Experimental Bit String Generation

Serge Massar

Université Libre de Bruxelles

Plan

• Recall earlier work on quantum coin tossing

• Theory of quantum bit string generation (joint work with Jonathan Barrett, PRA69(2004)022322 and quant-ph0408120)

• Experimental implementation of bit string generation (L.-Ph. Lamoureux, E. Brainis, D. Amans, J. Barrett, S. M., quant-ph/0408121)

Coin Tossing (Blum)

• Two parties dont trust each other.They need to choose a random bit:– « Alice (in the USA) and Bob (in the EU) are

divorcing, they need to decide who keeps the children. They decide to toss a coin. »

Bit String Generation: Tossing many coins

Applications of coin tossing

• Divorce cases

• Cryptographic primitive

• Are there any good applications?– ??Classically certified bit committement

secure against polynomial quantum attack (Kent03)??

How to toss a coin?

• Trusted third party: YES

• Classical communication alone: NO• Classical communication plus relativity:

OK. (But each party needs to be in multiple locations)

• Quantum Communication: yes, to some extent.

• Weak coin tossing:– Alice knows the outcome Bob wants– Bob knows the outcome Alice wants

• Strong coin tossing:– Alice and Bob do not know the outcome the

other party wants.

• We will be concerned with Strong coin tossing

Bit commitment implies

Coin Tossing

• Alice chooses a=0,1 at random• Alice commits a to Bob• Bob chooses b=0,1 at random• Bob tells Alice the value of b• Alice reveals the commitment• Coin c=a+b mod 2

Quantum protocol based on imperfect bit commitment

• Alice chooses a=0,1 at random• Commitment:

– Alice sends |ψa> to Bob– <ψ0|ψ1>=cosθ

• Bob chooses b=0,1 at random. • Bob tells Alice the value of b• Alice reveals a• Bob checks:

– measures in basis |ψa>, space orthogonal to |ψa>– If outcome is |ψa>, coin c=a+b mod 2– If outcome orthogonal to |ψa>, Bob aborts

• Wining means getting the outcome you want.• The protocol may abort. If the protocol aborts,

everybody looses

B

A

P

P

2

1)honest Alice wins,Bobdishonest (

2

1)honest Bob wins,Alicedishonest (

•Classical communication: either ЄA or ЄB = ½•There exists a quantum protocol with

ЄA = ЄB = ¼ (Ambainis)•For all quantum protocols,

Є> 1/√2 – ½ (Kitaev)

Alice cheats• Alice does not choose a• Commitment:

– Alice sends |ψ>=N(|ψ0> + |ψ1>) to Bob– <ψ0|ψ1>=cosθ

• Bob chooses b=0,1 at random. • Bob tells Alice the value of b• Alice reveals a chosen so that b+a has the desired value• Bob checks:

– measures in basis |ψa>, space orthogonal to |ψa>– Alice hopes outcome is |ψa>, then:

• coin c=a+b mod 2• Alice wins

– If outcome orthogonal to |ψa>, Bob aborts

• It is easy for Alice to cheat if <ψ0|ψ1>=cosθ is SMALL

Bob cheats• Alice chooses a=0,1 at random• Commitment:

– Alice sends |ψa> to Bob– <ψ0|ψ1>=cosθ

• Bob tries to learn whether a=0 or a=1: – He measures the state– He chooses b so that if his measurement outcome

was correct, he wins: b+a has the desired value• Bob tells Alice the value of b• Alice reveals a • Hopefully Bob has won (if his measurement outcome

gave the correct value of a)

• It is easy for Bob to cheat if cosθ is LARGE

• One can choose an optimal value of <ψ0|ψ1>=cosθ=1/√2 so that neither Alice nor Bob can cheat too much.

Then 22

1 and B A

Bit String Generation

• Alice and Bob want to generate a string of n bits c1, c2, … , cn– A. Kent (2003) noted that this should be

easier than tossing a single coin. Proposed a protocol based on the parties sharing many singlets. No security analysis.

Present work

• Bit string generation based on n repetitions of above protocol for coin tossing.

• Detailed security analysis.

1) Classical Protocol for bit string generation

• Best classical protocol we have found (optimal for some security criteria)– Alice chooses the value of half the bits– Bob chooses the value of the other half

• Thus if Alice is dishonest, Bob honest, half the bits are random, half are fixed.

• For i=1 to n• Alice chooses ai=0,1 at random• Commitment:

– Alice sends |ψai> to Bob– <ψ0|ψ1>=cosθ

• Bob chooses bi=0,1 at random. • Bob tells Alice the value of bi .• Alice reveals the value of ai to Bob• Bob checks:

– measures in basis |ψai>, space orthogonal to |ψai>– If outcome orthogonal to |ψa>, Bob aborts

• Next i• If Bob has not aborted, ci=ai + bi mod 2

2) Quantum Protocol

Cheating 1

• Cheating Bob:– He must measure the states received from

Alice immediately → Same security analysis than when tossing a single coin.

• Cheating Alice:– She can send an entangled state, measure

her state, then decide on the value of ai depending on the measurement outcome.

