Mathieu Bozzio

As in modern communication networks, the security of quantum networks will rely on complex cryptographic tasks that are based on a handful of fundamental primitives. Weak coin flipping (WCF) is a significant such primitive which allows two mistrustful parties to agree on a random bit while they favor opposite outcomes. Remarkably, perfect information-theoretic security can be achieved in principle for quantum WCF, which is impossible for a classical coin flip without computational assumptions or trusting a third party. In this work, we overcome conceptual and practical issues that have prevented the experimental demonstration of this primitive to date, and demonstrate how quantum resources can provide cheat sensitivity, whereby each party can detect a cheating opponent, and an honest party is never sanctioned. Such a property is not known to be classically achievable with information-theoretic security. Our experiment implements a refined, loss-tolerant version of a recently proposed theoretical protocol and exploits heralded single photons generated by spontaneous parametric down-conversion, a carefully optimized linear optical interferometer including beam splitters with variable reflectivities and a fast optical switch for the verification step. High values of our protocol benchmarks are maintained for attenuation corresponding to several kilometers of telecom optical fiber.

Despite the range of security guarantees offered by the laws of quantum theory, quantum-cryptographic schemes all face the same practical challenge: participants must ensure that the messages they receive originate from the right person. This authentication step is typically achieved by integrating classical methods, assumed hard for quantum computers, into quantum systems. Here, we propose an alternative solution to replace a central link of the authentication chain with a quantum commitment scheme that is information-theoretically secure against attackers holding a perfect quantum memory of thousands of qubits. In this way, all other parts of the authentication rely only on the fundamental and widely accepted conjecture that P/=NP. Our protocol can be implemented with all standard sources such as down-conversion and highly-attenuated laser states. We however employ a single-photon source emitting directly in the telecom C-band to show how its performance may be boosted by several orders of magnitude, even at moderate channel loss. Over a deployed optical fiber link, we achieve 128-bit security by detecting 10^9 photons, allowing for 66 secure re-uses of the public-private key pair.

Mistrustful cryptography includes important tasks like bit commitment, oblivious transfer, coin flipping, secure computations, position authentication, digital signatures and secure unforgeable tokens. Practical quantum implementations presently use photonic setups. In many such implementations, Alice sends photon pulses encoding quantum states and Bob chooses measurements on these states. In practice, Bob generally uses single photon threshold detectors, which cannot distinguish the number of photons in detected pulses. Also, losses and other imperfections require Bob to report the detected pulses. Thus, malicious Alice can send and track multi-photon pulses and thereby gain information about Bob's measurement choices, violating the protocols' security. Here, we provide a theoretical framework for analysing such multi-photon attacks, and present known and new attacks. We illustrate the power of these attacks with an experiment, and study their application to earlier experimental demonstrations of mistrustful quantum cryptography. We analyse countermeasures based on selective reporting and prove them inadequate. We also discuss side-channel attacks where Alice controls further degrees of freedom or sends other physical systems.