Semi-device-independent quantum money with coherent states

TL;DR

This paper presents a security proof for semi-device-independent quantum money using coherent states, accounting for practical imperfections and analyzing protocol security over time with quantum memory.

Contribution

It provides a novel security analysis for quantum money protocols with classical verification in realistic settings using semidefinite programming.

Findings

Secure regimes identified in fixed and randomized phase settings.

Protocol security evolution analyzed with decohering quantum memory.

Secure credit card lifetimes determined for specific configurations.

Abstract

The no-cloning property of quantum mechanics allows unforgeability of quantum banknotes and credit cards. Quantum credit card protocols involve a bank, a client and a payment terminal, and their practical implementation typically relies on encoding information on weak coherent states of light. Here, we provide a security proof in this practical setting for semi-device-independent quantum money with classical verification, involving an honest bank, a dishonest client and a potentially untrusted terminal. Our analysis uses semidefinite programming in the coherent state framework and aims at simultaneously optimizing over the noise and losses introduced by a dishonest party. We discuss secure regimes of operation in both fixed and randomized phase settings, taking into account experimental imperfections. Finally, we study the evolution of protocol security in the presence of a decohering optical quantum memory and identify secure credit card lifetimes for a specific configuration.

Figures

Tables

Table 1. Table 1 : Scenarios for quantum money with classical verification in terms of honest (H) and dishonest (D) parties. Cases denoted by D/H are indistinguishable to the bank. In this work, (ii) is studied in a semi-device-independent regime, since the squashing model allows to strongly limit the assumptions on the terminal detectors, while both (iii) and (iv) are by definition semi-device-independent. Here, we do not study (iv) , recently defined and analyzed in Horodecki and Stankiewicz ( 2018 ) , or the unrealistic scenario (v) .

	Mint	Client	Terminal	Bank	Parameter
(i)	H	H	H	H	correctness c
(ii)	H	D	H	H	error rate $e$
(iii)	H	D/H	D	H	error rate $e$
(iv)	D	D/H	D	H	N/A
(v)	D	D/H	D/H	D	N/A

Table 2. Table 2 : Numerical solutions of the dual problem ( 9 ) were found for all possible combinations of the above e 𝑒 e and μ 𝜇 \mu values, using the SDPT3 solver from the CVX software with its default numerical precision ( 10 − 9 superscript 10 9 10^{-9} ). These solutions obeyed the constraints ( 10 ) within numerical accuracy and all present a duality gap of order 10 − 9 superscript 10 9 10^{-9} . We note that, when e < 10 − 6 𝑒 superscript 10 6 e<10^{-6} , the solver struggles to find an accurate solution for some low values of μ 𝜇 \mu , as it fails to decrease the duality gap to less than 10 − 7 superscript 10 7 10^{-7} . The inaccurate optimal dual solutions are nevertheless close to the accurate primal optimal solutions within 10 − 4 superscript 10 4 10^{-4} .

$e$	${10}^{-6}$	${10}^{-3}$	0.01	0.02	0.05	0.10
$\mu$	0.01	0.05	0.10	0.50	1.00	2.00

Table 3. Table 3 : Optimal numerical solutions to ( 12 ) in various scenarios.

$\mu$	$e$, trusted	$e$, untrusted	$f_h$
Non phase-randomized, ${\eta }_d=100\%$
0.05	0.1%	0.1%	95.1%
0.10	0.3%	0.1%	90.5%
0.15	0.4%	0.1%	86.1%
0.25	0.5%	0 %	77.9%
0.55	0.7%	0 %	57.7%
Phase-randomized, ${\eta }_d=100\%$
0.50	2.2%	1.1%	60.1%
0.75	2.6%	1.3%	47.2%
1.00	2.7%	1.3%	36.8%
1.25	2.6%	1.3%	28.7%
1.50	2.4%	1.2%	22.3%
Phase-randomized, ${\eta }_d=80\%$
0.40	1.1%	0.2%	72.6%
0.60	1.4%	0.2%	61.9%
0.80	1.5%	0.2%	52.7%
1.00	1.5%	0.1%	44.9%
1.20	1.5%	0.1%	38.3%

