Instant Download of Quantum Cryptography and Computing Theory and Implementation 1st Edition R. Horodecki Ebook PDF, Every Chapter
Instant Download of Quantum Cryptography and Computing Theory and Implementation 1st Edition R. Horodecki Ebook PDF, Every Chapter
https://ebookfinal.com/download/quantum-communications-and-
cryptography-1st-edition-alexander-v-sergienko/
https://ebookfinal.com/download/cryptography-for-security-and-privacy-
in-cloud-computing-1st-edition-stefan-rass/
https://ebookfinal.com/download/quantum-computing-devices-principles-
designs-and-analysis-1st-edition-goong-chen/
https://ebookfinal.com/download/physics-and-theoretical-computer-
science-from-numbers-and-languages-to-quantum-cryptography-j-p-gazeau/
Quantum Theory II Aggregates of Particles D. R. Bates
(Editor)
https://ebookfinal.com/download/quantum-theory-ii-aggregates-of-
particles-d-r-bates-editor/
https://ebookfinal.com/download/grid-cloud-and-cluster-computing-1st-
edition-hamid-r-arabnia/
https://ebookfinal.com/download/quantum-engineering-theory-and-design-
of-quantum-coherent-structures-1st-edition-a-m-zagoskin/
https://ebookfinal.com/download/quantum-mechanics-theory-and-
experiment-1st-edition-mark-beck/
https://ebookfinal.com/download/subband-adaptive-filtering-theory-and-
implementation-kong-aik-lee/
Quantum Cryptography and Computing Theory and
Implementation 1st Edition R. Horodecki Digital Instant
Download
Author(s): R. Horodecki; S. Ya. Kilin; J. Kowalik
ISBN(s): 9781607505471, 1607505479
Edition: 1
File Details: PDF, 4.98 MB
Year: 2010
Language: english
QUANTUM CRYPTOGRAPHY AND COMPUTING
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
NATO Science for Peace and Security Series
This Series presents the results of scientific meetings supported under the NATO Programme:
Science for Peace and Security (SPS).
The NATO SPS Programme supports meetings in the following Key Priority areas: (1) Defence
Against Terrorism; (2) Countering other Threats to Security and (3) NATO, Partner and
Mediterranean Dialogue Country Priorities. The types of meeting supported are generally
“Advanced Study Institutes” and “Advanced Research Workshops”. The NATO SPS Series
collects together the results of these meetings. The meetings are co-organized by scientists from
NATO countries and scientists from NATO’s “Partner” or “Mediterranean Dialogue” countries.
The observations and recommendations made at the meetings, as well as the contents of the
volumes in the Series, reflect those of participants and contributors only; they should not
necessarily be regarded as reflecting NATO views or policy.
Advanced Study Institutes (ASI) are high-level tutorial courses to convey the latest
developments in a subject to an advanced-level audience.
Advanced Research Workshops (ARW) are expert meetings where an intense but informal
exchange of views at the frontiers of a subject aims at identifying directions for future action.
Following a transformation of the programme in 2006 the Series has been re-named and re-
organised. Recent volumes on topics not related to security, which result from meetings
supported under the programme earlier, may be found in the NATO Science Series.
The Series is published by IOS Press, Amsterdam, and Springer Science and Business Media,
Dordrecht, in conjunction with the NATO Public Diplomacy Division.
Sub-Series
http://www.nato.int/science
http://www.springer.com
http://www.iospress.nl
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
Quantum Cryptography and
Computing
Theory and Implementation
Edited by
Ryszard Horodecki
National Quantum Information Center of Gdask, Sopot, Poland
and
Janusz Kowalik
Seattle, USA
Institute of Informatics University of Gdask, Gdask, Poland
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
Proceedings of the NATO Advanced Research Workshop on Quantum Cryptography and
Computing: Theory and Implementations
Gdansk, Poland
9-12 September 2009
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or
transmitted, in any form or by any means, without prior written permission from the
publisher.
Publisher
IOS Press BV
Nieuwe Hemweg 6B
1013 BG Amsterdam
Netherlands
fax: +31 20 687 0019
e-mail: [email protected]
LEGAL NOTICE
The publisher is not responsible for the use which might be made of the following
information.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
Quantum Cryptography and Computing v
R. Horodecki et al. (Eds.)
IOS Press, 2010
© 2010 The authors and IOS Press. All rights reserved.
Preface
This book contains a selection of papers invited and presented at the NATO sponsored
Advanced Research Workshop on “Quantum Cryptography and Computing: Theory
and Implementation” held at the University of Gdansk, Poland from September 9th to
12th 2009. The purpose of the workshop was to assess the state of the art in the subject
areas and identify the most pressing research goals.
The workshop was an opportunity for about 38 experts from USA, Europe and the
countries of the former Soviet Union republics to discuss theoretical and applied
aspects of quantum cryptography and computing.
We wish to thank the NATO Public Diplomacy Division, Science for Peace and
Security section (SPS) and more specifically Dr. Chris De Wispelaere, Program
Director of Information and Communication Security, for the generous financial
support of the workshop.
Special thanks are due to the University of Gdansk administration represented by
the Rektor, Prof. Bernard Lammek, for making all meeting facilities available free of
charge.
The Workshop Office was skillfully run by ElĪbieta Bandura and Malgorzata
Chrustowska. An important workshop publicity and communication job was well done
by Piotr Arlukowicz. Several other people helped in various ways to make the
workshop successful. They are: Rafał Demkowicz-DobrzaĔski, Andrzej Grudka,
Michał Horodecki, Jarosław Korbicz, Łukasz Pankowski and Marcin Pawłowski. We
also express our sincere thanks to several persons who helped edit the NATO ARW
proceedings book. They are: Jarek Korbicz, Wiesław Laskowski and Marcin
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
Pawłowski.
Above all we are deeply grateful to the workshop participants, especially those
who contributed papers to this book.
R. HORODECKI
S. YA. KILIN
J. KOWALIK
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
This page intentionally left blank
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
vii
Contents
Preface v
Quantum Cryptography
Optimal Local Protocols for Processing of Entangled States – Local Cloning and
Eavesdropping 3
Rafał Demkowicz-Dobrzaski
Quantum Computing
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
viii
Quantum Algorithm for Preparing Thermal Gibbs States – Detailed Analysis 138
Chen-Fu Chiang and Pawel Wocjan
Local Bounds for General Bell Inequalities with the Reduced Entropy
of the Settings 224
Marcin Pawłowski, Karol Horodecki, Paweł Horodecki and Ryszard
Horodecki
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
ix
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
This page intentionally left blank
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
Quantum Cryptography
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
This page intentionally left blank
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
Quantum Cryptography and Computing 3
R. Horodecki et al. (Eds.)
IOS Press, 2010
© 2010 The authors and IOS Press. All rights reserved.
doi:10.3233/978-1-60750-547-1-3
Abstract. The problem of looking for the optimal local operations assisted by clas-
sical communication (LOCC) is investigated. A method based on semi-definite pro-
gramming is presented providing the optimal solutions or in worst case the up-
per bounds. The method is applied successfully to two problems: local cloning of
entangled states and local eavesdropping on secret sharing protocols.
Introduction
The main topic of all quantum information processing is: “how quantum features of phys-
ical systems change the way the information can be processed”. The feature that lays be-
hind all quantum enhanced information protocols is the quantum superposition principle.
The superposition principle when applied to composite systems inevitably leads to the
concept of entangled states—states that are correlated in a way which is not compatible
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
with any local, realistic, classical theory. The inherently quantum correlations allow for
performing task with precision or speed beyond the reach of classical information pro-
cessing. Quantum algorithms, quantum enhanced metrology and quantum cryptography
are the ones that promise the most spectacular applications [1] and good understanding
and control of entangled states is a prerequisite this.
Since creation of entanglement requires interaction between subsystems it is usually
only possible when two subsystems are relatively close to each other. When two subsys-
tems are separated by large distance it is technically extremely difficult to increase the
mutual entanglement. Entanglement swapping is required in which intermediate parti-
cles need to be prepared in between to allow for entanglement transfer between the two
subsystems of interest. From a practical point of view in processing of entangled states
it is not uncommon to find oneself in a situation that the only accessible operations on
subsystems are the local ones and no quantum interaction between the subsystems is
possible. More precisely the class of local operations contain independent evolution of
subsystems as well as local evolutions of subsystems which may be classically correlated
i.e. dependent on the classical communication between the two—local operations and
classical communication (LOCC).
