A Tight High-Order Entropic Quantum Uncertainty Relation with Applications

Abstract

Abstract. We derive a new entropic quantum uncertainty relation involving min-entropy. The relation is tight and can be applied in various quantum-cryptographic settings. Protocols for quantum 1-out-of-2 Oblivious Transfer and quantum Bit Commitment are presented and the uncertainty relation is used to prove the security of these protocols in the boundedquantum-storage model according to new strong security definitions. As another application, we consider the realistic setting of Quantum Key Distribution (QKD) against quantum-memory-bounded eavesdroppers. The uncertainty relation allows to prove the security of QKD protocols in this setting while tolerating considerably higher error rates compared to the standard model with unbounded adversaries. For instance, for the six-state protocol with one-way communication, a bit-flip error rate of up to 17% can be tolerated (compared to 13% in the standard model). Our uncertainty relation also yields a lower bound on the min-entropy key uncertainty against known-plaintext attacks when quantum ciphers are composed. Previously, the key uncertainty of these ciphers was only known with respect to Shannon entropy.

Composing Quantum Protocols in a Classical Environment

“…Finally, we show that the ad-hoc security definitions proposed by Damgård, Fehr, Salvail and Schaffner for their 1-2 OT and secure-identification protocols in the bounded-quantum-storage model [7,9] imply (and are likely to be equivalent) to the corresponding security definitions obtained from our approach. 3 This implies composability in the above sense for these quantum protocols in the bounded-quantum-storage model.…”

“…This is clearly a stronger composition result than we obtain (though restricted to the bounded-quantum-storage model) but comes at the price of a more demanding security definition. And indeed, whereas we show that the simple definitions used in [8,7] already guarantee composability into classical protocols without any modifications to the original parameters and proofs, [29] need to strengthen the quantum-memory bound (and re-do the security proof) in order to show that the 1-2 OT protocol from [7] meets their strong security definition. As we argued above, this is an overkill in many situations.…”

“…As we argued above, this is an overkill in many situations. 1 We are well aware that quantum OT is impossible without any restriction on the adversary, but it becomes possible for instance when restricting the adversary's quantum memory [8,7]. 2 Here, "classical" can be understood as "non-quantum" as well as "being a classic".…”

“…Since essentially no interesting two-party task can be implemented securely by a quantum protocol against unbounded quantum attacks [20,19,18,16], one typically has to put some restriction upon the dishonest player's capabilities, like to limit his quantum-storage capabilities [8,7,9,28] or the size of coherent measurements he can do [24]. Throughout, we let A and B be subfamilies of all possible strategies A and B of a dishonest Alice and a dishonest Bob, respectively.…”

“…In the full version [11] of this paper, we also show the corresponding for the 1-2 OT scheme [7] and for other variants of OT.…”