Measurement-Device-Independent Quantum Digital Signatures

TL;DR

This paper introduces a measurement-device-independent quantum digital signature scheme that enhances security against detector side-channel attacks, leveraging principles from MDI-QKD for practical implementation.

Contribution

The paper proposes the first MDI-QDS protocol that is secure against all detector side-channel attacks, inspired by recent advances in MDI-QKD.

Findings

Protocol is theoretically secure against side-channel attacks.

Compatible with existing MDI-QKD experimental setups.

Potential for practical implementation in secure communications.

Abstract

Digital signatures play an important role in software distribution, modern communication and financial transactions, where it is important to detect forgery and tampering. Signatures are a cryptographic technique for validating the authenticity and integrity of messages, software, or digital documents. The security of currently used classical schemes relies on computational assumptions. Quantum digital signatures (QDS), on the other hand, provide information-theoretic security based on the laws of quantum physics. Recent work on QDS shows that such schemes do not require trusted quantum channels and are unconditionally secure against general coherent attacks. However, in practical QDS, just as in quantum key distribution (QKD), the detectors can be subjected to side-channel attacks, which can make the actual implementations insecure. Motivated by the idea of measurement-device-independent quantum key distribution (MDI-QKD), we present a measurement-device-independent QDS (MDI-QDS) scheme, which is secure against all detector side-channel attacks. Based on the rapid development of practical MDI-QKD, our MDI-QDS protocol could also be experimentally implemented, since it requires a similar experimental setup.

Tables

Table 1. Table 1: Processing of data in the sifting stage. The Bell states are defined as | ψ − ⟩ = 1 2 ​ ( | H ​ V ⟩ − | V ​ H ⟩ ) , | ψ + ⟩ = 1 2 ​ ( | H ​ V ⟩ + | V ​ H ⟩ ) , | ϕ + ⟩ = 1 2 ​ ( | H ​ H ⟩ + | V ​ V ⟩ ) formulae-sequence ket superscript 𝜓 1 2 ket 𝐻 𝑉 ket 𝑉 𝐻 formulae-sequence ket superscript 𝜓 1 2 ket 𝐻 𝑉 ket 𝑉 𝐻 ket superscript italic-ϕ 1 2 ket 𝐻 𝐻 ket 𝑉 𝑉 \left|\psi^{-}\right\rangle=\frac{1}{\sqrt{2}}(\left|HV\right\rangle-\left|VH\right\rangle),\left|\psi^{+}\right\rangle=\frac{1}{\sqrt{2}}(\left|HV\right\rangle+\left|VH\right\rangle),\left|\phi^{+}\right\rangle=\frac{1}{\sqrt{2}}(\left|HH\right\rangle+\left|VV\right\rangle) and | ϕ − ⟩ = 1 2 ​ ( | H ​ H ⟩ − | V ​ V ⟩ ) ket superscript italic-ϕ 1 2 ket 𝐻 𝐻 ket 𝑉 𝑉 \left|\phi^{-}\right\rangle=\frac{1}{\sqrt{2}}(\left|HH\right\rangle-\left|VV\right\rangle) .

	Bell state reported by Eve
Alice’s & Bob’s basis	$|{\psi }^{-}⟩$	$|{\psi }^{+}⟩$	$|{\varphi }^{-}⟩$	$|{\varphi }^{+}⟩$
$Z$ basis	Bit flip	Bit flip	–	–
$X$ basis	Bit flip	–	Bit flip	–

Table 2. Table 2: Raw key generation times for various detectors that could be used in a MDI-QDS protocol for a distance of 50 km and a security threshold of 10 − 5 superscript 10 5 10^{-5} . The parameters η D ( % ) , Y 0 \eta_{D}(\%),Y_{0} and N s ​ i ​ g subscript 𝑁 𝑠 𝑖 𝑔 N_{sig} denote respectively the detection efficiency, dark count rate of Eve’s detectors, and the number of signals that Bob/Charlie sends to Alice during their KGPs. t r subscript 𝑡 𝑟 t_{r} is the time taken to generate the raw key and to estimate t r subscript 𝑡 𝑟 t_{r} we assume a source with a pulse rate of 1 GHz.

Detectors	${\eta }_D(\%)$	$Y_0(\times {10}^{-6})$	$N_{sig}(\times {10}^{12})$	$t_r$(min)
Standard single-photon detectors Ursin2007	14.5	6.02	5.58	93
InGaAs avalanche photodiodes detectors (APD) Comandar2015	30	130	1.8	30
InGaAs/InP APD Comandar2015b	55	500	0.87	14.5
Superconducting nanowire single-photon detectors (SNSPDs) Marsili2013	93	1	0.098	1.6

Table 3. Table 3: Raw key generation times for a distance of 50 km with a security threshold of 10 − 10 superscript 10 10 10^{-10} . For the definition of the different parameters, see the caption of Table  2 .

Detectors	$N_{sig}(\times {10}^{12})$	$t_r$(min)
Standard single-photon detectors Ursin2007	10.5	175
InGaAs APD Comandar2015	3.35	55.83
InGaAs/InP APD Comandar2015b	1.63	27.1
SNSPDs Marsili2013	0.18	3

Equations

$$\begin{array}{r}{H}_{\text{min}}^{{\epsilon }_k}({{\mathcal{Z}}^{\prime }}_{k,\text{keep}}|E_k{)}_{\rho }\ge \\ n_{k,0}+n_{k,1}\left[1-h(e_{k,1})\right]-2{\log }_2\frac{2}{{\epsilon }_k^{\prime }{\hat{\epsilon }}_k},\end{array}$$

$$H_{\text{min}}^{{\epsilon }_k}({{\mathcal{Z}}^{\prime }}_{k,\text{keep}}|E_k{)}_{\rho }$$

$$⟨p_r⟩\le \sum _{m=0}^r\left(\genfrac{}{}{0ex}{}{\frac{n_k}{2}}{m}\right)2^{-H_{\text{min}}^{{\epsilon }_k}({{\mathcal{Z}}^{\prime }}_{k,\text{keep}}|E_k{)}_{\rho }}+{\epsilon }_k.$$

$$Pr(\text{Eve makes fewer than r errors}):=p_r\le g,$$

$$p_F:=\frac{1}{g}\left(2^{-\frac{n_k}{2}\left\{c_{k,0}+c_{k,1}[1-h(e_{k,1})]-h(2r/n_k)\right\}}+{\epsilon }_k\right),$$

$$c_{k,0}+c_{k,1}[1-h(e_{k,1})]-h(2r/n_k)>0.$$

$$c_{k,0}+c_{k,1}[1-h(e_{k,1})]-h(p_E)=0.$$

$$c_{k,0}+c_{k,1}[1-h(e_{k,1})]-h({\overline{E}}_k)>0.$$

$${\overline{E}}_k^{a_s,b_s}\ge E_k^{a_s,b_s}+\mu \left(\frac{n_k}{2},R_k,{\epsilon }_{PE}\right),$$

$$\mu \left(\frac{n_k}{2},R_k,{\epsilon }_{PE}\right)=\sqrt{\frac{(\frac{n_k}{2}-R_k+1)\ln (\frac{1}{{\epsilon }_{PE}})}{R_k{n}_k}}.$$

$$Pr(\text{Honest Abort})\le 2{\epsilon }_{PE},$$

$$Pr(\text{Repudiation})\le 2\exp \left[-\frac{1}{4}(s_v-s_a{)}^2{n}_k\right].$$

$$Pr(\text{Bob makes fewer than svnk/2 errors}):=p_r\le g$$

$$Pr(\text{Forge})\le p_F+g+{\epsilon }_{PE}+{\epsilon }_{k,0}+{\epsilon }_{k,1}+{\epsilon }_{k,e}.$$