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
4 R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States
The question what is possible and what is not with LOCC has opened a field of re-
search resulting in quantification of entanglement using various entanglement measures,
as well as surprising discovery of bound entangled states and inequivalence between
entanglement and private key distillation [2].
Whenever LOCC processing of entangled states is part of a protocol, achieving high
performance requires finding the optimal LOCC that maximizes a relevant figure of merit
e.g. information, fidelity, length of a secure key, etc. This optimization is usually highly
non-trivial due to complicated mathematical structure of LOCC. This paper discusses a
general framework for dealing with such problems and presents two successful applica-
tions where the optimal LOCC operation is found in the case of (i) cloning of entangled
states [5] and (ii) eavesdropping on quantum secret sharing protocols [6].
Consider two parties A and B that share a state ρAB ∈ L(HA ⊗ HB ), where L(H)
denotes the space of linear operators on Hilbert space H. If no restriction on locality
of evolution is imposed, the most general transformation of the state is described by a
completely positive (CP) map E : L(HA ⊗ HB ) → L(HA ⊗ HB ). Note that primed
Hilbert spaces may be of different dimensions than the input ones. Additionally, every
CP map may be written in the Kraus form:
ρA B = Egeneral (ρAB ) = Ki ρAB Ki† , (1)
i
where Kraus operators Ki : HA ⊗ HB → HA ⊗ HB need to satisfy trace preservation
†
condition i Ki Ki = IHA ⊗HB . Apart from describing interaction of a system with
environment, the Kraus form of a CP map may as well describe a quantum evolution
assisted by a quantum measurement in which case the value of index i is a measure-
ment result. The probability of the event reads pi = T r(ρAB Ki† Ki ) with subnormalized
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
where Ai : HA → HA
, Bj : HB → HB , should satisfy: i A†i Ai = IHA , j Bj† Bj =
I HB .
When classical communication is allowed, the two parties may coordinate local op-
erations on their subsystems i.e. measurement results on one subsystem may be com-
municated to the other one where it influences the local CP map performed. In general
there is no limit on the number of rounds of classical communication which causes the
description of LOCC complicated. The most general LOCC may be written in the form:
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States 5
ρA B = ELOCC (ρAB ) = Ki1 i2 ... ρAB Ki†1 i2 ... (3)
i1 i2 ,...
where
{i } {i } {i } {i } {i }
Ki1 i2 ... = . . . Ai5 <5 Ai3 <3 Ai1 ⊗ . . . Bi6 <6 Bi4 <4 Bi2 <2 . (4)
The symbol {i<n } denotes a set of indices {i1 , . . . , in−1 }, which is used to indicate
{i } {i }
that Kraus operators Ain<n , Bin<n may depend on all previous measurement results
communicated between the parties. Additionally, trace preservation condition requires
that each local CP map must be trace preserving hence:
{i }† {i } {i }† {i }
Ain<n Ain<n = IHA , Bin<n Bin<n = IHB . (5)
in in
It is tempting to simplify the above definition and consider simply CP maps which
allow for Kraus decomposition with Kraus operators being in product form:
ρA B = Eseparable (ρAB ) = Ai ⊗ Bi ρAB A†i ⊗ Bi† (6)
i
where i A†i Ai ⊗Bi† Bi = IHA ⊗HB . This class of separable operations clearly contains
the LOCC, yet due to the trace preservation condition (5) not all separable operations
can be written in the LOCC form [7] and the best way to determine whether a given
separable operation may be realized as an LOCC has been presented recently in [8].
When analyzing CP maps it is often convenient to make use of the Jamiołkowski
isomorphism [9] which establishes one-two-one correspondence between CP maps and
positive operators. To every CP map E : H → H one assigns a positive operator PE ∈
L(H ⊗ H) according to the formula:
where |Ψ+ = d1 i |i ⊗ |i is a maximally entangled state in the space H ⊗ H. Trace
preservation of a CP map translates to TrH (PE ) = IH /d. In other words every CP
map can be associated with a quantum state. The evolution may be written using PE as
follows:
For the problem considered in the paper the most important fact is that when the
Jamiołkowski isomorphism is applied to a separable CP map E : L(HA ⊗ HB ) →
L(HA ⊗ HB ) the resulting positive operator is PE ∈ L(HA ⊗ HB ⊗ HA ⊗ HB ) is a
separable state with respect to the partition HA ⊗ HA vs. HB ⊗ HB . Explicitly:
PE = PA i ⊗ PBi , (9)
i
where PAi = |Ai Ai |, PAi = |Bi Bi |, with |Ai ∈ HA ⊗ HA , |Bi ∈ HB ⊗ HB be-
ing vectors obtained after concatenating rows of Kraus operators Ai and Bi respectively.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
6 R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States
Relation between separable CP maps and separable states allows to apply a highly devel-
oped field of characterization and detection of entangled states into problems involving
separable CP maps. In particular since LOCC are a subset of separable CP maps it may
also help in dealing with those.
where F depends on the choice of the gain function while Ci and ci are responsible for
linear constraints.
Things become complicated when we additionally require that E is LOCC. There is
no known method of imposing LOCC constraint in semi-definite optimization problems.
Therefore one must resort to weaker constraints, e.g. separability. Problem of separabil-
ity is itself a non trivial task and in general cannot be solved efficiently. Nevertheless sys-
tematic methods exist which allow to deal with separability issue, which for small scale
problems are good enough. More importantly one of them [10] is based on semi-definite
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
programming. It relies on positive partial transpose criterion (PPT) [11,12] and the con-
cept of symmetric extension of the state. Since each separable state ρsep ∈ L(HA ⊗ HB )
may be written as:
i ⊗ ρi ,
pi ρA B
ρsep = (10)
i
transposition of one of the subsystems keeps the separable state positive semi-definite.
Moreover, for a separable state one can always find a symmetric extension to n copies of
⊗n−1
A (or B) subsystem i.e. the state ρsym
sep ∈ L(HA ⊗ HB ⊗ HA ) which after tracing out
any of n − 1 subsystems A yields the original ρsep , and is invariant under permutations
of subsystems A. It is clear that the following state satisfies the above requirements:
i ⊗ ρi ⊗ ρi
A⊗n−1
ρsym
sep = pi ρA B
. (11)
i
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States 7
with respect to all bi-partite partition of the state. Both symmetry constraint and PPT are
easily incorporated into semi-definite program—symmetry constraint is simply a set of
linear equalities, while PPT is a semi-definite constraint on partially transposed matrix.
Interestingly, it was proven that if a state is entangled for some n the algorithm will stop
and return the answer that the state does not allow for a n-fold symmetric, PPT, exten-
sion proving that indeed the state is entangled. The downturn of the algorithm is that n
needed to detect entanglement may be large and algorithm will require huge computa-
tional resources to provide the answer.
Nevertheless the algorithm is an excellent tool for problems of optimization of sep-
arable operations. One should simply add sequentially PPT and symmetric extension
conditions for increasing values of n. One first runs optimization with constraints corre-
sponding to n = 1. After that one should check with other tools whether obtained state
PE is separable. If it is separable then the problem of finding the optimal separable oper-
ation is solved. If not one need to increase n and run again the optimization procedure,
check if the resulting state is separable and proceed accordingly. The non-trivial part is of
course proving that given state PE is separable, which sometimes may be easy by giving
explicit decomposition. If it is not and one is not able to prove that the state is separable
one can at least claim to find an upper bound on the optimized quantity.
We now return to the main problem of LOCC optimization. Unfortunately there
is no known semi-definite constraints analogous to [10] designed for LOCC. However,
since LOCC are subset of separable operation, one can simply impose separability con-
straint on optimized CP maps and eventually check whether obtained separable transfor-
mation is indeed LOCC using e.g. [8], or by “guessing” explicit LOCC protocol. If it is
found that no LOCC is able to realize the operation found, one has to treat the result of
optimization as an upper bound to the problem of optimizing LOCC.
3. Applications
We present here two application of the previously mentioned procedure where the opti-
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
mal LOCC operation have successfully been found and moreover only simple PPT con-
straint (n = 1) was sufficient to obtain the result.