Equations

$$|0⟩$$

$$|+⟩$$

$$|+i⟩$$

$$⟨{\psi }_3|\Lambda (|{\psi }_1⟩⟨{\psi }_1|)|{\psi }_3⟩=⟨{\psi }_3|\otimes ⟨\overline{{\psi }_1}|J(\Lambda )|{\psi }_3⟩\otimes |\overline{{\psi }_1}⟩,$$

$$E_1(\mu )=$$

$$E_2(\mu )=$$

$$L_1(\mu )=\frac{1}{4}\sum _{k=0}^3|\varnothing ⟩⟨\varnothing |\otimes 1\otimes |\overline{{\alpha }_k}⟩⟨\overline{{\alpha }_k}|$$

$$L_2(\mu )=\frac{1}{4}\sum _{k=0}^{3}1\otimes |\varnothing ⟩⟨\varnothing |\otimes |\overline{{\alpha }_k}⟩⟨\overline{{\alpha }_k}|.$$

$$\min$$

$${\mathrm{Tr}}_{{\mathcal{H}}_1\otimes {\mathcal{H}}_2}\left(J(\Lambda )\right)=1_{{\mathcal{H}}_{\text{mint}}}$$

$$\mathrm{Tr}\left(E_1(\mu )J(\Lambda )\right)=e$$

$$\mathrm{Tr}\left(E_1(\mu )J(\Lambda )\right)⩾\mathrm{Tr}\left(E_2(\mu )J(\Lambda )\right)$$

$$\mathrm{Tr}\left(L_1(\mu )J(\Lambda )\right)⩾\mathrm{Tr}\left(L_2(\mu )J(\Lambda )\right)$$

$$J(\Lambda )⩾0.$$

$$E_1(\mu )=\frac{1}{16}\sum _{i,j=0}^1$$

$$\otimes |c_i,c_j,\overline{{\alpha }_k}⟩⟨c_i,c_j,\overline{{\alpha }_k}|$$

$$L_1(\mu )=\frac{1}{16}\sum _{i,j=0}^1\sum _{k=0}^3$$

$$\otimes |c_i,c_j,\overline{{\alpha }_k}⟩⟨c_i,c_j,\overline{{\alpha }_k}|,$$

$$|{\Phi }^{+}⟩⟨{\Phi }^{+}|=\frac{1}{d}\sum _{i,j=1}^d|i⟩⟨j|\otimes |i⟩⟨j|$$

$$J(\Lambda )=\frac{1}{d}\sum _{i,j=1}^d\Lambda (|i⟩⟨j|)\otimes |i⟩⟨j|.$$

$$⟨{\psi }_3|\otimes$$

$$=⟨{\psi }_3|\otimes ⟨\overline{{\psi }_1}|\left(\text{smashoperator}[r]\sum _{i,j=1}^d\Lambda (|i⟩⟨j|)\otimes |i⟩⟨j|\right)|{\psi }_3⟩\otimes |\overline{{\psi }_1}⟩$$

$$=\text{smashoperator}[]\sum _{i,j=1}^d⟨{\psi }_3|\Lambda (|i⟩⟨j|)|{\psi }_3⟩\otimes ⟨\overline{{\psi }_1}⟩i⟨j⟩\overline{{\psi }_1}$$

$$=\text{smashoperator}[]\sum _{i,j=1}^d⟨{\psi }_3|\Lambda (|i⟩⟨j|)|{\psi }_3⟩\otimes ⟨i⟩{\psi }_1⟨{\psi }_1⟩j$$

$$=\sum _{i,j=1}^d⟨{\psi }_3|\Lambda ({\psi }_{1,ij}|i⟩⟨j|)|{\psi }_3⟩$$

$$=⟨{\psi }_3|\Lambda (|{\psi }_1⟩⟨{\psi }_1|)|{\psi }_3⟩,$$

$$|{\alpha }_0⟩$$

$$|{\alpha }_1⟩$$

$$|{\alpha }_2⟩$$

$$|{\alpha }_3⟩$$

$$C_0$$

$$C_1$$

$$C_2$$

$$C_3$$

$$|e^{i\varphi }\frac{\alpha }{\sqrt{2}}⟩\otimes |e^{i(\varphi +\theta )}\frac{\alpha }{\sqrt{2}}⟩,$$