$$l_k$$

$$l_k\approx n_k\{c_{k,0}+c_{k,1}[1-h(e_{k,1})]\}-lea{k}_{EC,k}.$$

$$l_k\approx \frac{n_k}{2}\{c_{k,0}+c_{k,1}[1-h(e_{k,1})]-\zeta h({\overline{E}}_k)\}.$$

$${\left(2{\epsilon }_{a,b}^{-1}\right)}^{1/{\mu }_{k,L}^{a,b}}\le \exp \left[3/(4\sqrt{2}){]}^2\right],$$

$${\left({\hat{\epsilon }}_{a,b}^{-1}\right)}^{1/{\mu }_{k,L}^{a,b}}\le \exp \left(1/3\right),$$

$${\mu }_{k,L}^{a,b}=|Z_k^{a,b}|-\sqrt{\sum _{a,b}|Z_k^{a,b}|/2\ln (1/{ϵ}_{a,b})},$$

$$|Z_k^{a,b}|=\sum _{n,m}{p}_{a,b|nm,Z}{S}_{k,nm}+{\delta }_{a,b},$$

$$m_{k,0}=\sum _n{p}_{a_s,b_s|n0,Z}{S}_{k,n0}-{\Delta }_0,$$

$$n_{k,0}=\max\Bigg{\{}\Bigg{\lfloor}\frac{n_{k}}{2}\frac{m_{k,0}}{|Z_{k}^{a_{s},b_{s}}|}-\frac{n_{k}}{2}\Lambda(|Z_{k}^{a_{s},b_{s}}|,\frac{n_{k}}{2},\varepsilon^{\prime\prime}_{k,0})\Bigg{\rfloor},0\Bigg{\}},$$

$${\epsilon }_{k,0}\le {\epsilon }_{k,0}^{\prime }+{\epsilon }_{k,0}^{\prime \prime },$$

$$n_{k,1}=\max\Bigg{\{}\Bigg{\lfloor}\frac{n_{k}}{2}\frac{m_{k,1}}{|Z_{k}^{a_{s},b_{s}}|}-\frac{n_{k}}{2}\Lambda(|Z_{k}^{a_{s},b_{s}}|,\frac{n_{k}}{2},\varepsilon^{\prime\prime}_{k,1})\Bigg{\rfloor},0\Bigg{\}},$$

$${\epsilon }_{k,1}\le {\epsilon }_{k,1}^{\prime }+{\epsilon }_{k,1}^{\prime \prime },$$

$$\begin{split}e_{k,1}=\min\Bigg{\{}\Bigg{\lceil}n_{k,1}\Bigg{(}\frac{\overline{e}_{k,1}}{\overline{n}_{k,1}}\Bigg{)}+(n_{k,1}+\overline{n}_{k,1})\\ \times\Upsilon(n_{k,1},\overline{n}_{k,1},\varepsilon^{\prime\prime\prime}_{k,e})\Bigg{\rceil},n_{k,1}\Bigg{\}},\end{split}$$

$${\epsilon }_{k,e}\le {\epsilon }_{k,e}^{\prime }+{\epsilon }_{k,e}^{\prime \prime }+{\epsilon }_{k,e}^{\prime \prime \prime },$$

$$\begin{array}{r}{H}_{\text{min}}^{{\epsilon }_k}({\mathcal{Z}}_{k,\text{keep}}^{\prime }|E_k)\ge \\ H_{\text{min}}^{{ϵ}_k^{\prime }+2{ϵ}_k^{\prime \prime }+(\widehat{{ϵ}_k}+2{\widehat{ϵ}}_k^{\prime }+{\widehat{ϵ}}_k^{\prime \prime })}({\mathcal{Z}}_{k,\text{keep}}^{{}^{\prime }0}{\mathcal{Z}}_{k,\text{keep}}^{{}^{\prime }1}{\mathcal{Z}}_{k,\text{keep}}^{{}^{\prime }\text{rest}}|E_k)\\ \ge n_{k,0}+H_{\text{min}}^{{ϵ}_k^{\prime \prime }}({\mathcal{Z}}_{k,\text{keep}}^{{}^{\prime }1}|{\mathcal{Z}}_{k,\text{keep}}^{{}^{\prime }0}{\mathcal{Z}}_{k,\text{keep}}^{{}^{\prime }\text{rest}}{E}_k)-2{\log }_2\frac{2}{{ϵ}_k^{\prime }{\widehat{ϵ}}_k},\end{array}$$

$$H_{\text{min}}^{{ϵ}_k^{\prime \prime }}({\mathcal{Z}}_{k,\text{keep}}^{{}^{\prime }1}|{\mathcal{Z}}_{k,\text{keep}}^{{}^{\prime }0}{\mathcal{Z}}_{k,\text{keep}}^{{}^{\prime }\text{rest}}{E}_k)$$

Full text

I Introduction

Digital signatures are techniques for guaranteeing the authenticity and integrity of a message. They play a significant role for example in financial transactions, software distribution, and e-mail. Signature schemes allow a sender to exchange messages with many recipients, with the assurance that the messages cannot be forged or tampered with. In addition, signed messages are also transferable, and cannot be repudiated. Transferability means that a message, which is accepted by an honest recipient, will also be accepted by another recipient if the message is forwarded. Non-repudiation is related to transferability and means that a sender cannot successfully deny having sent a signed message.

Classical digital signature schemes rely on public-key encryption. The security of such protocols is based on the assumed computational difficulty of inverting certain cryptographic functions. For example, an algorithm that is widely used for generating digital signatures is the Rivest-Shamir-Adleman (RSA) Rivest1978 cryptosystem, which relies on the difficulty of factoring the product of two large prime numbers. However, if a quantum computer is built, this may threaten the security of such protocols. This is a main motivation for developing unconditionally secure signature schemes Swanson2011 ; Amiri2015a , including quantum digital signature (QDS) schemes Gottesman2001 ; Andersson2006 ; Clarke2012 ; Dunjko2014 ; Collins2014 . The latter are essentially quantum versions of Lamport’s one-time signature scheme Lamport1979 , and can offer information-theoretic security relying on the fundamental laws of quantum physics.

Previous QDS schemes Andersson2006 ; Clarke2012 ; Dunjko2014 ; Collins2014 improved on the seminal work in Gottesman2001 by removing the need for quantum memory. Wallden et.al. Wallden2015 proposed more practical QDS schemes which could be realized using QKD Bennett1984 components. In these QDS schemes, Alice encodes her signatures in quantum states, and sends a copy of each state to both Bob and Charlie. Bob and Charlie are only able to gain partial information on the overall signature state, due to its quantum nature. Until recently, the security analysis of all QDS schemes assumed authenticated quantum channels. In  Amiri2015 ; Yin2015 , all trust assumptions on the quantum channels are removed, which is a significant improvement compared to the previous schemes.

It is however more challenging to guarantee the security of practical implementations of QDS schemes. This is so because practical realisations do not typically conform to the requirements imposed by the theory, as real devices can behave differently from the models considered in the security proofs. As a result, we have that any imperfection which is not accounted for might constitute a “side channel” which could be used by an adversary to render the QDS scheme insecure. Here, the most critical devices are arguably the single-photon detectors Qi2007 ; Lamas2007 ; Zhao2008 ; Xu2010 ; Lydersen2010 ; Weier2011 ; Gerhardt2011 ; Jouguet2013 . For example, an adversary can use detector loopholes to learn about a participant’s (say Bob’s) measurement results, and could then forge a message with Bob. In the context of QKD, detector side-channels can be successfully removed by means of measurement-device-independent QKD (MDI-QKD) Lo2012 . In this approach, Alice and Bob do not perform any measurement but only send quantum signals to be measured. Thus, the advantage of MDI-QKD is that the legitimate parties need not hold a measurement device and may treat the measurement apparatus as a “black box”, which may be fully controlled by Eve. This is important as it eliminates the requirement to certify the detectors in a QKD standarization process. Therefore, the bit strings generated by Alice and Bob are free from detector side-channel attacks as they do not employ any detector. Hence, this only requires Alice and Bob to characterize the quantum states which they send through the channel. This characterization should take place in a protected environment outside the influence of the adversary, which in principle is feasible. Since the invention of MDI-QKD, such schemes have been very actively studied both theoretically Tamaki2012 ; Ma2012 ; Xu2013 ; Curty2014 and experimentally Rubenok2013 ; Ferreira2013 ; Liu2013 ; Tang2014 ; Tang2014a ; Comandar2015 .