Perfect cloning of nonorthogonal states is not possible [13]. Given a set of states which
contain mutually nonorthogonal states one may ask the question what is the best ap-
proximate cloning procedure yielding clones of highest possible quality. Many approx-
imate optimal clonings have been found for various sets of states. Here we consider the
problem of 1 → 2 cloning of two-qubit entangled states using LOCC operations.
The problem is formulated as follows. Two parties A and B share a two-qubit state
which is drawn randomly from a set S = {|ψ(1) , |ψ (2) . . . }, with respective proba-
bilities pi . The cloning transforation E : HA ⊗ HB → HA ⊗ HB , where HA =
(i)
HA1 ⊗ HA2 , HB = HB1 ⊗ HB2 produces the output state ρA1 A2 B1 B2 = E(|ψ (i) ) of
the two clones. We will consider symmetric
cloning in which reduced
density matrices
of
(i) (i) (i)
each of the clones are identical TrA2 B2 ρA1 A2 B1 B2 = TrA1 B1 ρA1 A2 B1 B2 = ρclone .
The quality of cloning is quantified using the average fidelity:
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
8 R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States
(i)
(i)
F = pi ψ (i) |ρclone |ψ (i) = pi ψ (i) |ρclone |ψ (i) (12)
i i
Using Jamiołkowski isomorphism the fidelity can be written in terms of the positive
operator PE ∈ L(HA1 ⊗ HA2 ⊗ HB1 ⊗ HB2 ⊗ HA ⊗ HB ):
F = pi ψ (i) |TrHA HB HA2 HB2 IHA1 HA2 HB1 HB2 ⊗ |ψ (i) ψ (i) |TAB PE |ψ (i) =
i
(i) (i) (i)
= Tr pi |ψ ψ |A1 B1 ⊗ IA2 B2 ⊗ |ψ ψ (i) |TAB PE (13)
i
where UA , UB are single qubit unitary operations, and α ∈ (0, 1/2) is a square of the
Schmidt coefficient determining the degree of entanglement of the state.
LOCC constraint if the state is entangled it is not possible to produce perfect clones since
the amount of entanglement√ cannot increase
√ under LOCC. Without loss of generality let
the cloned state be |ψ = α|00 + 1 − α|11. Clearly if α = 0 the state can be
perfectly cloned F = 1, while for α = 1/2 it is expected to be most difficult. The fidelity
of the optimal cloning as a function of α is plotted in Fig.1. Instead of a single curve,
a gray shaded area is given which depicts the region between upper and lower bounds.
The upper bound was obtained using PPT constraint on cloning operation, for which the
author was not able to prove it can be realized by LOCC. The lower curve corresponds to
a simple LOCC strategy which with probability 1/2 gives the original state to clone 1 or
clone 2, while the remaining clone is provided with separable state closest to the original
in terms of fidelity which in our case is |11. Notice that the region between the bounds
is quite narrow and the simple LOCC strategy mentioned above is optimal for product
α = 0 (obvious) , and maximally entangled states α = 1/2 (less obvious).
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States 9
Figure 1. Fidelities of cloning of two-qubit entangled states, with a given degree of entanglement. α denotes
the square of the Schmidt coefficient. Gray curves correspond to the problem when only one entangled state
need to be cloned. Black curves correspond to the problem when all states belonging to the same local orbit
need to be cloned.
Let us √assume that the set Sα contains all the states having the same Schmidt coef-
ficient α, i.e. belonging to the same orbit generated by the action of UA ⊗ UB ∈
SU (2) ⊗ SU (2). Direct optimization may not be the best idea since the set Sα contains
infinite number of states. Still, one could take a discrete subset and if the subset was large
to cover the orbit densely enough one would observe that adding more states does not
decrease fidelity any more, and hence one could conjecture that he has found the optimal
transformation for all state belonging to the orbit.
There is however a better way, applicable in all situation when the set S can be
regarded as an orbit of a group representation acting on the Hilbert space. In such cases
it is known [14] that optimal transformation may always be found within the class of
covariant ones. Therefore we can restrict ourselves to cloning transformations covariant
with respect to the action of arbitrary local unitary operations UA ⊗ UB :
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
E UA ⊗ UB ρAB UA† ⊗ UB† = UA⊗2 ⊗ UB⊗2 E(ρAB )UA⊗2† ⊗ UB⊗2† . (15)
For convenience, let us introduce an operator P̃E which is the operator PE but with dif-
ferent ordering of subspaces, namely: P̃E ∈ L(H1A ⊗ H2A ⊗ HA ⊗ H1B ⊗ H2B ⊗ HB ).
The covariance condition for P̃E reads
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
10 R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States
The space H1A ⊗ H2A ⊗ HA can be decomposed into invariant subspaces under the
action of UA ⊗ UA ⊗ UA∗ . There are two two-dimensional invariant subspaces and one
four dimensional subspace:
where ai are arbitrary real parameters. Hence, the most general form of a positive oper-
ator P̃E , satisfying covariance condition, reads
5
P̃E = aij Ti ⊗ Tj , (20)
i,j=1
where we now have 25 real parameters aij , which have to be chosen such that the op-
erator P̃E is positive. This significantly simplifies the optimization problem. Taking into
account additional constraints for trace preservation and symmetry of the clones and
imposing separability constraints one can run semi-definite optimization.
Results are presented in Fig. 1. Black dashed line corresponds to the optimal cloning
of states belonging to the orbit when no LOCC constraint is imposed. The solid line is
the optimal LOCC strategy which was obtain by imposing PPT constraint (n = 1) and
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
the obtained results was subsequently proved to by indeed realizable by LOCC [5]. The
balck dotted line corresponds to a simple local strategy in which both parties perform
independently optimal local cloning using Buzek-Hillery machine (BH ⊗2 √)[15]. It is
interesting to note that up to a certain threshold, namely for α < (5 − 15)/10 ≈
0.1127, the BH ⊗2 is indeed the optimal LOCC strategy. Above this threshold, however,
communication between the parties is advantageous and the optimal LOCC is no longer
the BH ⊗2 . For maximally entangled states α = 1/2, F = 5/8 ≈ 0.625 and the optimal
operation LOCC achieving this fidelity is very simple. A decides randomly which clone
will get the original state and communicates this choice to B, who also transfer the state
to the chosen clone. The other clone gets maximally mixed state. Since A will chose each
clone with probability 1/2 the average fidelity of each clone can be simply calculated as
F = 1/2 + 1/2 · 1/4 = 5/8.
Secret sharing is the problem of distributing secret information between many parties
in the way that without cooperation of all (or majority) of the parties secret cannot be
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States 11
revealed. Consider the simplest case of one sender (A) and two receivers (B1 , B2 ). For
transmitting a binary message string {ai }, A can then take a sequence of random bits
{b1,i }, send it to B1 , and at the same time send a sequence {b2,i } = {ai ⊕ b1,i } to B2 ,
where ⊕ denotes addition modulo 2. Thus ai = b1,i ⊕ b2,i , assuring that the Bobs can
recover the message if they cooperate, and yet none of them can learn anything about the
message of A on his own, since the sequences {b1,i }, {b2,i } are random.
Apart from distributing bits among receivers, all parties need to make sure that no
other party (fourth) has eavesdropped on communication. This can be done using two
independent BB84 protocols establishing secret keys between A and B1 and A and B2 ,
which allow for secure communication. In what follows we denote this as BB84⊗2 pro-
tocol. It has been argued [16] that a more natural way of using quantum states in secret
sharing is to send entangled states to the Bobs, and as a result, avoid establishing random
keys with each of the Bobs separately, by combining the quantum and classical parts
of secret sharing in a single quantum protocol. We call the protocol E4 (since it uses
four entangled states) [17,16]. We compare security of the two protocols under the as-
sumption that an eavesdropper can perform LOCC attacks. Optimizing the eavesdropper
attack as will be shown below can again be cast into a semi-definite program.