$$\frac{1}{2\pi }{\int }_0^{2\pi }|\sqrt{\mu }{e}^{i\varphi }⟩⟨\sqrt{\mu }{e}^{i\varphi }|d\varphi =e^{-\mu }\sum _{n=0}^{\infty }\frac{{\mu }^n}{n!}|n⟩⟨n|,$$

$${\rho }_0$$

$${\rho }_1$$

$${\rho }_2$$

$${\rho }_3$$

$$p_0(\mu )$$

$$\mathcal{P}(n,j,\mathcal{C})=\sum _{s(j)}\underset{i=0}{\overset{n-1}{⨂}}\left[s_i(j){\mathcal{C}}_i+\overline{s_i(j)}(1-{\mathcal{C}}_i)\right],$$

$$\displaystyle\begin{multlined}L^{(n)}_{1}(\mu)=\frac{1}{4^{n}}\sum_{j=1}^{n}\smashoperator[r]{\sum_{k_{1}\cdots k_{n}=0}^{3}}\tfrac{j}{n}\mathcal{P}\left(n,j,\mathcal{C}^{(\varnothing,n)}\right)\otimes\mathbb{1}_{\mathcal{H}^{(n)}_{2}}\\ \otimes\left(\ket{\overline{\alpha_{k_{1}}}}\bra{\overline{\alpha_{k_{1}}}}\otimes\cdots\otimes\ket{\overline{\alpha_{k_{n}}}}\bra{\overline{\alpha_{k_{n}}}}\right)\\ \end{multlined}L^{(n)}_{1}(\mu)=\frac{1}{4^{n}}\sum_{j=1}^{n}\smashoperator[r]{\sum_{k_{1}\cdots k_{n}=0}^{3}}\tfrac{j}{n}\mathcal{P}\left(n,j,\mathcal{C}^{(\varnothing,n)}\right)\otimes\mathbb{1}_{\mathcal{H}^{(n)}_{2}}\\ \otimes\left(\ket{\overline{\alpha_{k_{1}}}}\bra{\overline{\alpha_{k_{1}}}}\otimes\cdots\otimes\ket{\overline{\alpha_{k_{n}}}}\bra{\overline{\alpha_{k_{n}}}}\right)\\$$

Full text

In contrast to classical physics, quantum mechanical systems have a no-cloning property Wooters and Zurek (1982): it is impossible to make a perfect copy of a quantum object in an unknown state. This property was used by Wiesner in his proposal to mint unforgeable quantum money Wiesner (1983), giving birth to the field of quantum cryptography Bennett and Brassard (1984); Gisin et al. (2002); Scarani et al. (2009). The original idea involved a bank encoding a secret classical key into a sequence of two-level quantum states (qubits) stored in a quantum memory and handed to a client. The secret key specifies the basis in which each qubit is encoded, ensuring that a forger ignoring the basis in which to measure it will destroy information. This will then trigger incorrect measurement outcomes when the bank will verify the validity of the banknote. Such a scheme may be impractical over long distances due to a potentially lossy and noisy transmission of the quantum states between the client and the bank. It was also shown to be vulnerable to adaptive attacks, where a counterfeiter can use the same banknote several times Brodutch et al. (2016). An alternative protocol with verification using classical communication was first proposed in Gavinski (2012) and extended to practical, noise-tolerant schemes in Pastawski et al. (2012); Georgiou and Kerenidis (2015); Amiri and Arrazola (2017).

