Security and composability of randomness expansion from Bell inequalities

Abstract

The nonlocal behavior of quantum mechanics can be used to generate guaranteed fresh randomness from an untrusted device that consists of two nonsignalling components; since the generation process requires some initial fresh randomness to act as a catalyst, one also speaks of randomness expansion. R. Colbeck and A. Kent [J. Phys. A 44, 095305 (2011)] proposed the first method for generating randomness from untrusted devices, but without providing a rigorous analysis. This was addressed subsequently by S. Pironio et al. [Nature (London) 464, 1021 (2010)], who aimed at deriving a lower bound on the min-entropy of the data extracted from an untrusted device based only on the observed nonlocal behavior of the device. Although that article succeeded in developing important tools for reaching the stated goal, the proof itself contained a bug, and the given formal claim on the guaranteed amount of min-entropy needs to be revisited. In this paper we build on the tools provided by Pironio et al. and obtain a meaningful lower bound on the min-entropy of the data produced by an untrusted device based on the observed nonlocal behavior of the device. Our main result confirms the essence of the (improperly formulated) claims of Pironio et al. and puts them on solid ground. We also address the question of composability and show that different untrusted devices can be composed in an alternating manner under the assumption that they are not entangled. This enables superpolynomial randomness expansion based on two untrusted yet unentangled devices.

Robust Protocols for Securely Expanding Randomness and Distributing Keys Using Untrusted Quantum Devices

“…Turning the intuition above into rigorous proofs turns out to be rather challenging. Classical security was proved in [Pironio et al, 2010], [Fehr et al, 2013], [Pironio and Massar, 2013], and in the later work [Coudron et al, 2013], which allowed a very broad class of nonlocal games. While useful, classical security does not guard against quantum adversaries, thus is inadequate as quantum computation is becoming a reality.…”

“…As the error parameters decrease at an exponential rate, they are dominated by the first set of errors. To decrease the number of devices used in unbounded expansion, a possibility (used, e.g., in [Fehr et al, 2013]) is to cross-feed the outputs of two devices (i.e., give the output of one device as the input to another, and then vice versa). But there is an apparent obstacle for proving security for such an approach: once a device produces output, this output is now correlated with the device itself.…”

Full randomness from arbitrarily deterministic events

“…Theorem: Let Pðk;ỹ;t;g;e j zÞ be the probability distribution of the variables generated during the protocol and the adversary's physical system e, z; and let P ideal ðk;ỹ;t;g;e j zÞ be the corresponding ideal distribution (11). The optimal probability of correctly guessing between the distributions P and P ideal satisfies…”

Quantum randomness extraction for various levels of characterization of the devices

“…On the contrary, in Classe II, since Eve prepares the state, the inputs z must be generated with a process that is a priori guaranteed to be unknown to Eve. In other words, in these classes there is no randomness generation, but only randomness expansion -and, after a series of partial results [24,28,29], it has been proved that such expansion can in principle be unbounded [21]. The different adversarial classes discussed here are summarized in Table I.…”