In this paper, we present a QDS protocol which eliminates all detector side-channel attacks by employing the concept of measurement-device-independence. This is desirable for actual practical use of QDS schemes. The main contribution of this work is to adapt the rigorous security proof of MDI-QKD given in Curty2014 , taking into account finite-size effects, to the QDS protocol proposed in Amiri2015 . The resulting security proof is valid against general forging and repudiation attacks. Long-distance implementation of MDI-QKD Rubenok2013 ; Ferreira2013 ; Liu2013 ; Tang2014 ; Tang2014a ; Comandar2015 has been recently achieved, and the experimental parameters allowing for MDI-QKD could equally well allow for implementation of our QDS protocol. Hence, we envisage not just a long-distance implementation of a QDS protocol, but an implementation that is secure against detector side-channel attacks.

II The protocol

We outline our protocol for three parties, with a sender, Alice, and two recipients Bob and Charlie. The set-up for MDI-QDS is illustrated in Fig. 1. We assume that between Alice and Bob, and between Alice and Charlie, there exist authenticated classical channels. There is no need for “direct” quantum channels between Alice and Bob, between Alice and Charlie, nor between Bob and Charlie. Each party has an untrusted and imperfect quantum channel with the relay (Eve). Bob and Charlie share a MDI-QKD link, which can be used to transmit classical messages in full secrecy. This is separately indicated in the figure, but could also be realised with Eve as relay. Any classical secret communication channel between Bob and Charlie would in fact suffice in place of this MDI-QKD link. We will describe the procedure for signing a one-bit message. For signing longer messages, the procedure can be suitably iterated, meaning that the signature length scales linearly with message length.

Alice, Bob and Charlie each use a laser source to generate quantum signals that are diagonal in the Fock basis. Sources producing such signals include attenuated laser diodes emitting phase-randomised weak coherent pulses (WCPs), triggered spontaneous parametric down-conversion sources and practical single-photon sources. The scheme makes use of a measurement-device-independent key generating protocol (MDI-KGP), performed in pairs separately by Alice-Bob and Alice-Charlie; see Section III for more details. The purpose of such an MDI-KGP scheme is to use the noisy untrusted quantum channels to generate two correlated bit strings, one for each participant in an MDI-KGP. The noise level is defined in terms of the relative Hamming distance between these strings. When the noise level is below a tolerated value, the relative Hamming distance between the respective strings of the participants is smaller than the relative Hamming distance between any string that an eavesdropper could produce, and the participant’s string.

The QDS scheme above is related to the one proposed in  Amiri2015 , with a difference in the KGP. It comprises of two stages, a distribution stage, where all quantum communication takes place, and a messaging stage, which can occur much later, and where only classical communication is used.

II.1 Distribution stage

(1) For each possible future message $m$=0 or 1, Alice uses the MDI-KGP to generate four different correlated bit strings, $A^{B}_{0},A^{B}_{1},A^{C}_{0},A^{C}_{1}$, each one of length $L$. The superscript denotes the participant with whom Alice performed the MDI-KGP, and the subscript represents the future message, which is to be decided later by her. Bob holds the strings $K^{B}_{0},K^{B}_{1}$ and Charlie holds the strings $K^{C}_{0},K^{C}_{1}$. Because of the KGP, it will be guaranteed that $A^{B}_{0}$ contains fewer mismatches with $K^{B}_{0}$ than does any string produced by an eavesdropper, and similarly for the other pairs of strings. Alice’s signature for the future message $m$ will be $Sig_{m}=(A^{B}_{m},A^{C}_{m})$. The fact that only Alice knows all signatures for a message $m$ protects the protocol against forging.

(2) For each future message, Bob and Charlie symmetrize their keys. This is done by each of them choosing at random half of the bit values in their keys ($K^{B}_{m},K^{C}_{m}$) and sending these bit values (as well as the corresponding positions) to the other participant using their secret classical channel. This will ensure that Alice cannot make Bob and Charlie disagree on the validity of a signature, if a message is forwarded from Bob to Charlie or vice versa in the messaging stage. If Bob (or Charlie) chooses to forward an element of $K^{B}_{m}$ (or $K^{C}_{m}$) in the distribution stage to Charlie (or Bob), he will not, if he is honest, further use it to check the validity of a signature. Bob and Charlie will only use the bits they did not forward, and those received from the other participant. This is not strictly necessary, but simplifies the analysis of repudiation by a dishonest Alice in that from Alice’s point of view, the probabilities are equal for Bob and Charlie to check a particular key bit. We denote their symmetrized keys by $S^{B}_{m}$ and $S^{C}_{m}$, with the superscript indicating whether the key is held by Bob or Charlie. Bob (and Charlie) keep a record of whether an element in $S^{B}_{m}$ ($S^{C}_{m}$) came directly from Alice or whether it was forwarded to him by Charlie (or Bob).

Each of the symmetrized strings held by Bob and Charlie now contains half of $K^{B}_{m}$ and half of $K^{C}_{m}$. For each future possible message $m$, Bob and Charlie each have a bit string of length $L$. Alice has no information on whether it is Bob’s $S^{B}_{m}$ or Charlie’s $S^{C}_{m}$ that contains a particular element of the string $(K^{B}_{m},K^{C}_{m})$, which is of length $2L$. This protects against repudiation. Bob has access to all of $K^{B}_{m}$ and half of $K^{C}_{m}$. He does not know the other half of $K^{C}_{m}$ which Charlie chose to keep. This protects the protocol against forging by Bob (and similarly against forging by Charlie).

II.2 Messaging stage

(1) To send a signed one-bit message $m$, Alice sends $(m,Sig_{m})$ to the desired recipient (say Bob).

(2) Bob checks whether $(m,Sig_{m})$ matches his $S^{B}_{m}$, and records the number of mismatches he finds. He separately checks the part of his key received directly from Alice and the part of the key received from Charlie. If there are fewer than $s_{a}(L/2)$ mismatches in both halves of the key, where $s_{a}<1/2$ is a small threshold determined by the observed experimental parameters (see Appendix  D for more details) and the desired security level of the protocol, then Bob accepts the message.

(3) To forward the message to Charlie, Bob forwards the pair $(m,Sig_{m})$ that he received from Alice.

(4) Charlie tests for mismatches in a similar way, but using a different threshold in order to protect against repudiation by Alice. He accepts the forwarded message if the number of mismatches in both halves of his key is below $s_{v}(L/2)$ where $s_{v}$ is another threshold, with $0<s_{a}<s_{v}<1/2$. An important and necessary feature of unconditionally secure signature schemes Swanson2011 ; Arrazola2015 is that the recipients have to use different thresholds or acceptance criteria for messages received directly from the sender and for forwarded messages.