The E4 protocol proceeds as follows. A sends randomly one of the four states, which
we group in two pairs, and denote (with a bit of abuse of the meaning of the word basis)
as basis 1 and basis 2:
1 1
basis 1: |ψ 1,0 = √ (|00 + |11), |ψ 1,1 = √ (|00 − |11) (21)
2 2
1 1
basis 2: |ψ 2,0 = √ (|00 + i|11), |ψ 2,1 = √ (|00 − i|11) (22)
2 2
A assigns bit value 0 to states |ψ 1,0 , |ψ 2,0 and bit value 1 to |ψ 1,1 , |ψ 2,1 . Each of
the receivers perform a measurement randomly either in σx or σy basis, and assigns bit
value 0 or 1 for measured eigenvalue −1 or 1 respectively. After communication A and
Bobs announce publicly the basis in which they performed measurement, and keep only
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
the results in which: (i) A used basis 1, whereas Bobs measured σx ⊗ σx basis or Bobs
measured σy ⊗ σy (in which case A additionally inverts her bit), (ii) A used basis 2 and
Bobs measured either σx ⊗σy or σy ⊗σx . If no disturbances occurred A and Bobs should
have strings of bits satisfying secret sharing requirements.
In reality there always will be errors in communication which can be assessed by
A and Bobs by revealing part of their bits and determining qubit error rate (QBER). If
QBER is below certain threshold one can perform error correction and privacy amplifi-
cation in order to get error-free and secret key. The threshold will in general depend on
the type of allowed attacks allowed for an eavesdropper. Here we assume that an eaves-
dropper is limited to performing LOCC attacks and does not have a quantum memory.
ρj,a
B1 B2 E1 E2 = E(|ψ
j,a
ψ j,a |), (23)
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
12 R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States
part of which is send to the legitimate receivers and part of which is kept by the eaves-
droppers. The attack is LOCC with respect to the partition B1 , E1 | B2 , E2 .
Subsequently, E1 , E2 perform an LOCC measurement on their subsystems in or-
der to obtain information about the bit shared by Alice with the Bobs, while sending
possibly-perturbed subsystems B1 , B2 to their legitimate recipients. Without loosing
generality, we can restrict this measurement to have only two possible outcomes (0 or
1), since only the value of a transmitted bit is of interest to the eavesdroppers. Hence
we model the measurement by a two-element positive operator valued measurement
(POVM) {ΠE1 E2 (e)}, e = 0, 1. Obviously
where p(j, a) = 1/4 is the probability that Alice sends the state |ψ j,a in a given round,
whereas {ΠB1 B2 (j, b)} is a POVM corresponding to the measurement by the Bobs in
the basis j (compatible with the state sent by Alice), where the sum of their individual
measured values, modulo 2, equals b.
Equivalently we may define conditional transformation on Bobs state depending on
the measurement value of the eavesdroppers:
1
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
The attack is therefore fully specified by two LOCC CP maps E0 , E1 . Notice that in-
dividually they do not have to be trace preserving since they correspond to conditional
transformation, but the sum E0 + E1 has to be a proper trace preserving LOCC map.
In standard two party cryptography, A and B can distill secure key from bits distributed
independently according to probability distribution pABE performing error correction
and privacy amplification. The key rate K asymptotically achievable by one way com-
munication is given by the Csiszár-Körner criterion [18]:
The original derivation of the criterion was based on the assumption that error correction
may be performed either from A to B or the opposite way. As was noted in [6] in se-
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States 13
cret sharing since each of the Bobs individually has a completely random string of bits
the error correction procedure may only be performed from Bobs to A. The modified
Csiszár-Körner criterion for secret sharing has the form:
A detailed discussion of one way error correction procedure in secret sharing is given in
Appendix A.
For simplicity we may assume that since bit values transmitted by A are equally
probable the attack by the eavesdroppers is also symmetric i.e. it does not distinguish
states carrying different bit values. A and Bobs are able to determine their QBER which
in turn allows them to calculate their mutual information I(A : B) = h(QBER), where
h(x) = −x log2 x − (1 − x) log2 (1 − x). In order to determine K they need to find
the optimal attack by the eavesdroppers that will provide them with highest possible
value of I(B : E) for fixed QBER. Since the attack is symmetric the probability distri-
bution pBE (b, e) depends only on one real number: pBE (0, 0) = pBE (1, 1) = 1 − q,
pBE (1, 0) = pBE (0, 1) = q where q denotes probability that E and B bits disagree.
Maximizing I(B : E) is therefore equivalent to maximizing q. Using Eq. (27) we can
write:
1
q= Tr Ee (|ψ j,a ψ j,a |)ΠB1 B2 (j, b)δe,b⊕1 . (30)
4
j,a,b,e
Analogously QBER:
1
QBER = Tr Ee (|ψ j,a ψ j,a |)ΠB1 B2 (j, b)δa,b⊕1 . (31)
4
j,a,b,e
with linear constraints: fixed QBER and trace preservation condition. We approach the
LOCC condition constraint again in the way described in Sec. 2. The same procedure
may be performed for BB84⊗2 protocol. We have performed the optimization both with
LOCC constraint and without. The results are depicted in Fig. 2.
Again it was enough to impose just PPT criterion (n = 1), the explicit LOCC decompo-
sition of the optimal attack was given in [6]. It is clear from the plot that imposing LOCC
constraint on eavesdroppers attack strongly favors the use of entangled states in secret
sharing and even though only four states are used in E4 as compared with effectively
sixteen different product states in BB84⊗2 the distillable key is longer for E4.
There is a close relation between cloning and eavesdropping on quantum key distribution
protocols. It is quite intuitive that a reasonable strategy for an eavesdropper is to perform
the optimal cloning on the flying quantum state, send one clone to the legitimate receiver
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
14 R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States
Figure 2. Achievable key rate for secret sharing protocols: E4 (based on the use of four entangled states),
BB84⊗2 (based on product states). The length of the key is plotted against observable qubit error rate (QBER).
Without the LOCC constraint on the attacks of the eavesdropper the E4 performs much worse than BB84⊗2
simply due to smaller number of states being used in the protocol. Nevertheless if eavesdropper are limited to
LOCC attacks the distillable key rate for E4 protocl outperforms that of BB84⊗2 .
and keep the other clone for himself. It is known that indeed optimal individual attack on
BB84 protocol is equivalent to optimal asymmetric cloning [4]. An interesting question
is whether the same holds for the case of E4 protocol and LOCC attacks.
Since E4 makes use of maximally entangled states we will make use of the optimal
LOCC cloning of maximally entangled states shown in Sec. 3.1. Notice that no matter
whether we want to clone a single maximally entangled state or the whole local orbit,
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
the optimal strategy for cloning is to keep the original state for one of the clones with
probability 1/2 and provide the other one with separable state that will guarantee the
highest fidelity. It is no different for E4 states, the fact that can again be checked by
running semi-definite programming in the fashion presented in Sec. 3.1. The separable
state that guarantees the highest fidelity can be taken as 1/2(|0000| + |1111|). The
LOCC cloning yields fidelity F = 3/4 in this case, hence the same as for cloning of a
single maximally entangled state.
Notice, however, that cloning focuses on providing two good quality clones, the
quality of which is related to I(A : B) and I(A : E). When optimizing cloning one
does not take care of I(B : E) at all. In fact the optimal cloning procedure just described
yields I(B : E) = 0! Since Cszisár-Körner criterion for secret sharing is based on
I(B : E) rather than I(A : E) this kind of attack is useless from the point of view
of an eavesdropper. Unlike for standard BB84 it seems that for the problem considered
here there is no clear connection between the optimal LOCC cloning and optimal LOCC
eavesdropping.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States 15
Conclusions
The reasoning is an adapted version for secret sharing scenario of secret key reconcilia-
tion procedures in standard bipartite cryptography, see e.g. [19].
Let A, B1 , B2 be n-bit strings shared by the three legitimate parties in secret sharing.
If there are no errors in the communication the string C = A ⊕ (B1 ⊕ B2 ) which is a
bitwise addition modulo 2 should consist only of bit values 0. Let C̄ be the sum of all
bits in the string C. Let p be the probability of error in the communication from A to
Bobs. The expectation value of C̄ is n · p.
The error correction procedure proceeds as follows. Let f : {0, 1}n → {0, 1}m
be a random function from n-bit strings to m-bit strings. The m-bit strings will play
a role of labels and the length m will be determined later. Each of the Bobs apply the
same random function f to their strings and communicate labels f (B1 ), f (B2 ) to A.