Although quantum key distribution protocols have been widely studied and implemented Diamanti et al. (2016), quantum money has not yet seen the same experimental progress, essentially because of the difficulty in implementing efficient quantum storage devices Heshami et al. (2016). However, the experimental interest in quantum money has grown recently, with demonstration of forgery of quantum banknotes Bartkiewicz et al. (2017) and implementation of weak coherent state- based quantum credit card schemes, secure in a trusted terminal scenario Bozzio et al. (2018); Guan et al. (2018), in the prospect of near-future implementations with a quantum memory. These require new security proofs tackling the optimal cloning of coherent states, differing from qubit-based quantum money and also quantum key distribution proofs.

In quantum cryptography, semi-device-independent frameworks have been developed in order to limit the needed assumptions to ensure security. While not as stringent as full device independence Acin et al. (2007), this approach allows for practical security and performance while making fewer assumptions on the implementation than usual security proofs. This includes assumptions on the detectors Ma and Lütkenhaus (2012); Branciard et al. (2012); Lo et al. (2012); Braunstein and Pirandola (2012), the dimensionality of the quantum states Liang et al. (2011); Pawłowski and Brunner (2011); Gittsovich and Moroder (2013) and other parameters Van Himbeeck et al. (2017). For quantum money, semi-device-independence relates to scenarios where one does not trust the terminal, as in this work and Horodecki and Stankiewicz (2018); Jiráková et al. (2018), along with scenarios where the state preparation Horodecki and Stankiewicz (2018) or the terminal is trusted but imperfectly characterized.

In this work, we derive a quantum money security proof which incorporates semi-device-independence to deal with both trusted and untrusted payment terminals in the presence of experimental imperfections. We do so by extending the semidefinite programming (SDP) techniques from Molina et al. (2013); Watrous (2011); Vandenberghe and Boyd (1996) to the coherent state framework and using the squashing model from Beaudry et al. (2008); Gittsovich et al. (2014). We also adapt our proof to study the effect of a decohering quantum memory. We remark that recent and concurrent work by Horodecki and Stankiewicz Horodecki and Stankiewicz (2018) also studies semi-device-independent quantum money, in a stronger threat model than here (scenario (iv) of Table 1), but without our focus on realistic implementations.

I I. Protocol and correctness

We consider the qubit scheme introduced by Wiesner Wiesner (1983) in the classical verification setting of Gavinski (2012); Pastawski et al. (2012); Georgiou and Kerenidis (2015); Amiri and Arrazola (2017). In this three-party quantum money scheme, the mint generates a random secret classical key $k^{(s)}$ and encodes it according to a secret classical basis key $b^{(s)}$. The quantum credit card state associated to public serial number $s$ is then written as $\ket{\text{€}^{(k,b)}}=\bigotimes_{j=1}^{n}\ket{\psi_{j}^{(k,b)}}$, where $\ket{\psi_{j}^{(k,b)}}\in\{\ket{+},\ket{+i},\ket{-},\ket{-i}\}$. More specifically, bit $k^{(s)}_{j}$ is encoded in the $\sigma_{x}$ basis when $b^{(s)}_{j}=0$, and in the $\sigma_{y}$ basis when $b^{(s)}_{j}=1$.

The mint stores $\ket{\text{€}^{(k,b)}}$ in a quantum memory and hands it to a client. When a transaction must be performed, the merchant’s honest terminal measures each of the $n$ qubits of $\ket{\text{€}^{(k,b)}}$ in a basis dictated by a challenge question randomly chosen by the bank. For a single qubit state, the challenge $c_{0}$ (resp. $c_{1}$) reads: Give the correct measurement outcome if the qubit is encoded in the $\sigma_{x}$ (resp. $\sigma_{y}$) basis, and provide any outcome if the qubit is encoded in the $\sigma_{y}$ (resp. $\sigma_{x}$) basis. The terminal measures the qubit in the basis associated with the given challenge, which provides the honest success probability or correctness $c=1$. The answers corresponding to the measurement results are sent in the form of a classical bit string to the bank, which compares it with $k^{(s)}$ and accepts the credit card only if all the measurement outcomes coincide with $k^{(s)}$.