III Measurement-device-independent key generation protocol

MDI-QKD protocols Lo2012 ; Curty2014 ; Xu2015a are schemes that remove all detector side-channel attacks. This is very important when we consider detector loopholes in conventional QKD implementations Qi2007 ; Jouguet2013 . Similarly, the key generation protocol, which is part of the QDS scheme we are describing, can be made measurement-device-independent. Essentially, Alice and Bob (or Alice and Charlie) only perform the quantum part of the MDI-QKD scheme to generate raw different keys (the $A^{B}_{m}$ and $K^{B}_{m}$ described above) with imperfectly correlated and not completely secret bit strings. That is, Alice and Bob do not perform error correction and privacy amplification. This is sufficient for quantum signatures, since it is the number of mismatches with the recipient’s key that matters for the signature protocol; perfectly correlated, perfectly secret strings are not necessary. The aim is to show that $\Lambda(A^{B}_{m},K^{B}_{m})<\Lambda(E_{guess},K^{B}_{m})$ except with negligible probability, where $\Lambda(x,y)$ is the Hamming distance between $x$ and $y$, and $E_{guess}$ is Eve’s attempt at guessing $K^{B}_{m}$. It can also be possible that the adversary Eve is Charlie (for the KGP performed between Alice and Bob, and for the KGP performed by Alice and Charlie, Eve could be Bob). The security of the signature protocol is proved in Sec. IV.

The underlying MDI-QKD protocol, upon which the KGP is built, is the decoy-state BB84 protocol using phase-randomized WCPs considered in Lo2012 . We follow the steps of the protocol in Curty2014 , using the $Z$ basis for key generation, but do not proceed with error correction and privacy amplification.

The different steps of the MDI-KGP are as follows.

(1) State preparation: Alice and Bob repeat the first two steps of the protocol for $i=1,...,N$ until the conditions in the Sifting stage are met. For each $i$, Alice chooses an intensity $a\in\{a_{s},a_{d_{1}},a_{d_{2}}\}$, a basis $\alpha\in\{Z,X\}$, and a random bit $r\in\{0,1\}$ with probability $p_{a,\alpha}/2$. Here $a_{s}$ ($a_{d_{j}}$ where $j\in\{1,2\}$) is the intensity of the signal (decoy) states. Next, she generates a quantum signal (e.g, a phase-randomized WCP) of intensity $a$ prepared in the basis state of $\alpha$ given by $r$. Similarly, Bob does the same. Alice and Bob then send their states to Eve via the quantum channel.

(2) Measurement: If Eve is honest, she makes a Bell state measurement of the signals she has received. Whether Eve is honest or not, she informs Alice and Bob through a public channel of whether or not her measurement was successful. If successful, she declares the Bell state that is obtained.

(3) Sifting: If Eve reports a successful result, Alice and Bob communicate through an authenticated channel their intensity and basis settings. For each Bell state $k$, we define two groups of sets: $Z_{k}^{a,b}$ and $X_{k}^{a,b}$. $Z_{k}^{a,b}$ is a set that identifies signals where Eve declares a Bell state $k$ and Alice and Bob have selected the intensities $a$ and $b$ and the basis $Z$. Similarly, $X_{k}^{a,b}$ is a set that identifies signals where Eve declares a Bell state $k$ and Alice and Bob have selected the intensities $a$ and $b$ and the basis $X$. The protocol is repeated until $|Z_{k}^{a,b}|\geq N_{k}^{a,b}$ and $|X_{k}^{a,b}|\geq M_{k}^{a,b}$ $\forall a,b,k$ footnote1 . After this, Bob flips part of his bits to correctly correlate them with those of Alice. This is shown in Table 1.

(4) Parameter Estimation: Alice and Bob use $n_{k}$ random bits from $Z_{k}^{a_{s},b_{s}}$ to form the code bit strings $\mathcal{Z}_{k}$ and $\mathcal{Z^{\prime}}_{k}$, respectively. The remaining $R_{k}$ bits from $Z_{k}^{a_{s},b_{s}}$ are used to compute the error rate $E_{k}^{a_{s},b_{s}}=\frac{1}{R_{k}}\sum_{l}r_{l}\oplus r_{l^{\prime}}$ where $r_{l}$ and $r_{l^{\prime}}$ are Alice’s and Bob’s bits respectively. The bit string of length $R_{k}$ is used to estimate the correlation between Alice and Bob’s strings generated from the $Z$ basis, after which they are discarded. If $E_{k}^{a_{s},b_{s}}>E_{tol}\leavevmode\nobreak\ \forall k$, then Alice and Bob abort the protocol. If $E_{k}^{a_{s},b_{s}}\leq E_{tol}$, Alice and Bob use $Z_{k}^{a,b}$ and $X_{k}^{a,b}$ to estimate $n_{k,0},n_{k,1}$ and $e_{k,1}$. The parameter $n_{k,0}$ is a lower bound for the number of bits in $\mathcal{Z^{\prime}}_{k,\text{keep}}$ where Bob sent a vacuum state. $\mathcal{Z^{\prime}}_{k,\text{keep}}$ is the part of $\mathcal{Z^{\prime}}_{k}$ which he chooses to keep with himself while he forwards the other remaining part, $\mathcal{Z^{\prime}}_{k,\text{forward}}$, to Charlie during the key symmetrization process. That is, $|\mathcal{Z^{\prime}}_{k,\text{keep}}|=|\mathcal{Z^{\prime}}_{k,\text{forward}}|=n_{k}/2$. In a similar way, $n_{k,1}$ is a lower bound for the number of bits in $\mathcal{Z^{\prime}}_{k,\text{keep}}$ where Alice and Bob sent a single-photon state. $e_{k,1}$ is an upper bound for the single-photon phase error rate. If $e_{k,1}\geq e_{tol}$, the code bit strings $\mathcal{Z}_{k}$ and $\mathcal{Z^{\prime}}_{k}$ are discarded, and the protocol is aborted only if $e_{k,1}\geq e_{tol}$ $\forall k$.

We will assume that Eve implements her Bell state measurement using linear optics. The measurement setup is illustrated in Fig. 2; it is able to identify two of the four Bell states. Alice and Bob choose $\mathcal{Z}_{k}$ and $\mathcal{Z^{\prime}}_{k}$ as their respective secret keys $A^{B}_{m}$ and $K^{B}_{m}$ of length $L$ (where $L=n_{k}$), for which they obtained the smallest phase error rate $e_{k,1}$. Here, we will consider a finite number of states that are sent and measured, where Eve is allowed to perform general coherent attacks.

Our strategy is to find Eve’s information in terms of the smooth min-entropy Tomamichel2011 , and then use it to bound the probability that she can make a signature declaration making fewer errors than a certain value. We begin by finding Eve’s smooth min-entropy on Bob’s bit string $\mathcal{Z^{\prime}}_{k,\text{keep}}$, by following the same strategy as in Amiri2015 . In spite of the fact that the KGP is built on MDI-QKD, the security analysis for the MDI-KGP does not follow directly from the security of the MDI-QKD protocol. One reason is that the goal of an adversary in the signature protocol is different from that of an eavesdropper in MDI-QKD. For the signature protocol, what matters is the number of mismatches with a recipient’s key; for QKD, what matters is the information an eavesdropper can hold about a key. These are related but not identical.