A then checks all strings B1 , and B2 such that f (B1 ) = f (B1 ), f (B2 ) = f (B2 ),
and takes the ones for which the Hamming distance dist(B1 ⊕ B2 , A) is the smallest.
Let us now calculate the probability p(!) that the error correction is successful, i.e. that
the B1 and B2 chosen by A are such that B1 ⊕ B2 = B1 ⊕ B2 . p(!) is equal to the
probability that: for all B1 , B2 , dist(B1 ⊕ B2 , A) = dist(B1 ⊕ B2 , A) implies that
B1 ⊕ B2 = B1 ⊕ B2 and dist(B1 ⊕ B2 , A) < dist(B1 ⊕ B2 , A) implies that either
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
f (B1 ) = f
(B1 ) or
nf (B2 ) = f (B2 ).
r
Nr = j=1 j is the number of n bit strings that differ from a given one in at most
r places. Probability that two randomly chosen m-bit strings are identical is 1/2m . Let
us first assume that C̄ ≤ r. There are Nr · 2n possible pairs {B1 , B2 } compatible with
this assumption. Probability that some other pair {B1 , B2 } will be encoded using the
same labels i.e f (B1 ) = f (B1 ), f (B2 ) = f (B2 ) is equal to (1/2m )2 . Therefore under
assumption that C̄ ≤ r error correction succeeds with probability:
2n N r
1
p(!|C̄ ≤ r) = 1− . (32)
22m
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
16 R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States
Let us take r = np + n/ log n (the base of the logarithm is 2), where x denotes
largest integer number smaller or equal to x. Using Chebychev inequality we have:
r
n
≤ 2nh(r/n) ≤ 2nh(p+1/ log n) (35)
j=1
j
where h(x) = −x log x − (1 − x) log(1 − x). Combining the two inequalities we get:
2n 2nh(p+1/ log n)
1 p(1 − p)(log n)2
p(!) ≥ 1− − ≥
22m n
p(1 − p)(log n)2
≥ exp[−2n[1+h(p+1/ log n)]−2m ] − (36)
n
It remains to choose m high enough that the in the limit of large n the probability of
success approaches 1. For this it is enough to choose:
1 1
m = n[1 + h(p + 1/ log n)] + log log n, (37)
2 2
where x denotes smallest integer greater or equal to x:
References
[1] M. A. Nielsen and I. L. Chuang, Quantum Computing and Quantum Information, Cambridge University
Press, 2000.
[2] R. Horodecki, P. Horodecki, M. Horodecki, and K. Horodecki, Quantum entanglement, Rev. Mod. Phys.
81 (2009), 865.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
R. Demkowicz-Dobrzański / Optimal Local Protocols for Processing of Entangled States 17
[3] G. M. D’Ariano and P. Lo Presti, Optimal non-universally covariant cloning, Phys. Rev. A 64 (2001),
042308.
[4] N. Gisin and G. Ribordy and W. Tittel and H. Zbinden, Quantum cryptography, Rev. Mod. Phys. 74
(2002), 145.
[5] R. Demkowicz-Dobrzański, M. Lewenstein, A. Sen(De), U. Sen, and D. Bruß, Usefulness of classical
communication for local cloning of entangled states, Phys. Rev. A 73 (2006), 032313.
[6] R. Demkowicz-Dobrzański, A. Sen(De), U. Sen, and M. Lewenstein, Entanglement enhances security
in quantum communication, Phys. Rev. A 80 (2009), 012311.
[7] C. H. Bennett, D. P. DiVincenzo, C. A. Fuchs, T. Mor, E. Rains, P. W. Shor, J. A. Smolin, and W. K.
Wootters, Quantum nonlocality without entanglement, Phys. Rev. A 59 (1999), 1070.
[8] S. M. Cohen, When a quantum measurement can be implemented locally and when it cannot,
arXiv.org:0912.1607 (2009).
[9] A. Jamiolkowski, Linear transformations which preserve trace and positive semidefiniteness of opera-
tors, Rep. Math. Phys 3 (1972), 275.
[10] A. C. Doherty, P. A. Parrilo, and F. M. Spedalieri, Complete family of separability criteria, Phys. Rev. A
69 (2004), 022308.
[11] A. Peres, Separability criterion for density matrices, Phys. Rev. Lett. 77 (1996), 1413.
[12] M. Horodecki, P. Horodecki, and R. Horodecki, Separability of mixed states: necessary and sufficient
conditions, Phys. Lett. A 223 (1996), 1.
[13] W. K. Wooters and W.H Zurek, A single quantum cannot be cloned, Nature 299 (1982), 802.
[14] R. F. Werner, Optimal cloning of pure states, Phys. Rev. A 58 (1998), 1827.
[15] V. Bužek and M. Hillery, Quantum copying: Beyond no-cloning theorem, Phys. Rev. A 54 (1996), 1844.
[16] M. Hillery, V. Buzek, and A. Berthiaume, Quantum secret sharing, Phys. Rev. A, 59 (1999), 1829.
[17] M. A. Horne M. Zukowski, A. Zeillinger and H. Weinfurter, Quest for GHZ states, Acta Phys. Pol. A 93
(1998), 187.
[18] I. Csiszár and J. Körner, Broadcast channels with confidential messages, IEEE Trans. Inf. Theory 24
(1978), 339.
[19] G. Brassard and Norway L. Salvail, Secret-key reconciliation by public discussion, Workshop on the
theory and application of cryptographic techniques on Advances in cryptology, p.410-423, Lofthus,
Norway, 1994.
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
18
Quantum Cryptography and Computing
R. Horodecki et al. (Eds.)
IOS Press, 2010
© 2010 The authors and IOS Press. All rights reserved.
doi:10.3233/978-1-60750-547-1-18
Abstract. Since 1997 Senetas Corporation Limited has designed and manufactured
network encryption hardware that allows high speed voice, video and data networks
to operate securely when data is in transmission. Senetas has its encryptors de-
ployed to secure the world’s most critical information networks for governments,
military, foreign agencies, banking and financial institutions in over 40 countries.
Taking developments from the labs of the University of Geneva and idQuantique,
Senetas jointly created the world’s first, and fastest, commercial quantum en-
cryption solution in 2007. Since then Senetas has quantum-enabled its globally-
accredited classic encryption hardware to future-proof customers, and continues to
work with idQuantique and the University of Geneva to add further functionality
to the high speed quantum encryption solution, now deployed on four continents -
Africa, Asia, North America and Europe.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
J. Dubois / Commercial Potential of Quantum Cryptography 19
means that an independent third party has assessed our technology and verified it. Sene-
tas also released the world’s first hybrid quantum encryptor and that solution recently
underwent accreditation and gained EAL4+ accreditation for our CypherNet encryptors
using the encryption keys generated by the quantum key distributor (QKD) -this world
first certification for encryption using QKD-generated keys is further validation of our
technology. We have interoperability across Ethernet from 10 Gigabits per second (10
Gbps) to 10 Megabits per second (10Mbps). So the technology that Senetas deploys is
what we call ”bump in the wire”: we secure data in transmission at line speed, also called
’wire speed’, up to 10 Gigabits per second.
still deployed. It is a standards- based solution for SDH (SONET), Ethernet ATM, Fibre
Channel and Microwave. We secure a State police force in Australia for Voice-Over-
IP (VOIP) and data over microwave. Our products are upgradable and future-proofed.
When we did our quantum encryption collaboration with idQuantique in 2006 and we
launched the product in 2007, we have since then brought quantum enablement into all
our products. What does that mean? It means that at any stage in the future, if any one of
our customers wanted to become quantum-enabled, all they would need to do is to buy
a QKD device. Technology differentiators are: very low latency, very high performance
(layer 2 encryption is a lot more simple - you do not have to set up routing tables), we
retain full network bandwidth availability. The alternative approach to ours is that you
put a blade inside a network switch or router on a layer 3 network and there is a lot
of manual intervention needed from the operators. Senetas technology is military grade
encryption that operates at line speed. We allow organisations to secure their information
using all the bandwidth they paid for - not a good move for Telcos because they want
to be selling more bandwidth: we call that ’encryption tax’ because layer 3 has 40%
and up to 50% more bandwidth usage and high degrees of latency. We are also ROHS
(reduction of hazardous substances) compliant. This is required for us to sell in certain
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
20 J. Dubois / Commercial Potential of Quantum Cryptography
countries across Europe and certainly some countries in Asia. Lower cost of ownership
comes from our automatic key management and ease of configuration. The reality is
that if we understand the network configuration before we deploy it is only a 20 minute
installation. There is little ongoing maintenance. Our encryptors have about seven years
of battery life and 55,000 hours MTBF. We run on simple network management protocol
software (SNMP version 3) - version 3 being the most secure.
