Fabian Wiesner

Delegated quantum computing (DQC) allows clients with low quantum capabilities to outsource computations to a server hosting a quantum computer. This process is often envisioned within the measurement-based quantum computing framework, as it naturally facilitates blindness of inputs and computation. Hence, the overall process of setting up and conducting the computation encompasses a sequence of three stages: preparing the qubits, entangling the qubits to obtain the resource state, and measuring the qubits to run the computation. There are two primary approaches to distributing these stages between the client and the server that impose different constraints on cryptographic techniques and experimental implementations. In the prepare-and-send setting, the client prepares the qubits and sends them to the server, whereas in the receive-and-measure setting, the client receives the qubits from the server and measures them. Although these settings have been extensively studied independently, their interrelation and whether setting-dependent theoretical constraints are inevitable remain unclear. By implementing the key components of most DQC protocols in the respective missing setting, we provide a method to build prospective protocols in both settings simultaneously and to translate existing protocols from one setting into the other. Our results suggest an equivalence that aligns with a heuristic translation between the two settings, replacing measurements with preparations and vise versa. We further investigate this intuition by introducing an equivalence definition that requires an equivalence of secure constructions, i.e., if one protocol implements an ideal resource, an equivalent protocol implements this ideal resource with the same security. Hence, our definition of equivalence is meaningful for composable security and allows for formalizing the suspected equivalence between settings: Every protocol in one setting should have an equivalent counterpart in the other setting. We find that despite the strong indication, the settings are, in fact, inequivalent. In order to derive this inequivalence, we introduce an axiomatic formulation of composable cryptography and prove theoretical results of independent interest.

Verification is a crucial property of many cryptographic functionalities, enabling a verifier to check whether a prover conducted an operation as agreed or deviated from the agreement. Probably the most intuitive technique for verification is the cut-and-choose technique, in which the verifier randomly intertwines test rounds with the output round to verify the honesty of the prover. Although this technique was successfully deployed for some use cases, such as quantum key distribution, its suitability for many other functionalities remains unknown. We consider two central verification tasks — quantum state verification and verifiable delegated quantum computing — and prove inherent trade-offs when verification is implemented solely via cut-and-choose: no protocol can simultaneously achieve high correctness, security, and efficiency; improving any one of these quantities beyond certain bounds necessarily degrades at least one of the others.

Quantum state verification plays a vital role in many quantum cryptographic protocols, as it allows using quantum states from an untrusted source. While some progress has been made in this direction, the question of whether the most prevalent type of quantum state verification, namely cut-and-choose verification, can be efficient and secure, is still not answered in full generality. In this work, we show a fundamental limit for quantum state verification for all cut-and-choose approaches used to verify arbitrary quantum states. We provide a no-go result showing that the cut-and-choose techniques cannot lead to quantum state verification protocols that are both efficient and secure. We show this trade-off for stand-alone and composable security, where the scaling of the lower bound for the security parameters renders cut-and-choose quantum state verification effectively useless.

Quantum repeaters have long been established to be essential for distributing entanglement over longdistances. Consequently, their experimental realization constitutes a core challenge of quantum communi-cation. However, there are numerous open questions about implementation details for realistic near-termexperimental setups. In order to assess the performance of realistic repeater protocols, here we presentReQuSim, a comprehensive Monte Carlo–based simulation platform for quantum repeaters that faithfullyincludes loss and models a wide range of imperfections such as memories with time-dependent noise. Ourplatform allows us to perform an analysis for quantum repeater setups and strategies that go far beyondknown analytical results: This refers to being able to both capture more realistic noise models and analyzemore complex repeater strategies. We present a number of findings centered around the combination ofstrategies for improving performance, such as entanglement purification and the use of multiple repeaterstations, and demonstrate that there exist complex relationships between them. We stress that numericaltools such as ours are essential to model complex quantum communication protocols aimed at contributingto the quantum Internet.