Previous work Amiri2015 followed Lim2014 to find Eve’s smooth min-entropy in a similar way as for decoy-state QKD. Another important difference from QKD is that in the signature protocol, Bob effectively gives the extra information $\mathcal{Z^{\prime}}_{k,\text{forward}}$ to Eve (with respect to forging with Bob, Charlie can be “Eve”). In a similar way, let us denote the classical random variables $R_{k}$ and $\Theta$ as the information gained by Eve from parameter estimation and basis declarations for all the pulses sent by Alice and Bob, respectively. Since Bob, if he is honest, does not use $\mathcal{Z^{\prime}}_{k,\text{forward}}$, this could be treated as the part of the string $R_{k}$ that is sacrificed for parameter estimation, as explained in Tomamichel2015 . We combine all of Eve’s information into one quantum system living in the Hilbert space $\mathcal{H}_{E}$. This comprises the space containing Eve’s ancilla quantum system following her general attack, $\mathcal{H}_{E^{\prime}}$, as well as the spaces containing the states encoding the strings $R_{k},\Theta$ and $\mathcal{Z^{\prime}}_{k,\text{forward}}$. Then, according to Curty2014 , Eve’s smooth min-entropy, which quantifies the average probability that she guesses $\mathcal{Z^{\prime}}_{k,\text{keep}}$ within a certain threshold using the optimal strategy with access to $E_{k}$, is given by

[TABLE]

where $\varepsilon_{k}\geq\varepsilon^{\prime}_{k}+{\hat{\varepsilon}}_{k}$ and $\rho$ is the state shared by Eve and the part of the key that Bob kept and did not forward. We are interested in a regime where the first two terms on the RHS of equation (1) are much larger than the $\log_{2}$ term as $\varepsilon^{\prime}_{k}$ and $\hat{\varepsilon}_{k}$ are typically of the order say $10^{-5}-10^{-10}$. Therefore, we arrive at the following approximation of equation (1):

[TABLE]

Appendix A provides a brief analysis of the estimation of the parameters $n_{k,0}$, $n_{k,1}$, and $e_{k,1}$, and Appendix B briefly describes the steps involved to obtain equation (1).

Note that equation (2) is similar to equation (1) obtained in Amiri2015 . The next task is to bound the number of errors that Eve is likely to make when guessing Bob’s key, given the bound on her smooth min-entropy. For this, we use Proposition $1$ in Amiri2015 and follow the same argumentation.

Proposition 1

Amiri2015 * If Bob and Eve share the state $\rho$ then, for any eavesdropping strategy, Eve’s average probability of making at most $r$ mistakes when guessing $\mathcal{Z^{\prime}}_{k,\text{keep}}$ can be upper bounded as*

[TABLE]

The proof of this proposition follows the lines introduced in Appendix B of Amiri2015 . For large $n_{k}$, it can be shown from Markov’s inequality that equation (3) implies

[TABLE]

except with probability at most

[TABLE]

where $c_{k,i}:={2n_{k,i}}/{n_{k}}$ is the lower bound on the count rate for the $Z$ basis pulses containing $i$ photons. Therefore, we arrive at the condition that determines whether or not Eve is able to make fewer than $r$ errors with non-negligible probability, given as

[TABLE]

If the condition holds, then $n_{k}$ can be increased to make Eve’s probability of making fewer than $r$ errors arbitrarily small. We define $p_{E}$ by the equation

[TABLE]

The meaning of this is that $p_{E}$ is the minimum rate at which Eve can make errors for the code string associated with the Bell state $k$ (except with negligible probability $p_{F}$). Suppose the error rate on the $Z$ basis measurements between Alice and Bob is upper bounded as $\overline{E}_{k}$. As long as $p_{E}>\overline{E}_{k}$, there exists a choice of parameters and a sufficiently large signature length which makes the protocol secure. This means that MDI-QDS is possible as long as

[TABLE]

IV Security analysis

We will now prove the security of the signature protocol, i.e. the robustness (probability of an honest run aborting), security against forging (probability that a recipient generates a signature, not originating from Alice, that is accepted as authentic) and repudiation (or transferability) (probability that Alice generates a signature that is accepted by Bob but then when forwarded, is rejected by Charlie). In what follows we assume that Alice-Bob and Alice-Charlie have each used the MDI-KGP to generate bit strings of length $L=n_{k}$, to use in the QDS protocol described above.

(a) Robustness. Bob rejects a signed message if the $\frac{n_{k}}{2}$ bits received from either Alice or Charlie have a mismatch rate higher than $s_{a}$ with Alice’s signature. We note that Alice and Bob use a random sample, $R_{k}$ bits from $Z_{k}^{a_{s},b_{s}}$, to obtain the error rate $E_{k}^{a_{s},b_{s}}$. This implies that the error rate $\overline{E}_{k}^{a_{s},b_{s}}$ between the strings ($\mathcal{Z}_{k,\text{keep}}$ and $\mathcal{Z^{\prime}}_{k,\text{keep}}$) generated using the $Z$ basis satisfies the inequality Serfling1974

[TABLE]

where

[TABLE]

This means that the upper bound which we obtain from equation (9) on the error rate between Alice’s and Bob’s strings is true except with a very small probability $\varepsilon_{PE}$, and this probability can be fixed as small as desired. For any fixed value of the function $\mu$, the failure probability decays exponentially fast in the parameter $R_{k}$. Then we set $\overline{E}_{k}:=max\{\overline{E}_{k,B},\overline{E}_{k,C}\}$, where $\overline{E}_{k,B}$ and $\overline{E}_{k,C}$ refer to the upper bound obtained in equation (9) for the cases Alice-Bob and Alice-Charlie, and we choose $s_{a}$ such that $s_{a}>\overline{E}_{k}$. We have that the probability that Bob will find an error rate higher than $s_{a}$ is bounded by

[TABLE]

where the factor of 2 accounts for the fact that the abort can be due to either the states received from Alice or the states received from Charlie.

(b) Security against repudiation. Successful repudiation by Alice means, in the three-party scenario, that she makes Bob accept a declaration $(m,Sig_{m})$ that was sent to him by her, while Charlie rejects the same declaration when Bob forwards it to him (or similarly for a message forwarded from Charlie to Bob). Intuitively, security against repudiation follows because of the symmetrisation performed by Bob and Charlie using the secret classical channel. Even if Alice knows and can control the error rates between $A^{B}_{m}$, $A^{C}_{m}$ and $K^{B}_{m}$, $K^{C}_{m}$, she cannot control whether the errors end up with Bob or Charlie. After symmetrisation the keys $S^{B}_{m}$ and $S^{C}_{m}$ will each have the same expected number of errors. To repudiate, one key must contain significantly more errors than the other. Using results from Amiri2015 , we obtain

[TABLE]

For a formal proof, please see Appendix C. Note that the probability of repudiation decays exponentially as the length $n_{k}$ of the signature increases.

(c) Security against forging. It is easier for either Bob or Charlie to forge than it is for any other external party. Therefore, we will consider forging by an internal party. In order to forge a message, Bob must give a declaration $(m,Sig_{m})$ to Charlie that has fewer than $s_{v}{n_{k}}/{2}$ mismatches with the (to Bob) unknown half of $S^{C}_{m}$ sent directly from Alice to Charlie, and also fewer than $s_{v}{n_{k}}/{2}$ mismatches with the half he himself forwarded to Charlie. An adversarial Bob will obviously be able to meet the threshold on the part he forwarded to Charlie. We therefore consider only the unknown half that Charlie received directly from Alice. We have that the maximum rate at which Alice will make errors with Charlie’s key is given by $\overline{E}_{k}$. From Eq. (7), we also know the minimum rate at which Bob will make errors with the code string associated with the Bell state $k$ of Charlie’s key; we have denoted this by $p_{E}$. Assuming (8) holds, we choose $s_{v}$ such that $\overline{E}_{k}<s_{v}<p_{E}$. In this case, Charlie will likely accept a legitimate signature sent by Alice, since the upper bound on their error rate, $\overline{E}_{k}$, is less than the threshold $s_{v}$. On the other hand, Charlie will likely reject any dishonest signature declaration by Bob, since the probability of Bob finding a signature with an error rate smaller than $s_{v}$ is restricted by (4) as

[TABLE]

except with probability at most $p_{F}$ given by (5). If the estimation of the parameter $\overline{E}_{k}$ fails, which can happen with probability $\varepsilon_{PE}$, we will assume for simplicity that Bob is able to successfully forge with certainty. In a similar way as in Amiri2015 , we are then able to bound Bob’s probability of successfully forging as

[TABLE]

This equation is valid for any choice of parameters ($g,\varepsilon_{PE},\varepsilon_{k,0},\varepsilon_{k,1},\varepsilon_{k,e}$) greater than [math]. Thereby, Bob’s probability to forge can be made arbitrarily small by increasing $n_{k}$. The addition of $\varepsilon_{PE}$ accounts for the probability that the upper bound on $\overline{E}_{k}$ is incorrect and $\varepsilon_{k,0},\varepsilon_{k,1}$ and $\varepsilon_{k,e}$ are the error probabilities associated with the estimation of $n_{k,0},n_{k,1}$ and $e_{k,1}$ respectively (see Appendix A).