Our current roadmap shows we have been around since 1997. Today we are accred-
ited to EAL4+; tomorrow we will be at secret level. We are actually building high grade
encryptors for the Australian Government right now. We are 10 Gbps today, but we are
building new devices that will be capable of up to 100 Gbps. The new encryptors we
release in the next 12-18 months will also shrink the 10 Gbps chassis down in size from
3U to 1U and we will reduce the cost of manufacturing and we will have high perfor-
mance across all areas. We are currently developing WiFi encryption. Our Government
approached us to look at WiFi because the current technology itself is not totally se-
cure, so we have taken our Layer 2 product and with our knowledge of encryption we
have wrapped it around WiFi. It is still in our labs, but will be released midway through
2010. Innovation: I want to address a couple of issues - there’s CypherStream, there’s
WiFi, there’s Black Ice, Fibre channel and Tivoli-in-a-box. So Senetas is moving from
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
J. Dubois / Commercial Potential of Quantum Cryptography 21
all cellular networks, WiFi or major satellite systems. Chinzacorp also has a solution de-
veloped around our 19” rack-mounted encryptors that has been demonstrated to secure
command and control operations for police and military application.
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
This diagram shows how we do fibre channel encryption. The advantage of this is
that when data is at rest it is fully encrypted, irrespective of who you buy storage from,
but while it is on the move it is not encrypted. We happen to secure this for the Hong Kong
Treasury. Storage Area Networks (SANs) are growing and as storage grows exponen-
tially, organisations are setting up more and more SANs. These can be 70-100 km away
from central areas, simply based on different power grids and disaster recovery require-
ments. The benefit of the Senetas solution is that all data on the move is fully encrypted.
It is high performance. It suits banking requirements. It suits military requirements. It is
purpose built encryption and it is independent encryption for a fibre link channel. Tivoli.
What we have done is taken the small footprint encryptor, CypherStream, and we have
developed a new low cost 100 Mbps device. We have done this for a number of reasons.
We want to introduce a category killer into the market - a 100 Mb Ethernet device run-
ning Layer 2, but also switchable to Layer 3 with all the attributes of the previous one,
including custom algorithms, Japanese and Korean algorithms, plus the ability to encrypt
satellite. This is all proven Senetas technology that links in and talks to the rest of our
devices. We can also have 509 of these talking to our 1 Gbps device. This device will
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
22 J. Dubois / Commercial Potential of Quantum Cryptography
be certified to EAL4+ and will also be going through FIPS accreditation. What we have
done is incorporate expertise that resides in Senetas within the consulting division of our
company - this division is the single largest IBM Tivoli implementer and trainer in the
region. So we have taken the Tivoli software and expertise and loaded it into the Cypher-
Stream encryptor, hence Tivoli-in-a-box. What this really means is that Senetas can pro-
vide secure software-as-a-service (SAAS). The benefit of this is that an organisation that
normally deploys a number of agents (eg Tivoli storage) with a number of different staff
monitoring, gains an immediate return on investment (ROI). It gives the satisfaction and
knowledge that for 365 days a year the networks are absolutely being monitored at every
point they choose - it could be storage, memory, anything. The CypherStream 100 is in
final development and due for release early in 2010. It is based on an Intel platform and
is targeting the 100 Mbps encryption market, but we have tested it internally running at
well over 180 Mbps and we expect to be able to take it to a maximum 400 Mbps. It is
running at a true 100 Mbps IPSec and the latency on this is one millisecond, which is
very low latency. It uses a standard AES256-bit key software encryption. It is tamper
proof in its rack mount and we have passed all emission testing.
We think the benefits of using Senetas technology are:
• it is bump in the wire
• set and forget - you just set up your policies and the frequency with which you
change keys (most military change every hour but you can go down to five minute
intervals should you choose)
• it will cause no impact on the network - it is Layer 2 encryption so we encrypt all
higher layer protocols
• we support multicast, point-to-point, multipoint, hub and spoke and all meshed
technologies - in fact the largest environment we run in is a 6000 node network
• it is a purpose-built accredited security device.
As we said earlier on we did a collaboration with idQuantique of Switzerland in which
we commercialised the quantum cryptography that they had put forward. We were the
first multi-megabit hybrid quantum-crypto developed and in 2002, when everyone else
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
was only achieving 1 Mbps inside the labs, we were already at 1 Gbps and today we
are at 10 Gbps. As I said our product is future-proof. We have won a range of different
technology awards including Frost and Sullivan, the Australian AIIA ’i-Awards’ and we
were a finalist in the regional APICTA awards. We achieved significant media coverage
for our quantum development and the subsequent use of this technology to secure vot-
ing and referenda in Switzerland. It has been a very successful implementation for us.
Smart City of Africa: The physicists at the University of KwaZulu Natal at their Quan-
tum Technology Centre have installed a quantum communications security solution over
the optical fibre network infrastructure being run by the local council. The whole object
is to make the city of Durban the world’s first quantum city. It is based on the eThekwini
smart city initiative, that is, they want to use this project to show the city’s capabilities
to offer quantum security solutions to all users on this recently installed fibre network.
This will make Durban South Africa the only city in Africa with the ability to share its
broadband access to vital services, businesses schools, hospitals and tertiary institutions.
With Durban being the smart city of Africa, the next generation of networking solutions
have prompted it to leap into the quantum regime. The quantum project allows the vi-
tal services of the city to penetrate securely into municipal buildings in three locations:
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
J. Dubois / Commercial Potential of Quantum Cryptography 23
Pinetown, Westville and Cato Manor. Such a test-bed will pave the way for a further
rollout of quantum security solutions to create an unsurpassed communications solution.
Government agencies, finance houses and large corporate clients have expressed their
interest in securing their confidential data. Partners in this project include the Centre
for Quantum Technology at the University of KwaZulu Natal, idQuantique, Senetas and
the eThekwini municipal council. The description of this network is that it consists of a
four-node MAN star architecture and the links will vary between 1.5 km and 30 km. It
is all live and we actually protect finance and medical records. We have partnered with
idQuantique again to prove that quantum encryption can do multipoint and can run at
much higher speed. We have a 10 Gbps high speed Ethernet solution that has gone live
in Switzerland, called the Swiss Quantum Project. It consists of three nodes in the city of
Geneva in a triangular configuration connected by optical fibres and a host of quantum
technology and data encryption equipment. The network is used to secure a 10 Gbps
Ethernet link between CERN, the European Nuclear research body and the University of
Geneva. The multimode quantum test-bed will provide long term testing, demonstration
of quantum cryptography and its applications will be used for R&D, demonstration and
education purposes in the field of quantum communications demonstrating multimode
security. Senetas, idQuantique and NECTEC: This is the hybrid quantum system jointly
developed between Senetas and idQuantique which was sold to NECTEC, Thailand’s na-
tional science and technology development agency. They became the first country in Asia
with quantum encryption. NECTEC has established a quantum encryption R&D test-bed
and demonstration centre for Thai government and business. Senetas and NECTEC have
signed a memorandum of understanding and agreed to share knowledge and practical
skills, to exchange Senetas engineers and NECTEC research scientists for collaborative
work programs and to collaborate in identified fields including communications infras-
tructure and intelligent systems. We have just had a NECTEC scientist returned to Thai-
land recently having visited Australia and worked with our engineers on very specific
areas for a project I will now discuss. Better Health for All Thai Citizens. This is called
the e-health or smart health project and it has been initiated by NECTEC. They have set
a goal of ”providing a smart health information system for smart living and better care
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
services that will eventually enable a healthy Thailand” - that’s their objective. Over the
next 10 years Thailand’s objective is that all citizens should have access to good health
and predictive and preventative health care services to protect themselves from illness
and disease. The project is led by Dr Asanee, deputy director of NECTEC, and funding
for this has already been received - in excess of 100 Billion Baht which is about $US4
billion. So in summary I would like to repeat that Senetas is an organisation that leads
the world in its development and deployment of encryption.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
24 Quantum Cryptography and Computing
R. Horodecki et al. (Eds.)
IOS Press, 2010
© 2010 The authors and IOS Press. All rights reserved.
doi:10.3233/978-1-60750-547-1-24
Introduction
A number of protocols for electronic voting have been developed and successfully ap-
plied in the last decades [1]. In the modern electronic voting systems the information se-
curity is provided by the means of public-key cryptography, guaranteeing secrecy under
condition of limited computational resources of a potential adversary. With the advent
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
of quantum computers [2] this condition becomes impractical, thus inspiring interest in
unconditionally secure voting schemes and protocols. One perspective way to this end is
connected with using the quantum systems as information carriers, which proved to be
successful for the development of unconditionally secure key distribution; the technol-
ogy known as quantum key distribution [3] has reached presently the level of commercial
realizations.