We now consider the same honest protocol in which qubit states are mapped onto two-mode weak coherent states as:

[TABLE]

where $\alpha$ is the coherent state amplitude and $\ket{\text{vac}}$ denotes the vacuum state. Such a mapping is typically used for polarization or time-bin encoding, where the $\ket{0}$ component is mapped onto the first mode and the $\ket{1}$ component is mapped onto the second Lo and Preskill (2007). When dealing with polarization, the honest terminal measures each of the $n$ credit card states in the basis which answers either $c_{0}$ or $c_{1}$ by typically rotating a half or quarter waveplate. It then outputs $(1-f_{h})n$ measurement outcomes, where $f_{h}\approx e^{-\eta_{d}\mu}$ represents the honest losses assuming a weak coherent light source with average photon number per pulse $\mu=|\alpha|^{2}$, unit channel transmission efficiency, and threshold single-photon detectors with quantum efficiency $\eta_{d}$. When no detection occurs, the terminal reports a flag, denoted by $\varnothing$. For large sample sizes, the $n$-state challenge is then satisfied only if the total number of no-detection reports is equal to $f_{h}n$. The multi-photon component of coherent states may also trigger clicks on both detectors at the same time. An adversary may actually exploit this property to boost his cheating probability. Following the methods used in Beaudry et al. (2008), clicks on both detectors are randomly mapped to a single click as either a [math] or $1$. This allows to use a squashing model to securely map the infinite-dimensional threshold detection POVMs to a finite dimensional Hilbert space.

II II. Security

II.1 A. Principle and proof outline

Table 1 shows the possible security scenarios for quantum money schemes. A successful forging attack consists in answering two challenges correctly at the same time, corresponding to extracting twice the original amount of money in one’s possession. As the last four states from Eq. (1) are identical on the first mode, we may reduce our security analysis to the single state $\ket{\alpha_{k}}=\ket{i^{k}\frac{\alpha}{\sqrt{2}}}$ with $k\leqslant 3$, before extending it to $n$ states. In scenario (ii), an attack is materialized by the creation of two copies of the quantum credit card state, both being accepted by the bank when measured by two separate trusted terminals. In scenario (iii), an attack is materialized by the communication of two classical strings by two untrusted terminals to the bank, which accepts both of them. In a coherent state implementation, the adversary may modify one or both of the following parameters: losses $f_{d}$ (probability of a projection onto the vacuum state), and error rate $e$. The bank may detect an attack when $f_{d}>f_{h}$ or when the measured error rate $e$ upon verification is larger than expected. Given average photon number $\mu$, we use SDP techniques Watrous (2011); Vandenberghe and Boyd (1996) to first minimize the losses that the adversary must introduce in (ii) or declare in (iii) to succeed with probability $(1-e)$. We can then identify the range of $\mu$ for which $f_{d}>f_{h}$. We will use Choi’s theorem (see Appendix A.1 for details) to optimize over the best adversarial linear cloning map. For (ii), the figure of merit for the optimization is based on the measurements of the two trusted terminals. For (iii), the figure of merit becomes the acceptance of classical data by the bank. We then show how this single state analysis gives a bound for the $n$-state proof. We also note the following useful property from Molina et al. (2013), proven in Appendix A.2: given $\ket{\psi_{1}}\in\mathcal{H}_{1}^{d}$, $\ket{\psi_{3}}\in\mathcal{H}_{3}^{d^{\prime}}$, and Choi–Jamiołkowski operator $J(\Lambda)$ associated to map $\Lambda$, we have

[TABLE]

where the overline denotes complex conjugation.