V Comparison to MDI-QKD

According to Curty2014 , in MDI-QKD the length $l_{k}$ of the secret bit string associated to the Bell state $k$ is given by

[TABLE]

if the protocol is $\epsilon_{sec}$-secret, with $\epsilon_{sec}=\sum_{k}\epsilon_{k,sec}$ and $\epsilon_{k,sec}=2(\varepsilon^{\prime}_{k}+2\varepsilon_{k,e}+\hat{\varepsilon}_{k})+\varepsilon_{k,b}+\varepsilon_{k,0}+\varepsilon_{k,1}+\varepsilon_{k,PA}$. Here $\varepsilon_{k,PA}$ is the failure probability of privacy amplification, and the term $leak_{EC,k}$ is the information that is revealed by Alice in the error correction step. The meaning of the remaining epsilons can be found in Curty2014 . The correctness of the protocol is guaranteed by the error correction step, and we say that the protocol is $\epsilon_{cor}$-correct if the probability that Alice’s and Bob’s bit strings are not identical is not greater than $\epsilon_{cor}$. In the asymptotic limit of very large data blocks, one can neglect certain terms that reduce the secret key length and thereby equation (15) can be rewritten as

[TABLE]

Here, $c_{k,i}:={n_{k,i}}/n_{k}$ increase the secret key rate, while $n_{k}c_{k,1}h(e_{k,1})$ and $leak_{EC,k}$ reduce it. These parameters depend on the sifted key length $n_{k}$ Curty2014 . $leak_{EC,k}=n_{k}\zeta h(\overline{E}_{k}^{a_{s},b_{s}})$, where $\zeta$ is referred to as the leakage parameter, which depends on the value of $n_{k}$, and $h(.)$ denotes the binary Shannon entropy. $\zeta$ is assumed to be 1.16 in Curty2014 but can generally be in the range 1.1 - 1.2, and when $n_{k}<10^{5}$ the parameter $\zeta$ may be greater than 1.16. Therefore, for a sifted key length $\frac{n_{k}}{2}$, equation (16) can be written as

[TABLE]

In a similar way as in Amiri2015 , when we compare equations (8) and (17), we find that there are Alice-Bob and Alice-Charlie quantum channels for which quantum signatures are possible and yet practical MDI-QKD is not, since the error threshold is less strict for the quantum channels used to perform the KGP in the signature protocol.

VI Discussion

In this section, we analyse the number of quantum transmissions necessary to sign a message with a security level of the order of $10^{-5}$ and $10^{-10}$ respectively. If the security level of the protocol is of the order of, say, $10^{-5}$, then this means that the probabilities of honest abort, forging and repudiation are all less than $10^{-5}$.

Using realistic experimental quantities, we estimate that a signature length of $n_{k}=8.9\times 10^{6}$ (for each of the possible single bit messages [math] and $1$) can be used to securely sign a single bit message, sent over a distance of 50 km. Essentially, it would require Bob or Charlie to transmit approximately $N_{sig}=5.58\times 10^{12}$ quantum states (per bit to be signed) to Alice during their KGPs (for full details see Appendix D). With a source with a pulse rate of 1GHz, we can calculate that it would take approximately 93 minutes to generate a raw key when the experiment uses standard single-photon detectors with detection efficiency ($\eta_{D}$) of 14.5%. This is for a security level of the order of $10^{-5}$. By using detectors with higher detection efficiency we can improve the time of generating a raw key ($t_{r}$) since sending a smaller number of signals ($N_{sig}$) is then required to sign a single-bit message.

Table 2 shows the raw key generation times for various detectors that could be used in the protocol. We find that the most advanced superconducting nanowire single-photon detectors (SNSPDs) having $93\%$ efficiency Marsili2013 would only require Bob or Charlie to send $6.4\times 10^{10}$ signals to perform the protocol with a secure threshold of the order of $10^{-5}$. This would require just above a minute to generate the raw key. In order to improve the security threshold of the protocol (say $10^{-10}$), Bob or Charlie would need to send a higher number of signals compared to the previous case. Table 3 shows the raw key generation times and the number of signals that are required to send for the protocol to be secure for a threshold of the order of $10^{-10}$.

The protocol is secure to the order of $10^{-10}$ for a distance of 50 km, which in comparison is an improvement over the previous scheme Amiri2015 having with a security threshold of $10^{-4}$. The simulation results demonstrate that even with practical signals (for example, phase-randomised WCPs) and a finite size of data (say $10^{11}$ to $10^{14}$ signals) it is possible to perform secure MDI-QDS (with security threshold $10^{-10}$) over long distances (up to about 150 km). Since the experimental platform for the implementation of MDI-QKD can also be used for MDI-QDS with slight modifications, in particular in the post-processing of measurement results, we expect MDI-QDS could be widely used in practical QDS systems in the near future.

VII Conclusion

In summary, we have presented a MDI-QDS protocol and proven it unconditionally secure against general attacks. It improves on previous quantum signature protocols by removing all detector side-channel attacks. This is essentially achieved by adapting the rigorous security proof of MDI-QKD given in Curty2014 , taking into account finite size effects, to the QDS protocol proposed in Amiri2015 and we have presented that the resulting security proof is valid against general forging and repudiation attacks.

Acknowledgements.

The authors would like to thank Marco Lucamarini for discussions. This work was supported by the UK Engineering and Physical Sciences Research Council (EPSRC) under EP/M013472/1. R. A. acknowledges the support of the EPSRC CM-CDT. M.C. gratefully acknowledges support from the Galician Regional Government (program “Ayudas para proyectos de investigacion desarrollados por investigadores emergentes” EM2014/033, and consolidation of Research Units: AtlantTIC), the Spanish Ministry of Economy and Competitiveness (MINECO), the Fondo Europeo de Desarrollo Regional (FEDER) through grant TEC2014-54898-R.

Appendix A Estimation of relevant parameters

In this Appendix we briefly discuss the estimation of the parameter $n_{k,0}$. This is a two-step process. First, we calculate a lower bound for the number of indices in $Z_{k}^{a_{s},b_{s}}$ where Bob sent a vacuum state. This lower bound is denoted $m_{k,0}$. Second, we compute $n_{k,0}$ from $m_{k,0}$ using the Serfling inequality for random sampling without replacement Serfling1974 . The other parameters, $n_{k,1}$ and $e_{k,1}$, are also estimated using a similar approach. A detailed explanation is provided in the supplementary notes of Curty2014 .

We assume that Alice and Bob use two decoy states each and the photon-number distribution of their signals is Poissonian. That is, $a\in A=\{a_{s},a_{d_{1}},a_{d_{2}}\}$, with $a_{s}>a_{d_{1}}>a_{d_{2}}$, $b\in B=\{b_{s},b_{d_{1}},b_{d_{2}}\}$, with $b_{s}>b_{d_{1}}>b_{d_{2}}$, and the probability that Alice (Bob) sends an $n$-photon ($m$-photon) signal when she (he) selects the intensity $a$ ($b$) is given by $p_{n|a}=e^{-a}a^{n}/n!$ ($p_{m|b}=e^{-b}b^{m}/m!$).

