Implementation of two-party protocols in the noisy-storage model

Abstract

The noisy-storage model allows the implementation of secure two-party protocols under the sole assumption that no large-scale reliable quantum storage is available to the cheating party. No quantum storage is thereby required for the honest parties. Examples of such protocols include bit commitment, oblivious transfer, and secure identification. Here, we provide a guideline for the practical implementation of such protocols. In particular, we analyze security in a practical setting where the honest parties themselves are unable to perform perfect operations and need to deal with practical problems such as errors during transmission and detector inefficiencies. We provide explicit security parameters for two different experimental setups using weak coherent, and parametric down-conversion sources. In addition, we analyze a modification of the protocols based on decoy states.

Experimental plug and play quantum coin flipping

“…For example, although randomized procedures like error correction and privacy amplification that are widely employed in QKD have been used in the security analysis of protocols dealing with bounded adversaries 36 , it is an open question whether such procedures can be used in the information-theoretic security setting; in principle, any such step can be used by the malicious party to his or her advantage. Therefore, new techniques may be needed in order to deal with the imperfections of the implementation and the inherent limitations to the attainable communication distance.…”

“…This system can also potentially be used for protocols employing decoy states [39][40][41] . Although the use of decoy states is a powerful tool for achieving practical long-distance QKD and for improving the performance of quantum cryptographic protocols in the noisy storage model 36 , it is not known, to the best of our knowledge, if a protocol employing decoy states can be devised for quantum coin flipping providing security against all-powerful adversaries.…”

Min-entropy uncertainty relation for finite-size cryptography

“…Using this relation in a cryptographic protocol only yields an additional error ε in the overall security error, and it is widely employed in the protocols of [6,9,10,[12][13][14]. From a theoretical (asymptotic) viewpoint, this uncertainty relation is certainly sufficient.…”

“…In particular, a low value for c means that the adversary's memory must be very limited and/or noisy for security to be possible [5,6,9] at all. Furthermore, a low value of c means that any experiment implementing such protocols can tolerate only a small amount of bit flip errors and losses [8,12,13]. For instance, if p err is the bit flip error on the channel connecting Alice and Bob, then security for the cryptographic primitive known as oblivious transfer is possible if c − h(p err ) > 0 [12,14], where h(p) = −p log 2 p − (1 − p) log 2 (1 − p) is the binary Shannon entropy.…”

“…Furthermore, a low value of c means that any experiment implementing such protocols can tolerate only a small amount of bit flip errors and losses [8,12,13]. For instance, if p err is the bit flip error on the channel connecting Alice and Bob, then security for the cryptographic primitive known as oblivious transfer is possible if c − h(p err ) > 0 [12,14], where h(p) = −p log 2 p − (1 − p) log 2 (1 − p) is the binary Shannon entropy. Motivated by this need to obtain a strong uncertainty relation for BB84 bases, that is, a large c , the authors of [6] considered the so-called smooth min-entropy H ε min (X|ΘK).…”