In the present work we consider a protocol of anonymous binary-valued voting [4]
involving n persons (voters), each making a binary decision bi ∈ {0, 1} and writing it
on a ballot,
and one person (tallyman) collecting the ballots and announcing the result
s = i b i . This protocol possesses two security properties. The first property is the
”anonymity of voting”, meaning that the value of individual vote of the ith voter, bi , re-
mains unknown to other voters, the tallyman, and any third party possibly monitoring the
communication lines, unless s = 0, s = n, min{s, n − s} voters cooperate, or the ith
voter discloses his decision. The second property may be called ”non-exaggeration” and
means inability of a voter to contribute a number different from 0 or 1 to the final sum s.
1 Corresponding Author: D. B. Horoshko, B.I.Stepanov Institute of Physics, National Academy of Sciences
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
D.B. Horoshko and S.Ya. Kilin / Quantum Voting via NV Centers in Diamond 25
The anonymity of voting protects the voters from a curious tallyman (and other parties),
who may wish to learn who voted in which way, while the non-exaggeration protects
the entire community from malicious voters who may wish to vote twice. The discussed
protocol includes operations with quantum systems and provides unconditional security
for both anonymity and non-exaggeration, which distinguishes it from other existing vot-
ing protocols, both classical [5,6] and quantum. The quantum protocols [7,8,9] provide
unconditional anonymity of voting, but the property of ”non-exaggeration” is reached on
the cost of serious additional assumptions, which may be viewed impractical in some ap-
plications. In contrast, the discussed protocol provides in unconditional way both ”eaves-
dropping detection”, meaning non-zero probability of detection of any attempt to learn
the distribution of votes among the voters, and ”non-exaggeration”, thus protecting the
protocol from dishonest voters on the one hand and dishonest tallyman from on the other
hand. Here we consider, like in Refs. [5,7,8,9], a curious but not malicious tallyman,
whose dishonest action is limited to learning the distribution of votes among the voters,
but not to announcing a wrong value of the voting result s.
The main aim of this work is to show how the protocol of anonymous voting can be
realized by the technique of operating nitrogen-vacancy (NV) centers in diamond.
In this Section we briefly describe the protocol for anonymous voting and its security
against simple attacks.
1.1. Protocol
The protocol of voting is as follows. The participants are n legal voters labelled by index
i = 1, 2, ..., n and a tallyman.
1. Each voter chooses either to vote or to check the anonymity of voting.
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
(a) In the case of voting the voter makes a binary decision bi with bi = 0 cor-
responding to ”no” and bi = 1 corresponding to ”yes” decision, and encodes
it into a state of a two-level quantum system – qubit – playing the role of a
ballot. Two orthogonal states |0i and |1i of a qubit (computational basis) are
used for encoding of the corresponding value of bi .
(b) In the case of anonymity check the ith voter cooperates with the jth voter,
who also chooses to check the anonymity, and they together prepare their pair
of qubits in the Bell state |Ψ+ ij , where the Bell states are defined as
1
|Φ± ij = √ {|0i |0j ± |1i |1j }, (1)
2
1
|Ψ± ij = √ {|0i |1j ± |1i |0j }. (2)
2
2. After the encoding all voters send their qubits to the tallyman together with their
identities. The latter excludes the possibility of voting for illegal participants and
the possibility for legal voters to vote instead of their colleagues.
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
26 D.B. Horoshko and S.Ya. Kilin / Quantum Voting via NV Centers in Diamond
3. The tallyman collects all n qubits and calculates the number of ”yes” votes by
applying to the n-qubit system the projector valued measure (PVM)
P̂ (s) = |m(s, π)m(s, π)|, (3)
π
where |m(s, π) is a product state of n qubits in the computational basis, having
exactly s 1’s in the order determined by the permutation variable π. The tallyman
announces the voting result ”s votes yes”.
4. The tallyman sends the qubits back to the voters.
5. The voters make a ballot test.
(a) The voters, who have chosen to vote, measure their qubits in the computa-
tional basis. If the state of the qubit is different from the sent one, they state
the ballot test failure.
(b) The voters, who have chosen to make an anonymity check, make a mea-
surement of their pair of qubits in the Bell basis. If they get a result which is
different from the Bell state |Ψ+ ij , they state the ballot test failure.
A few comments to the protocol are necessary. In the present protocol the statement
of the ballot test failure does not mean a public accusation of the tallyman, it is rather an
information for the personal use by the voter (e.g. a council member).
The numbering with π is as follows. All n-bit strings with exactly s 1’s represent
numbers 0 ≤ m ≤ (2n − 1) in binary notation. Let us sort the strings in increasing order
of the corresponding numbers
m and label them with index π taking consecutive integer
values from 1 to ds = ns . In this way for any 0 ≤ s ≤ n we get a set of strings m(s, π).
The product state of n qubits in computational basis with individual qubit states |bi i , bi
being ith bit from the string m(s, π), is the state |m(s, π). For example, in the case of 5
qubits m(1, 2) = 00010 and |m(1, 2) = |05 |04 |03 |12 |01 . The states |m(s, π) are
mutually orthogonal. Figure 1 illustrates the state structure for n = 4. Below, we will
also use the word “excited” when referring to the state |1.
The projector given by Eq.(3) is a projector on the subspace of n-qubit system,
having s states |1 and n − s states |0. Let us denote this ds -dimensional subspace Vs .
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
It is easy to see, that the subspaces corresponding to different values of s are orthogonal
and their sum is the entire state space of n qubits. The states |m(s, π) for given s form a
basis in Vs . The application of projective measurement Eq.(3) corresponds to measuring
the number of ”yes” votes, but not their distribution among the voters.
Let us see how the protocol guarantees the anonymity of voting. Consider an event E(μ)
consisting in 2k voters choosing to check the anonymity, l voters voting ”yes” and the
rest voting ”no”. The state of n ballot qubits collected by the tallyman is represented by
a state
1
|E(μ) = √ |m(k + l, π), (4)
2k π∈Ω(μ)
where Ω(μ) is a set of 2k possible values of π. The state Eq.(4) belongs to the subspace
Vk+l and therefore is not affected by the projective measurement defined by Eq.(3). In
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
D.B. Horoshko and S.Ya. Kilin / Quantum Voting via NV Centers in Diamond 27
Figure 1. Structure and labelling of the states of ballots for the case of n = 4 voters. Each horizontal bar
represents a state of 4 qubits in the computational basis. Vertical axis shows the total number s of “yes” votes
(ones). Horizontal axis shows the permutation number π for given s. Binary string under the bar is its m(s, π)
label. The PVM given by Eq.(3) measures s without disturbing π.
the absence of errors the qubits sent back to the voters will always pass the ballot test in
the Step 5.
Now we consider a curious tallyman, who makes an additional measurement of
qubits with the aim to obtain some information on who voted which way. The simplest
way to learn the vote of the ith voter is just to measure the ith qubit in the computational
basis. If the ith voter has chosen to vote, this attack passes unnoticed. But, if the ith voter
has chosen to check the anonymity with the jth voter, their state |Ψ+ ij will be trans-
formed into |0i |1j or |1i |0j with equal probabilities, and the subsequent Bell mea-
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
surement will give results |Ψ+ ij or |Ψ− ij with probabilities 12 . The latter result means
the anonymity check failure. Thus, a curious tallyman faces a risk of being detected. The
security of the proposed protocol against a general type of attack is proven in Ref.[4].