Let $S_{k,nm}$ denote the number of signals sent by Alice and Bob with $n$ and $m$ photons respectively, when they select the basis $Z$ and Eve declares the Bell state $k$. Now, for each combination of values $n$ and $m$, the signal and decoy states provide a random sample of the population of all signals containing $n$ and $m$ photons respectively. Therefore, one can apply the standard large deviation theory technique, in particular a multiplicative form of the Chernoff bound Curty2014 . Then, if

[TABLE]

and

[TABLE]

with the parameter $\mu_{k,L}^{a,b}$ given by

[TABLE]

this implies that

[TABLE]

except with error probability $\gamma_{a,b}=\epsilon_{a,b}+\varepsilon_{a,b}+\hat{\varepsilon}_{a,b}$. Here, $p_{a,b|nm,Z}$ refers to the conditional probability that Alice and Bob have selected the intensity settings $a$ and $b$ respectively, given that their signals contain $n$ and $m$ photons respectively, prepared in the $Z$ basis. The parameter $\delta_{a,b}\in\left[-\Delta_{a,b},\hat{\Delta}_{a,b}\right]$ with $\Delta_{a,b}=g(|Z_{k}^{a,b}|,\varepsilon_{a,b}^{4}/16)$ and ${\hat{\Delta}_{a,b}}=g(|Z_{k}^{a,b}|,\hat{\varepsilon}_{a,b}^{3/2})$, and the function $g(x,y)=\sqrt{2x\ln(y^{-1})}$.

By using similar arguments, the quantity $m_{k,0}$ can be written as

[TABLE]

except with error probability $\varepsilon_{0}$, where $\Delta_{0}=g\left(\sum_{n}p_{a_{s},b_{s}|n0,Z}S_{k,n0},\varepsilon_{0}\right)$. To obtain a lower bound for $m_{k,0}$, one can minimise equation (20) given the linear constraints imposed by equation (19) $\forall a,b$. This is solved both analytically and numerically in the supplementary notes of Curty2014 . Then using Serfling inequality Serfling1974 , we find

[TABLE]

except with error probability

[TABLE]

where $\varepsilon^{\prime}_{k,0}\leq\varepsilon_{0}+\sum_{a,b}\gamma_{a,b}$ corresponds to the total error probability in the estimation of $m_{k,0}$ and the function $\Lambda(x,y,z)$ is defined as $\Lambda(x,y,z)=\sqrt{(x-y+1)\ln(z^{-1})/(2xy)}$.

A similar approach is followed to estimate $n_{k,1}$ and $e_{k,1}$ with associated error probabilities $\varepsilon_{k,1}$ and $\varepsilon_{k,e}$ respectively. We obtain

[TABLE]

except with error probability

[TABLE]

where $\varepsilon^{\prime}_{k,1}\leq\varepsilon_{1}+\sum_{a,b}\gamma_{a,b}$. Here, $m_{k,1}=p_{a_{s},b_{s}|11,Z}S_{k,11}-\Delta_{1}$, except with error probability $\varepsilon_{1}$ where the parameter $\Delta_{1}=g(p_{a_{s},b_{s}|11,Z}S_{k,11},\varepsilon_{1})$. Finally, the parameter $e_{k,1}$ is given as

[TABLE]

except with error probability

[TABLE]

where the function $\Upsilon(x,y,z)$ is defined as $\Upsilon(x,y,z)=\sqrt{(x+1)\ln(z^{-1})/(2y(x+y))}$. The quantity $\overline{n}_{k,1}$ is a lower bound for the number of signals where Alice and Bob send a single-photon state prepared in the $X$ basis and where Eve declares the Bell state $k$, $\overline{e}_{k,1}$ is an upper bound for the total number of errors in these signals, and $\varepsilon^{\prime}_{k,e}$ and $\varepsilon^{\prime\prime}_{k,e}$ represent, respectively, their associated error probabilities. For more details about how to calculate these parameters, please see Curty2014 .

We have, therefore, that the error probability associated with the estimation of the different parameters is given by $\varepsilon_{PE}+\varepsilon_{k,0}+\varepsilon_{k,1}+\varepsilon_{k,e}$, with $\varepsilon_{PE}$ given by equation (9).

Appendix B Eve’s smooth-min entropy

The goal of this Appendix is to derive equation (B). The analysis follows the procedure introduced in Curty2014 . For this, let $H^{\varepsilon_{k}}_{\text{min}}(\mathcal{Z^{\prime}}_{k,\text{keep}}|E_{k})$ denote the smooth min-entropy which quantifies the average probability that the adversary guesses $\mathcal{Z^{\prime}}_{k,\text{keep}}$ correctly using the optimal strategy with access to $E_{k}$. Now the bits of $\mathcal{Z^{\prime}}_{k,\text{keep}}$ can be distributed among three different strings, $\mathcal{Z}^{{}^{\prime}0}_{k,\text{keep}},\mathcal{Z}^{{}^{\prime}1}_{k,\text{keep}}$ and $\mathcal{Z}^{{}^{\prime}\text{rest}}_{k,\text{keep}}$. The first string contains bits where Bob sent a vacuum state, the second where Alice and Bob sent a single-photon state, and $\mathcal{Z}^{{}^{\prime}\text{rest}}_{k,\text{keep}}$ contains the rest of bits. Using the result of chain rule of entropies Vitanov2013 , we obtain

[TABLE]

where $\varepsilon_{k}=\epsilon^{\prime}_{k}+2\epsilon^{\prime\prime}_{k}+(\hat{\epsilon_{k}}+2\hat{\epsilon}^{\prime}_{k}+\hat{\epsilon}_{k}^{\prime\prime})$. Here, it is taken into consideration that $H_{\text{min}}^{\hat{\epsilon}^{\prime}_{k}}(\mathcal{Z}_{k,\text{keep}}^{{}^{\prime}\text{rest}}|\mathcal{Z}_{k,\text{keep}}^{{}^{\prime}0}E_{k})\geq 0$, and $H_{\text{min}}^{\hat{\epsilon}^{\prime\prime}_{k}}(\mathcal{Z}_{k,\text{keep}}^{{}^{\prime}0}|E_{k})\geq H_{\text{min}}^{0}(\mathcal{Z}_{k,\text{keep}}^{{}^{\prime}0}|E_{k})=H_{\text{min}}(\mathcal{Z}_{k,\text{keep}}^{{}^{\prime}0})=n_{k,0}$. The final part arises as the vacuum states contain no information about their bit values, which are uniformly distributed. In order to get the lower bound for the term $H_{\text{min}}^{\epsilon^{\prime\prime}_{k}}(\mathcal{Z}_{k,\text{keep}}^{{}^{\prime}1}|\mathcal{Z}_{k,\text{keep}}^{{}^{\prime}0}\mathcal{Z}_{k,\text{keep}}^{{}^{\prime}\text{rest}}E_{k})$, it is considered that Alice and Bob prepare perfect BB84 states. Then, this quantity can be written in terms of the smooth max-entropy between them, which is directly bounded by the strength of the correlations Tomamichel2012 . From the entropy uncertainty relation Tomamichel2011 , we obtain

[TABLE]

Using the above equation in equation (27), we get

[TABLE]

We are interested in a regime where the first two terms on the RHS of equation (B) are much larger than the $\log_{2}$ term, as $\varepsilon^{\prime}_{k}$ and $\hat{\varepsilon}_{k}$ are typically of the order say $10^{-5}-10^{-10}$. Therefore, if we neglect this $\log_{2}$ term, we obtain equation (2) of the main paper,

[TABLE]