– She can correlate/entangle her strategy between rounds

Cheating 2

• For fixed <ψ0|ψ1>=cosθ it is more and more difficult for Alice to cheat when n increases (since Bob carries out n measurements)

→ One can decrease θ as n increases• This makes it more and more difficult for Bob to

cheat• Optimal rate of decrease θ=n- α for some α

→Good security both with respect to Alice and Bob

Security Criteria:Average Bias

B

A

:honest Alice dishonest, Bob

:honest Bob dishonest, Alice

coin? that of bias theisWhat

string. in the randomat coin a Take

1/12-BA

BA

n and :protocolOur

1/2 :Classicaly

Security Criteria:Entropy

o(n)2

n:protocol classicalBest :Conjecture

and :Protocol Quantum

honest? Alice dishonest, is Bob if-

honest? Bob dishonest, is Alice if-

H of aluesmallest v theisWhat

)abort()abortnot |( abort)not (

) string protocol of outcome()(

A

8/7

B

BA

HH

nnHH

nPcHPH

cPcP

Security criteria:Min Entropy

entropymin goodget cannot one ie.

1c somefor Hor Heither

protocols, quantum allFor :Conjecture2

Hor HEither :Classicaly

honest? isparty other the

dishonest, isparty one when H of valueMinimum

)(log

c is stringbit

y that theprobabilit maximum)(

cfix

Bmin

Amin

Bmin

Amin

min

0max2min

0

0max

0

cn

n

cPH

cP

Summary

2/??)(2/??4/1Classical

????)1(Quantum0

Entropy-Min

0

Entropy

2/10

Bias Average

min

min

min

nHnonH

cnHnnHnnHnH

•Open Questions:•Improve quantum results. (Can entanglement help?)•Obtain Kitaev type bounds for the different security criteria.•Prove classical conjecture.

Experimental Bit String Generation

• Easier than tossing a single coin because some experimental imperfections (detector efficiency, detector dark counts) can be subtracted.– Experiment reported by Zeilinger et al (quant-

ph/0404027) but incomplete security analysis.– Our experiment: we did our best to prove

security against ALL attacks by a dishonest party.

• Experimental imperfections:– Alice’s state preparation may be noisy– The communication line may be noisy– Bob’s measurement apparatus may be imperfect

• A dishonest party can controle everything outside the other party’s lab.

• Thus in the presence of imperfections, the guaranteed bounds on randomness will be worse

Alice’s Lab

Bob’sLab

Communication line

• For i=1 to n• Alice chooses ai=0,1 at random• Commitment:

– Alice sends |ψai> to Bob– <ψ0|ψ1>=cosθ

• Bob chooses bi=0,1 at random. • Bob tells Alice the value of bi .• Alice reveals the value of ai to Bob• Bob checks:

– estimates fidelity of states sent by Alice:

measures in basis |ψai>, space orthogonal to |ψai>

• Next i• If fidelity too small, Bob aborts• If fidelity sufficiently large,

Bob does not abort and ci=ai + bi mod 2

Quantum Protocol with imperfections

• Important parameters:– Scalar product <ψ0|ψ1>=cosθ between states

prepared by Alice– Fidelity f of states as estimated by Bob.

• Bounds on εB , HB depend on θ only.

• Bounds on εA , HA depend on f and θ,

for instance:

• Thus choose good compromise between <ψ0|ψ1>=cosθ and fidelity f

)ln

(sin

1

sin2

122 n

nO

ffA

Security Analysis

Implementation• |ψ0>=|+α> , |ψ1>=|-α> are

two coherent states(by changing the intensity |α|2, one changes the overlap <ψ0|ψ1>=exp[-2|α|2])

• Bob’s measurement:– displaces the states by D±α

– Uses a single photon detector to check that the state is the vacuum.

– If the detector clicks, then Alice could be cheating

Notes: • Displacement is simply realised by an interferometer• No need to restrict Hilbert space to single photon

subspace

x

p

|α>|-α>

x

p

|α>|0>=D-α|α>

Experimental setup

• All fiber optics

• Telecommunication wavelenghts

• Based on « plug an play » system for quantum key distribution (N. Gisin)

→suitable for long distance communication (our realisation: table top)

• Security Complication:– Light pulses produced by Bob, then go to

Alice, then reflected back to Bob

• Remark: upon attenuation, any state tends towards a mixture of coherent states

Typically A=104

Attenuation A

Gaussian Noise 1/A

Arbitrary state

Mixture of coherent states(positive P function)

• Security Solution:

first measure intensity, then attenuate: this produces a mixture of coherent states of known intensity

A

Classical Detector

Mixture of coherent states of known intensity

Intensity known

Experimental Results•Different choices of |α|, hence of <ψ0|ψ1>=exp[-2|α|2]•Curves assume a visibility v=97% (but it is sometimes worse)•Number of coins tossed n=104

All classical protocols haveεA + εB ≥0.5

All classical protocols have (HA + HB)/n ≤1(conjecture)

Summary

• Using quantum communication it is possible to generate very random strings of bits in the absence of noise.

• In the presence of imperfections the randomness goes down. Nevertheless experimental demonstration of bit strings generation using quantum communication (bits are more random than can be achieved using classical communication, at least according to the average bias criterion).

Outlook

• improve theoretical bounds,

• Improve experiment: – toss a single coin more random than

possible using classical communication;

– long distance bit string generation

• Collaborators:– Jonathan Barrett– Louis-Philippe Lamoureux– Edouard Brainis– David Amans

• Funding and Support: – Université Libre de Bruxelles (ULB)– Fonds National de la Recherche Scientifique (FNRS)– Communauté Française de Belgique (ARC)– Gouvernement Fédéral Belge (PAI)– European Community (project RESQ)