum Protocol for OT memory bound: store < n/2 qubits Alice Bob Example: honest players 0110…

15 / 42 Quantum Protocol for OT II memory bound: store < n/2 qubits Alice Bob honest players? private? 0110… 0011…0011…

16 / 42 Obliviousness against dishonest Bob? memory bound: store < n/2 qubits Alice Bob 0110… … … 11…11…

17 / 42 Quantum Mechanics II + basis £ basis EPR pairs: prob. ½ : 0prob. ½ : 1 prob. ½ : 0 prob. ½ : 1 prob. 1 : 0

18 / 42 Proof of Obliviousness: Purification memory bound: store < n/2 qubits Alice Bob

19 / 42 Proof of Obliviousness: Purification II memory bound: store < n/2 qubits Alice Bob 011 0

20 / 42 Proof of Obliviousness: EPR-Version memory bound: store < n/2 qubits Alice Bob

21 / 42 Proof of Obliviousness: Distributions memory bound: store < n/2 qubits Alice Bob … … … … 0000 pq 2 -4

22 / 42 Proof of Obliviousness: Example memory bound: store < n/2 qubits Alice Bob p 2 -4 … … q 2 -4 … …

23 / 42 Proof of Obliviousness: Distributions II memory bound: store < n/2 qubits Alice Bob 001… … … 0000 p x … … q 2 -4 x

24 / 42 Proof of Obliviousness: Goal However Bob prepares his memory and the distributions p and q, he cannot guess h(x) in both bases simultaneously ) oblivious 001… p x q x ……

25 / 42 Privacy Amplification … p Privacy Amplification against Quantum Adversaries [Renner König, TCC 2005] …

26 / 42 Obliviousness: Uncertainty Relation … p x … q x

27 / 42 Proof of Obliviousness: Finale … p x … q x

28 / 42 Proof of Obliviousness: Recap memory bound: store ≤ n/2 qubits Alice Bob

29 / 42 Proof of Obliviousness: Recap II memory bound: store ≤ n/2 qubits Alice Bob

30 / 42 Proof of Obliviousness: Recap III memory bound: store ≤ n/2 qubits Alice Bob 001… … p x … q x

31 / 42 Proof of Obliviousness: Recap IV Alice Bob … p x … q x

32 / 42 Agenda Known Results Known Results Protocol for Oblivious Transfer Protocol for Oblivious Transfer Security Proof Security Proof  Protocol for Bit Commitment  Practicality Issues  Open Problems

33 / 42 Quantum Protocol for Bit Commitment BC VerifierCommitter memory bound: store < n/2 qubits

34 / 42 BC VerifierCommitter one round one round non-interactive (commit by receiving) non-interactive (commit by receiving) unconditionally hiding unconditionally hiding unconditionally binding: unconditionally binding: classically:Mem dis < 2 ¢ Mem hon classically:Mem dis < 2 ¢ Mem hon quantum:Mem dis < n / 2 quantum:Mem dis < n / 2 memory bound: store < n/2 qubits Quantum Protocol for Bit Commitment II

35 / 42 Binding Property: Proof Idea BC VerifierCommitter memory bound: store < n/2 qubits

36 / 42 Agenda Known Results Known Results Protocol for Oblivious Transfer Protocol for Oblivious Transfer Security Proof Security Proof Protocol for Bit Commitment Protocol for Bit Commitment  Practicality Issues  Open Problems

37 / 42 Practicality Issues OT BC With today’s technology, we can transmit quantum bits can transmit quantum bits encode bits in the correct basis encode bits in the correct basis send them over optical fibers send them over optical fibers receive and measure them receive and measure them cannot store them for longer than a few milliseconds cannot store them for longer than a few milliseconds Problems: imperfect sources (multi-pulse emissions) imperfect sources (multi-pulse emissions) transmission errors transmission errors

38 / 42 Practicality Issues II OT Our protocols can be modified to resist attacks based on multi-photon emissions resist attacks based on multi-photon emissions tolerate (quantum) noise tolerate (quantum) noise BC  Well within reach of current technology and unconditionally secure as long as nobody can store large amounts of quantum bits.

39 / 42 Open Problems and Next Steps OT Other flavors of OT: e.g. 1-out-of-2 Oblivious Transfer, String-OT, … Other flavors of OT: e.g. 1-out-of-2 Oblivious Transfer, String-OT, … Better memory bounds Better memory bounds Composability? What happens to the memory bound? Composability? What happens to the memory bound? Better uncertainty relations for more MUB Better uncertainty relations for more MUB … BC

40 / 42 Quantum Protocol for 1-2-OT memory bound: store < 0.4n qubits Alice Bob

41 / 42 Summary OT Protocols for OT and BC that are efficient efficient non-interactive non-interactive unconditionally secure against adversaries with bounded quantum memory unconditionally secure against adversaries with bounded quantum memory practical: practical: honest players do not need quantum memory honest players do not need quantum memory fault-tolerant fault-tolerant BC

42 / 42 Questions and Comments? OT BC