II.2 B. Trusted terminal

We shall first study the trusted terminal scenario (ii). In the single qubit case, the minimum adversarial error probability is the same as in Wiesner’s original quantum verification scheme, namely $e=1/4$ Wiesner (1983); Molina et al. (2013). When dealing with the coherent states from Eq. (1), we use the existence of a squashing model for our threshold detector measurement setup, originally proven for coherent implementations of BB84 Beaudry et al. (2008). By imposing a condition on the terminal’s postprocessing, consisting of assigning a random measurement outcome to any double click, this model allows to express the infinite-dimensional measurement operators in a 3-dimensional space spanned by $\{\ket{0},\ket{1},\ket{\varnothing}\}$, which greatly simplifies the security analysis. Let $\Lambda$ be the optimal adversarial map which produces two copies (living in $\mathcal{H}_{1}\otimes\mathcal{H}_{2}$) of the original quantum credit card state $\rho_{\text{mint}}=\frac{1}{4}\sum_{k=0}^{3}\ket{\alpha_{k}}\bra{\alpha_{k}}$ (living in $\mathcal{H}_{\text{mint}}$). The state $\rho_{\text{mint}}$ may be expressed in a $4$-dimensional orthonormal basis corresponding to $\text{span}\{\ket{\alpha_{k}}\}$, as shown in Appendix B.1. The probability that a trusted terminal declares an incorrect measurement outcome for credit card $1$ (resp. $2$) is given by the trace of $\sum_{k=0}^{3}\left(\frac{1}{2}\ket{\beta_{k}^{\perp}}\bra{\beta_{k}^{\perp}}\otimes\mathbb{1}\right)\Lambda(\frac{1}{4}\ket{\alpha_{k}}\bra{\alpha_{k}})$, (resp. of $\sum_{k=0}^{3}\left(\mathbb{1}\otimes\frac{1}{2}\ket{\beta_{k}^{\perp}}\bra{\beta_{k}^{\perp}}\right)\Lambda(\frac{1}{4}\ket{\alpha_{k}}\bra{\alpha_{k}})$, where $\ket{\beta_{k}}$ is the squashed qubit associated with the original state $\ket{\alpha_{k}}$, i.e. $\ket{\beta_{0}}=\ket{+}$, $\ket{\beta_{1}}=\ket{+i}$, $\ket{\beta_{2}}=\ket{-}$, $\ket{\beta_{3}}=\ket{-i}$, and $\ket{\beta_{k}^{\perp}}$ is its orthogonal qubit state. The factor $1/4$ indicates that each $\ket{\alpha_{k}}$ is equally likely to occur, while $1/2$ accounts for the trusted terminal’s random measurement basis choice. Using Eq. (2), we may then rewrite these expressions as $\operatorname{Tr}\left(E_{1}(\mu)J(\Lambda)\right)$ and $\operatorname{Tr}\left(E_{2}(\mu)J(\Lambda)\right)$, where $E_{1}(\mu)$ and $E_{2}(\mu)$ are the error operators,

[TABLE]

and $\mu=|\alpha|^{2}$ is the average photon number in a pulse. Following a similar method, the probability that terminal 1 (resp. 2) registers a no-detection event on credit card $1$ (resp. $2$) reads $\operatorname{Tr}\left(L_{1}(\mu)J(\Lambda)\right)$ (resp. $\operatorname{Tr}\left(L_{2}(\mu)J(\Lambda)\right)$), where $L_{1}(\mu)$ and $L_{2}(\mu)$ are the loss operators, which contain the projection onto the state $\ket{\varnothing}$:

[TABLE]

We now search for the optimal cloning map $\Lambda$ that minimizes the losses that the adversary must introduce on both credit cards for a given error rate $e$. We cast this problem in the following SDP for a card with a single state,

[TABLE]

The first constraint imposes that $\Lambda$ is trace-preserving, the second imposes error $e$ when card $1$ is measured by terminal $1$, the third and fourth impose that the error and losses on card $1$ are at least equal to those on card $2$, and the fifth imposes that $\Lambda$ is completely positive. Solving (5) numerically provides the results in Fig. 1(a): it is impossible for an adversary to succeed with zero error ($e=0\%$) without introducing any excess losses ($f_{d}>f_{h}$) when $\mu<1.7$. The protocol may therefore be implemented securely in this range of $\mu$, since the excess losses will allow the bank to detect an attack. Secure regions of operation for other values of error $e$ are also displayed in Fig. 1(a).

In Appendix C, we extend problem (5) to $n$ states and provide numerical evidence that the optimal solution does not change in this case, namely the adversary cannot decrease $f_{d}$ by correlating the $n$ states.