Now we will show how the above protocol can be realized by the highly developed at
present technique of working with electronic and nuclear spins of NV centers in diamond
[10,11,12]. NV center in the diamond lattice consists of a nitrogen atom and a nearby
vacancy. The center fluoresce in the red part of the spectrum when excited by green laser
light, being a “color center” for otherwise transparent diamond. NV center, as a whole,
has an electronic spin equal to 1, whose projection on the axis connecting the nitrogen
atom and the vacancy takes values mS = −1, 0, 1. The states with mS = −1 and mS =
1 are degenerate in the absence of external magnetic fields, and the fluorescence yield
is significantly different for the ground electronic states with mS = ±1 and mS = 0,
allowing one to measure with certainty the value of |mS | by an optical readout. Thus,
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
28 D.B. Horoshko and S.Ya. Kilin / Quantum Voting via NV Centers in Diamond
the electronic spin of NV center represents a two-level quantum system – qubit – which
can be subjected to a projective measurement in an experiment.
Another qubit can be created by a nuclear spin of isotopic carbon 13 C atom in a
nearby node of the diamond lattice. Spin-spin interaction of electronic spin of NV center
and nuclear spin of isotopic carbon leads to hyperfine splitting of energy levels. The
resulting system of two qubits can be coherently operated by applying microwave and
radiofrequency fields, allowing one to realize elementary quantum gates [10]. Additional
atoms of isotopic carbon in the nearby lattice nodes create a higher-dimensional quantum
system. Coherent operation of more than three spins is such system is out of the present
day technology, but we can hope it will be possible in the near future.
In the proposed scheme the role of a ballot is played by a diamond nanocrystal with a
single NV center and two isotopic carbon 13 C atoms in a nearby node of the diamond
lattice. We will denote the electronic and two nuclear spins of ith voter as EiV , CiV and
AVi correspondingly. The tallyman is in a possession of a nanocrystal with a single NV
center and n + 1 isotopic carbon 13 C atoms in nearby nodes, whose nuclear spins will be
denoted as CiT (first n spins) and AT . The tallyman’s electronic spin is denoted E T .
Before the voting each voter needs to create the Bell state |Ψ− between CiV and
T
Ci . Entanglement can be created between the electronic spins of a voter and the tallyman
by the long-distance fibre interferometer technique with postselection and entanglement
purification [13]. Presently, this technique is very close to its experimental realization.
The protocol of entanglement purification requires one ancillary qubit, for which purpose
ancillary nuclear spins AVi and AT can be used on both sides. After created, the entangled
state is transferred from the electronic to the nuclear spins CiV and CiT .
The value of individual vote bi is encoded into the value |mS | of electronic spin EiV
by the spin polarization method [12]. After that, by realizing the Bell state measurement
of two qubits, EiV and CiV , the state of quantum ballot is teleported onto the nuclear spin
CiT . The complete Bell state measurement of two qubits can be done with unitary trans-
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
formation of two qubits and a projective measurement of one qubit; the measurement is
to be applied twice. The full protocol of quantum teleportation requires sending two bits
of information (Bell state measurement result) by a classical channel from the voter to
the tallyman and the corresponding unitary rotation by the latter of the CiT state.
The voters who have chosen to check the anonymity, need to create an entangled
state |Ψ+ between their electronic spins EiV and EjV by the same technique. For that
purpose they need to use as ancillary qubits nuclear spins AVi and AVj . The sending
procedure for them is the same and results is teleportation of entangled state |Ψ+ onto
the state of qubits CiT and CjT .
After all the quantum ballots are stored in the tallyman’s nuclear spins, he makes a pro-
jective measurement with PVM given by Eq.(3). Here we show that the realization of
such a PVM is possible for any number of voters, if the tallyman can operate coherently
all n + 1 qubits and can make a projective measurement of the electronic spin (optical
readout).
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
D.B. Horoshko and S.Ya. Kilin / Quantum Voting via NV Centers in Diamond 29
The measurement we propose here is based on applying to qubits the multiply con-
trolled NOT gates. Following the notation of Ref.[14], we denote Λk (σx ) a gate for k + 1
qubits which does not affect in the computational basis the first k qubits (the control
qubits) and flips the last qubit (the target one) if and only if all k control qubits are in the
state |1. The first two members of this family of gates are well known: Λ1 (σx ) is the
controlled-NOT gate, and Λ2 (σx ) is the Toffoli gate. The decomposition of higher-order
multiply controlled NOT gates via simpler elements has been a subject of special study
[14].
The proposed measurement is realized by the following algorithm.
1. Let k = 1.
2. The state of E T is set to |0.
3. All possible groups of k nuclear spins are chosen out of n spins. For each group
a Λk (σx ) gate is realized with the nuclear spins from the group being the control
qubits and E T being the target one.
4. The state of E T is measured in the computational basis with the result Mk .
5. If k < n, then k = k + 1 and go to Step 2, otherwise stop.
As a result of this algorithm a sequence of binary measurement results {Mk , k =
1, 2, ..., n} is obtained. It is easy to find that for given k ≤ s the number of successful
flips of the electronic spin is given by the binomial coefficient ks and therefore
s
Mk = mod 2, (5)
k
and for k > s Mk is always zero, since there are too few nuclear spins in the excited
state to flip the electronic one via a Λk (σx ) gate. It follows from Eq.(5) that Ms = 1.
Therefore, the value of s can be determined as the largest k with non-zero Mk :
It is easy to see that this algorithm does not affect the superposition given by Eq.(4).
Copyright © 2010. IOS Press, Incorporated. All rights reserved.
A multiply controlled NOT gate acts as unity operator on control qubits in the computa-
tional basis. Since the resulting state of the electronic spin |Mk does not depend on the
permutation number π but on the total number of excitations s only, and all components
in Eq.(4) correspond to the same s, they all will acquire the same factor |Mk E T at the
end of the kth iteration of the algorithm. Thus, the state of the electronic spin will be
disentangled from the state of nuclear spins before the measurement.
It should be noted that the described algorithm for measuring the total number of
excitations requires for its realizations as much as 2n − 1 gates, and probably is not
optimal. A search for faster algorithm may be required.
The last steps of the quantum voting protocol can be realized by the same technique: an
entangled state is created between every CiV and CiT , the ballots are teleported back to
corresponding CiV , the voters who have chosen to vote measure their ballots, the voters
who have chosen to check the anonymity create a Bell state between EiV and EjV and
teleport jth ballot onto EiV with a subsequent Bell state measurement of EiV and CiV .
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
30 D.B. Horoshko and S.Ya. Kilin / Quantum Voting via NV Centers in Diamond
Thus, all the steps of the protocol may be realized by the same elementary opera-
tions: Bell state creation for two remote qubits, multiply controlled NOT gate for up to
n + 1 qubits, and a projective measurement of electronic spin.
Conclusions
In the present work we have shown that a protocol of quantum voting can be realized
with the emerging technology of operating nuclear and electronic spins of NV center
and isotopic carbon in diamond nanocrystals. We have described how all important steps
of the protocol can be realized: the writing of vote onto the ballot, sending the ballot
to the tallyman, the subtle mechanism of measuring the number of “yes” votes without
disclosing their order, sending the ballots back to the voters, and the ballot test procedure.
The complexity of realizing quantum voting for n users is approximately the same as
realizing quantum computation with (n + 1)-qubit quantum register. However, while
quantum computation becomes practical for n ∼ 100, quantum voting may be useful for
values of n lower by an order of magnitude. Thus, the protocol of quantum voting may be
an interesting alternative application of the quantum information processing technique.
Acknowledgements
This work was supported by the project EQUIND performed within the 6th Framework
programme of European Commission.
References
Quantum Cryptography and Computing : Theory and Implementation, edited by R. Horodecki, et al., IOS Press, Incorporated, 2010.
Exploring the Variety of Random
Documents with Different Content
If the second copy is also defective, you may demand a refund
in writing without further opportunities to fix the problem.
Most people start at our website which has the main PG search
facility: www.gutenberg.org.
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
ebookfinal.com