Appendix C Security against repudiation

We follow the approach in Wallden2015 . If Alice tries to repudiate a message, she sends a declaration $(m,Sig_{m})$ which Bob will accept and Charlie will reject. For this to happen, Bob must accept both the elements that Alice sent directly to him, and the elements that Charlie forwarded to him. In order for Charlie to reject he needs only to reject either the elements he received from Alice, or the elements Bob forwarded to him (or both). Intuitively, security against repudiation follows because of the symmetrisation performed by Bob and Charlie using the secret classical channel. In the distribution stage, to send the future message $m$, Alice uses the MDI-KGP with Bob and Charlie to generate strings of length $n_{k}=L$. Suppose that Bob holds the string $(b_{1},...,b_{L})$ and Charlie holds the string $(c_{1},...,c_{L})$. Now, for simplicity, we consider that Alice has full power and we assume that later on, in the messaging stage, she is able to fully control the number of mismatches her signature declaration contains with $(b_{1},...,b_{L})$ and $(c_{1},...,c_{L})$. Let us denote the mismatch rates by $e_{B}$ and $e_{C}$ respectively. Then, the symmetrisation process means that Bob and Charlie will randomly (and unknown to Alice) receive $L/2$ elements of the other’s string. We aim to show that any choice of $e_{C}$ and $e_{B}$ leads to an exponentially decaying probability of repudiation. Then we have two cases as in Wallden2015 :

Case 1: First, let us assume that $e_{C}>s_{a}$. In this case, Bob receives $L/2$ elements from the set $\{c_{1},...,c_{L}\}$, which contains exactly $e_{C}L$ mismatches with Alice’s future declaration. In order to accept the message, Bob must get fewer than $s_{a}L/2$ errors. Using Hoeffding1963 we can bound the probability that Bob gets fewer than $s_{a}L/2$ mismatches as

[TABLE]

To repudiate, Alice must make Bob accept the message, which means that Bob must accept both the part received from Alice and the part received from Charlie. Since $Pr(A\cap B)\leq\min\{Pr(A),Pr(B)\}$ the probability of repudiation must be less than or equal to the above expression, and so must also decrease exponentially.

Case 2: Suppose $e_{C}\leq s_{a}$. In this case, if $e_{B}>s_{a}$, the above argument shows that it is highly likely that Bob will reject the message, so we examine only the case where $e_{B}\leq s_{a}$. Consider first the set $\{b_{1},...,b_{L}\}$. We can use the same arguments as above to bound the probability of selecting more than $s_{v}L/2$ mismatches as

[TABLE]

Then, Alice succeeds if Charlie finds more than $s_{v}L/2$ mismatches either from the set $\{b_{1},...,b_{L}\}$ or the set $\{c_{1},...,c_{L}\}$. Using $Pr(A\cup B)\leq Pr(A)+Pr(B)$, we can see that, for the choice of $e_{B},e_{C}\leq s_{a}$, we have

[TABLE]

So again, the probability of Alice successfully repudiating decreases exponentially in the size of the signature, and Alice’s best strategy would be to pick $e_{B}=e_{C}=\frac{1}{2}(s_{v}+s_{a})$, in which case

[TABLE]

Appendix D Calculation of the number of quantum transmissions required per signed bit

D.1 Parameters and constraints

Similar to Amiri2015 , the correctness and security of the protocol depends on the three equations (11), (12) and (14), which in turn depend on the choice of parameters $s_{a}$ and $s_{v}$. The parameters are considered such that $\overline{E}_{k}<s_{a}<s_{v}<p_{E}$. We say that $\overline{E}_{k}$ is the maximum of the worst-case error rates that Alice makes with Bob’s key (found from the Alice-Bob MDI-KGP), and the worst-case error rates Alice makes with Charlie’s key (found from the Alice-Charlie MDI-KGP). Similarly, $p_{E}$ is the minimum of the adversary’s error rates found from the Alice-Bob and Alice-Charlie MDI-KGP. We follow Amiri2015 to choose the parameters that minimise the number of quantum transmissions required per signed bit. This will be larger than the signature length, $L$, due to factors such as channel loss, detection efficiency and parameter estimation procedures. Because of this, Bob will have to transmit more than $L$ quantum states to generate a signature of length $L$.

In the next section, we will calculate the length of the signature and the number of quantum transmissions necessary to sign a message with a security level of $10^{-5}$. This means that the probabilities of honest abort, forging and repudiation, given respectively by (11), (14) and (12), are all less than $10^{-5}$. To find the length per possible one-bit message, of the signature necessary to securely sign a one-bit message, we must first choose the parameters $s_{a}$ and $s_{v}$. That is, a signature sequence of length $L$ needs to be transmitted for the possible message “0”, and for the possible message ‘1”, so that the total signature sequence has length $2L$. Ideally, our choice would minimise $L$. We choose to set $\varepsilon_{PE}=10^{-5}$ and

[TABLE]

These may not be the optimal choices of these parameters. However, a natural choice would be to choose the parameters in order to equally partition the gap between $\overline{E}_{k}$ and $p_{E}$.

D.2 The number of quantum transmissions required per signed bit

In this section, we use experimental data provided by Ursin2007 to give an optimal estimate of the number of states Bob needs to transmit over a $50$ km quantum channel to securely sign a one bit message. We set $\epsilon_{PE}=10^{-5}$ in all equations that follow. The experiment in Ursin2007 considers a free-space channel, we assume a fibre-based channel with a loss coefficient of $0.2$ dB/km. Here, we consider standard single-photon detectors where the detection efficiency of the relay is $14.5\%$ and the background rate is $6.02\times 10^{-6}$. The overall misalignment in the channel is assumed to be $1\%$ and the bound is fixed to be $\varepsilon_{k}=10^{-10}$. The other parameters involved are:

• •

Source: 1 GHz pulse rate

• •

Basis probabilities: $p_{Z}=62.5\%$, $p_{X}=37.5\%$.

• •

Intensity levels: $(s,d_{1},d_{2})=(0.18,0.09,5\times 10^{-4})$.

• •

Intensity probabilities: $p_{s}=50\%$, $p_{d1}=p_{d2}=25\%$.

We consider the total number of signals sent by Bob to be $5.58\times 10^{12}$, and find the raw key to contain $9.42\times 10^{6}$ bit values from $Z$ basis measurement outcomes. Assuming that $5.5\%$ of the detected signals are used for error rate estimation ($R_{k}=5.18\times 10^{5}$), we obtain a signature length of $n_{k}=8.9\times 10^{6}$. Of these, Bob will randomly choose $n_{k}/2=4.45\times 10^{6}$ to be $\mathcal{Z^{\prime}}_{k,\text{keep}}$, another $n_{k}/2$ will be used as $\mathcal{Z^{\prime}}_{k,\text{forward}}$.

For the given intensity levels and intensity choice probabilities, we observe an error rate in the $Z$ basis given by $E_{k}^{a_{s},b_{s}}=2.07\%$. This error rate arises from the channel misalignment together with the dark-count rate of the detectors. We can then use Eq.(9) to upper bound the true error rate as $\overline{E}_{k}^{a_{s},b_{s}}=2.39\%$.

We use Appendix A to estimate the relevant parameters by setting all $\varepsilon$ as $10^{-10}$, and thereby we can calculate the min-entropy. Finally, setting $\varepsilon_{k}=10^{-10}$, we get

[TABLE]

Then using (7) we find $p_{E}$ as $3.02\%$, and so we obtain $s_{a}=2.60\%$ and $s_{v}=2.81\%$. Setting $g$ as $10^{-5}$ and substituting these values into equations (11), (14) and (12), we find $Pr(\text{Honest Abort})=2.00\times 10^{-5}$, $Pr(\text{Forge})=3\times 10^{-5}$, and $Pr(\text{Repudiation})=9.857\times 10^{-5}$. Thus we observe that when $5.58\times 10^{12}$ states are transmitted, the protocol is secure to a level of the order of $10^{-5}$ for a distance of $50$ km. The analysis for the other cases shown in Tables II and III is done in a similar way.