II.3 C. Untrusted terminal

In the untrusted terminal scenario (iii), the adversary aims to provide two classical outcome strings from two different untrusted terminals which are both accepted by the bank. The minimum error in the qubit case yields $e=1/8$ Molina et al. (2013) (attained with the strategy provided in Appendix D). In the coherent state framework, we recast (5) with newly defined error and loss operators:

[TABLE]

and similarly for $E_{2}(\mu)$ and $L_{2}(\mu)$. We use braket notation to denote the correct classical answer $\ket{a_{ik}}$ to challenge $\ket{c_{i}}$, given state $\ket{\alpha_{k}}$. These vectors are all orthogonal to one another, and live in a 3-dimensional space spanned by classical answers $\{\ket{a_{0}},\ket{a_{1}},\ket{\varnothing}\}$, where the last vector corresponds to a classical no-detection flag. We label the orthogonal (wrong) answer as $\ket{a_{ik}^{\perp}}$. Figure 1(b) displays the optimal solutions as a function of $\mu$: an errorless protocol is impossible without increasing the fraction of declared no-detection flags with respect to the honest fraction $f_{h}$, although this increase is extremely small compared to the trusted terminal setting (see figure inset).

III III. Parameter analysis

The small adversarial losses and tight noise tolerance observed in Fig. 1(b) may be increased by replacing the pure states $\{\ket{\alpha_{k}}\}$ (given in Appendix B.1) with phase-randomized states $\rho_{k}$ (expressions given in Appendix B.2). Phase randomization is commonly used in quantum key distribution implementations to increase the security and obtain higher key rates Lo and Preskill (2005); Zhao et al. (2007); Yuan et al. (2014). Numerical solutions to (5) for such states are displayed in Figs. 1(c) and 1(d) for trusted and untrusted terminals respectively. We observe that the range of $\mu$ for which security can be shown in practice is considerably extended in this case.

It is also interesting to analyze our results in this phase-randomized setting for finite detection efficiency $\eta_{d}$. Figures 1(e) and 1(f) show that security may be achieved in the trusted terminal scenario using state-of-the-art single-photon detectors Hadfield (2009); Lita et al. (2008), depending also on the target error rate, while the untrusted scenario puts much more stringent constraints on the required devices.

We also remark that in Appendix E, we provide an alternative SDP to (5) which allows to derive $e$ given a fixed $\mu$ and detection efficiency $\eta_{d}$.

IV IV. Decohering quantum memory

In our security analysis, we have considered up till now fixed losses. However, in a quantum money implementation with a quantum memory used to store the credit card states, it will be necessary to take into account the time-dependent losses due to the decoherence of the memory. Here, the mint hands the stored quantum state to the client at time $t=0$. When $t>0$, the retrieval efficiency $\eta_{m}(t)$ decreases with time, thus increasing the losses to $e^{-\mu\eta_{d}\eta_{m}(t)}$. The initial retrieval efficiency $\eta_{m}(0)$ of the quantum memory limits the fraction of the $n$ states a dishonest client can retrieve to $\left(1-e^{-\mu\eta_{d}\eta_{m}(0)}\right)$. He may however have access to an ideal quantum memory to transfer the state at $t=0$, before $\eta_{m}(t)$ starts to decrease. This opens the door to powerful loss dependent attacks whose success increases as a function of time. As an illustration, we consider the cold atomic ensemble setup described in Vernaz-Gris et al. (2018), with losses that are dominated by the dephasing of the collective atomic magnetic excitation with a lifetime $\tau\approx 15\mskip 3.0mu\upmu\textrm{s}$ due to weak residual magnetic fields. The retrieval efficiency decreases as $\eta_{m}(t)\approx\eta_{m}(0)e^{-t^{2}/\tau^{2}}$, where $\eta_{m}(0)\approx 68\%$ for this setup. Using this expression, we solve (5) with phase-randomized states and derive secure credit card lifetimes of a few $\mskip 3.0mu\upmu\textrm{s}$, as shown in Fig. 2 for $\mu=0.50$ and $\mu=1.50$.

