Semi-device-independent quantum money with coherent states

Abstract

The no-cloning property of quantum mechanics allows unforgeability of quantum banknotes and credit cards. Quantum credit card protocols involve a bank, a client and a payment terminal, and their practical implementation typically relies on encoding information on weak coherent states of light. Here, we provide a security proof in this practical setting for semi-device-independent quantum money with classical verification, involving an honest bank, a dishonest client and a potentially untrusted terminal. Our analysis uses semidefinite programming in the coherent state framework and aims at simultaneously optimizing over the noise and losses introduced by a dishonest party. We discuss secure regimes of operation in both fixed and randomized phase settings, taking into account experimental imperfections. Finally, we study the evolution of protocol security in the presence of a decohering optical quantum memory and identify secure credit card lifetimes for a specific configuration.In contrast to classical physics, quantum mechanical systems have a no-cloning property [1]: it is impossible to make a perfect copy of a quantum object in an unknown state. This property was used by Wiesner in his proposal to mint unforgeable quantum money [2], giving birth to the field of quantum cryptography [3][4][5]. The original idea involved a bank encoding a secret classical key into a sequence of two-level quantum states (qubits) stored in a quantum memory and handed to a client. The secret key specifies the basis in which each qubit is encoded, ensuring that a forger ignoring the basis in which to measure it will destroy information. This will then trigger incorrect measurement outcomes when the bank will verify the validity of the banknote. Such a scheme may be impractical over long distances due to a potentially lossy and noisy transmission of the quantum states between the client and the bank. It was also shown to be vulnerable to adaptive attacks, where a counterfeiter can use the same banknote several times [6]. An alternative protocol with verification using classical communication was first proposed in [7] and extended to practical, noise-tolerant schemes in [8][9][10].Although quantum key distribution protocols have been widely studied and implemented [11], quantum money has not yet seen the same experimental progress, essentially because of the difficulty in implementing efficient quantum storage devices [12]. However, the experimental interest in quantum money has grown recently, with demonstration of forgery of quantum banknotes [13] and implementation of weak coherent state-based quantum credit card schemes, secure in a trusted terminal scenario [14,15], in the prospect of near-future implementations with a quantum memory. These require new security proofs tackling the optimal cloning of coherent states, differing from qubit-based quantum money and also quantum key distribution proofs.In quantum cryptography, semi-device-independent frameworks have been developed in order to limit the needed assumptions to ensure secur...

Semi-device-independent quantum money

“…The fewer assumptions a proof bases on, the more independent of the device the proof is. Any proof based on less number of assumptions about the inner working device than the fully device-dependent one is called now a semi-device-independent one [13].…”

“…Soon after the first version of this paper was published on arXiv preprints repository, Bozzio et al [13] presented the result with a similar title 'Semi-device-independent quantum money with coherent states'. Their result requires stronger security assumptions (trusted source device) but is more focused on realistic implementations.…”

Practical quantum tokens without quantum memories and experimental tests

“…Alice presents the token by giving s and |ψ back to Bob, and Bob validates or rejects the token after measuring the received quantum state in the basis in which |ψ was prepared. In refinements of this scheme [2][3][4][5][6][7][8][9][10], Alice can present the token to Bob or to one of a set of verifiers, by communicating the classical outcomes of quantum measurements applied on |ψ , as requested by Bob or the verifier. Alternatively, Alice presents the token by giving s and |ψ to the verifier, who applies quantum measurements on |ψ .…”

“…they guarantee that a token cannot be validated more than once, with unconditional security, i.e. based only on the laws of physics without restricting the technology of dishonest Alice [2][3][4][5][6][7][8][9][10]. Intuitively, this follows from the no-cloning theorem, stating that it is impossible to perfectly copy unknown quantum states [11,12].…”

“…Standard quantum token schemes satisfying unforgeability, user privacy and instant validation with unconditional security require to store quantum states in quantum memories and/or to transfer quantum states over long distances in order to give Alice enough flexibility in space and time to present the token [1][2][3][4][5][6][7][8][9][10][13][14][15][16]. Recently, a quantum memory of a single qubit with a coherence time of over an hour has been experimentally demonstrated [19,20].…”