Anna Pappa

Delegated quantum computing (DQC) allows clients with low quantum capabilities to outsource computations to a server hosting a quantum computer. This process is often envisioned within the measurement-based quantum computing framework, as it naturally facilitates blindness of inputs and computation. Hence, the overall process of setting up and conducting the computation encompasses a sequence of three stages: preparing the qubits, entangling the qubits to obtain the resource state, and measuring the qubits to run the computation. There are two primary approaches to distributing these stages between the client and the server that impose different constraints on cryptographic techniques and experimental implementations. In the prepare-and-send setting, the client prepares the qubits and sends them to the server, whereas in the receive-and-measure setting, the client receives the qubits from the server and measures them. Although these settings have been extensively studied independently, their interrelation and whether setting-dependent theoretical constraints are inevitable remain unclear. By implementing the key components of most DQC protocols in the respective missing setting, we provide a method to build prospective protocols in both settings simultaneously and to translate existing protocols from one setting into the other. Our results suggest an equivalence that aligns with a heuristic translation between the two settings, replacing measurements with preparations and vise versa. We further investigate this intuition by introducing an equivalence definition that requires an equivalence of secure constructions, i.e., if one protocol implements an ideal resource, an equivalent protocol implements this ideal resource with the same security. Hence, our definition of equivalence is meaningful for composable security and allows for formalizing the suspected equivalence between settings: Every protocol in one setting should have an equivalent counterpart in the other setting. We find that despite the strong indication, the settings are, in fact, inequivalent. In order to derive this inequivalence, we introduce an axiomatic formulation of composable cryptography and prove theoretical results of independent interest.

Verification is a crucial property of many cryptographic functionalities, enabling a verifier to check whether a prover conducted an operation as agreed or deviated from the agreement. Probably the most intuitive technique for verification is the cut-and-choose technique, in which the verifier randomly intertwines test rounds with the output round to verify the honesty of the prover. Although this technique was successfully deployed for some use cases, such as quantum key distribution, its suitability for many other functionalities remains unknown. We consider two central verification tasks — quantum state verification and verifiable delegated quantum computing — and prove inherent trade-offs when verification is implemented solely via cut-and-choose: no protocol can simultaneously achieve high correctness, security, and efficiency; improving any one of these quantities beyond certain bounds necessarily degrades at least one of the others.

Quantum networks have recently generated significant interest due to enhanced functionalities and security, including offering the capability to securely calculate a linear function of several parameters which themselves remain private. This allows joint estimation of a parameter using the precision advantage of quantum sensing. In this work, we extend the functionality of previously considered schemes to allow for some subset of the network, without sharing their own private network, to carry out parameter estimation together without revealing the identities of participants, either to each other or to the rest of the network, while being guaranteed that only the relevant parties have inputted their parameter.

We report on an experimental demonstration of a recently proposed (n, n)-QSS (quantum secret sharing) protocol, which can be shown to be secure against participant attacks, using a four-photon GHZ state. Our work leverages the generation of high-quality and high-brightness non-linear single photon sources to achieve a secure key rate of 745 bits/sec in the asymptotic regime marking an important step toward scalable quantum-secure communication in networks.

In quantum cryptography, fundamental laws of quantum physics are exploited to enhance the security of cryptographic tasks. Quantum key distribution (QKD) is by far the most studied protocol to date, enabling the establishment of a secret key between trusted parties. Many practical use-cases in communication networks, however, involve parties who do not know or trust each other. The most fundamental quantum cryptographic building block in such a distrustful setting is quantum coin flipping, which, in its original version has been proposed in the seminal work by C.H. Bennett and G. Brassard in 1984. Interestingly, few experimental studies of quantum coin flipping have been reported to date using weak coherent pulses (WCPs), sources based on spontaneous parametric down conversion (SPDC) exploiting entanglement, or heralded single-photon states. Here, we experimentally implement a quantum strong coin flipping (QSCF) protocol using single-photon states and demonstrate an advantage compared to both classical realizations and implementations using faint laser pulses. We achieve this by employing a state-of-the-art deterministic single-photon source based on the Purcell-enhanced emission of a semiconductor quantum dot in combination with fast polarization-state encoding with sufficiently low quantum bit error ratio. The reduced multi-photon emission of the single-photon source yields a smaller bias of the coin flipping protocol compared to an attenuated laser implementation, both in simulations and in the experiment. By demonstrating a single-photon quantum advantage in a cryptographic primitive beyond QKD, our work represents an important advance towards the implementation of complex cryptographic tasks in a future quantum internet.

Bit commitment is a fundamental cryptographic primitive and a cornerstone for numerous two- party cryptographic protocols, including zero-knowledge proofs. However, it has been proven that unconditionally secure bit commitment, both classical and quantum, is impossible. In this work, we demonstrate that imposing a restriction on the committing party to perform only separable operations enables secure quantum bit commitment schemes. Specifically, we prove that in any perfectly hiding bit commitment protocol, an honestly-committing party limited to separable operations will be detected with high probability if they attempt to alter their commitment. To illustrate our findings, we present an example protocol.

Quantum state verification plays a vital role in many quantum cryptographic protocols, as it allows using quantum states from an untrusted source. While some progress has been made in this direction, the question of whether the most prevalent type of quantum state verification, namely cut-and-choose verification, can be efficient and secure, is still not answered in full generality. In this work, we show a fundamental limit for quantum state verification for all cut-and-choose approaches used to verify arbitrary quantum states. We provide a no-go result showing that the cut-and-choose techniques cannot lead to quantum state verification protocols that are both efficient and secure. We show this trade-off for stand-alone and composable security, where the scaling of the lower bound for the security parameters renders cut-and-choose quantum state verification effectively useless.

We experimentally implement a quantum coin flipping protocol that guarantees a strictly better security than classically possible against an all powerful adversary over a distance suitable for communication in metropolitan area networks. The implementation is based on a practical plug’n'play system, originally designed for quantum key distribution. Furthermore, we show that our protocol can be combined with quantum coin flipping protocols that provide almost perfect security against adversaries with limited resources and hence enhance them with a level of unconditional security. Our results offer a powerful theoretical and experimental toolbox for future secure quantum communications.