Cryptography In the Bounded Quantum-Storage Model Ivan Damgård, Louis Salvail, Christian Schaffner BRICS, University of Århus, DK Serge Fehr CWI, Amsterdam, NL FOCS 2005 - Pittsburgh Tuesday, October 25th 2005

Classical 2-party primitives Rabin Oblivious Transfer b b / ? private oblivious OT Bit Commitment b Cb b in Cb? BC binding hiding OT ) BC OT is complete for two-party cryptography

Known Impossibility Results In the classical unconditionally secure model without further assumptions OT In the unconditionally secure model with quantum communication [Mayers97, Lo-Chau97] BC

Classical Bounded-Storage Model random string which players try to store a memory bound applies at a specified moment protocol for OT [DHRS, TCC04]: memory size of honest players: k memory of dishonest players: <k2 Tight bound [DM, EC04] can be improved by allowing quantum communication OT ()  BC

Quantum Bounded-Storage Model quantum memory bound applies at a specified moment. Besides that, players are unbounded (in time and space) unconditional secure against adversaries with quantum memory of less then half of the transmitted qubits honest players do not need quantum memory at all honest players: 0 k dishonest players: <n/2 <k2 ratio: 1 k OT  BC 

Agenda Quantum Bounded-Storage Model Protocol for Oblivious Transfer Protocol for Bit Commitment Practicality Issues

Quantum Mechanics (Toy Version) + basis £ basis Measurements: with prob. 1 yields 1 with prob. ½ yields 0 with prob. ½ yields 1

Quantum Protocol for OT Alice Bob 0110… 0110… memory bound: store < n/2 qubits h is two-universal and BINARY, maps to one bit Example: honest players

Quantum Protocol for OT II Alice Bob 0110… 0011… memory bound: store < n/2 qubits   honest players? private?

Obliviousness against dishonest Bob? Alice Bob 0110… … … 11… memory bound: store < n/2 qubits

Proof of Obliviousness: Tools Purification techniques like in the Shor-Preskill security proof of BB84 Privacy Amplification against Quantum Adversaries [RK, TCC05] new min-entropy based uncertainty relation: OT  For a n-qubit register A in state A, let P+ and P£ be the probabilities of measuring A in the +-basis respectively £-basis. Then it holds P+1 + P£1 · 1 + negl(n).

Agenda Quantum Bounded Storage Model Protocol for Oblivious Transfer Protocol for Bit Commitment Practicality Issues

Quantum Protocol for Bit Commitment Verifier Committer BC memory bound: store < n/2 qubits

Quantum Protocol for Bit Commitment II Verifier Committer memory bound: store < n/2 qubits one round, non-interactive commit by receiving! unconditionally hiding unconditionally binding as long as Memcommitter < n / 2 BC ) proof uses same tools as for OT !

Agenda Quantum Bounded Storage Model Protocol for Oblivious Transfer Protocol for Bit Commitment Practicality Issues

OT BC Practicality Issues With today’s technology, we can transmit quantum bits encoded in photons cannot store them for longer than a few milliseconds OT BC Problems: imperfect sources (multi-pulse emissions) transmission errors

Practicality Issues II Our protocols can be modified to resist attacks based on multi-photon emissions tolerate (quantum) noise OT  BC Well within reach of current technology. makes sense over short distances (in contrast to QKD) 

Thank you for your attention! Summary Protocols for OT and BC that are efficient, non-interactive unconditionally secure against adversaries with bounded quantum memory practical: honest players do not need quantum memory fault-tolerant OT  BC  Thank you for your attention!

Binding Property: Proof Idea Verifier Committer BC  memory bound: store < n/2 qubits

Open Problems and Next Steps Other flavors of OT: e.g. 1-out-of-2 Oblivious Transfer, String-OT, … Better memory bounds Composability? What happens to the memory bound? Better uncertainty relations for more MUB … OT  BC 

Quantum 1-2-OT Alice Bob memory bound: store < 0.4n qubits h is two-universal and BINARY, maps to one bit

Three Ways Out Bound computing power (schemes based on complexity assumptions) Noisy communication [e.g. CrépeauMorozovWolf04] Physical limitations OT  Physical limitations e.g. bounded memory size BC 

Quantum Mechanics II + basis £ basis EPR pairs: prob. ½ : 0 prob. ½ : 0 prob. ½ : 1 prob. 1 : 0

Agenda Quantum Bounded-Storage Model Protocol for Oblivious Transfer Protocol for Bit Commitment Practicality Issues