V Conclusion

By establishing an optimization framework in the coherent state setting, we have derived secure regions of operation for quantum credit card schemes in both trusted and untrusted terminal scenarios. With phase-randomized states, we have shown that the former case can be secure using a setup with detection efficiency $\eta_{d}>80\%$ and noise tolerance around $e=1-2\%$, while the latter case requires tighter parameters: $\eta_{d}>95\%$ and noise tolerance lower than $e=1\%$. Using the duality of semidefinite programs, we have provided numerical evidence that the adversary cannot increase his/her cheating probability by correlating the $n$ states in the credit card. In such a setting, the uncertainty on the tolerated number of incorrect outcomes $en$ and excess losses $f_{d}\>n$ scales as $\sqrt{n}$. We have finally provided a method to derive secure credit card lifetimes in the presence of a decohering quantum memory. This work encourages the future implementation of quantum credit card schemes with state-of-the-art quantum storage devices, as it provides a simple framework to derive practical security parameters in a semi-device-independent setting.

VI Acknowledgments

We thank Félix Hoffet and Julien Laurat for useful discussions about the modeling of the quantum memory, as well as Anthony Leverrier for his helpful comments on the manuscript. We acknowledge support from the European Union through the project ERC-2017-STG-758911 QUSCO, from the ANR through the project ANR-17-CE39-0005 quBIC, from BPI France through the project 143024 RISQ, and from Université Paris-Saclay through the Initiative de Recherche Interdisciplinaire.

Appendix A : Choi–Jamiołkowski operator and semidefinite programming.

A.1 : Choi’s theorem on completely positive maps

Let us consider a tensor product of two $d$-dimensional Hilbert spaces $\mathcal{H}=\mathcal{H}_{1}^{d}\otimes\mathcal{H}_{2}^{d}$, and then define the maximally entangled state $\ket{\Phi^{+}}\bra{\Phi^{+}}$ on $\mathcal{H}$ as

[TABLE]

We introduce a completely positive linear map $\Lambda:\mathcal{H}_{1}^{d}\rightarrow\mathcal{H}_{3}^{d^{\prime}}$, and define the Choi–Jamiołkowski operator $J(\Lambda):\mathcal{H}_{1}^{d}\otimes\mathcal{H}_{2}^{d}\rightarrow\mathcal{H}_{3}^{d^{\prime}}\otimes\mathcal{H}_{2}^{d}$ as the operator which applies $\Lambda$ to the first half of the maximally entangled state $\ket{\Phi^{+}}\bra{\Phi^{+}}$:

[TABLE]

Choi’s theorem then states that $\Lambda$ is completely positive if and only iff $J(\Lambda)$ is positive semidefinite. We also have that $\Lambda$ is a trace-preserving map if and only if $\operatorname{Tr}_{\mathcal{H}_{3}^{d^{\prime}}}(J(\Lambda))=\mathbb{1}_{\mathcal{H}_{2}^{d}}$ Molina et al. (2013); Watrous (2011); Vandenberghe and Boyd (1996). These properties are implemented as constraints in the optimization problem from (5).

A.2 : Proof of Equation (2)

For a completely positive trace-preserving linear map $\Lambda:\mathcal{H}_{1}^{d}\rightarrow\mathcal{H}_{3}^{d^{\prime}}$ and its associated Choi–Jamiołkowski operator $J(\Lambda)$, and $\ket{\psi_{1}}\in\mathcal{H}_{1}^{d}$, $\ket{\psi_{3}}\in\mathcal{H}_{3}^{d^{\prime}}$, we can write

[TABLE]

where we have defined the scalar $\psi_{1,ij}:=\braket{i}{\psi_{1}}\braket{\psi_{1}}{j}$.

Appendix B : Non phase-randomized and phase-randomized coherent state expressions.

B.1 : Non phase-randomized states

We may write the coherent states $\ket{\alpha_{k}}=\ket{i^{k}\frac{\alpha}{\sqrt{2}}}$ from $\mathcal{H}_{\text{mint}}$ in a four-dimensional orthonormal basis $\{\ket{\phi_{i}}\}$ as

[TABLE]

where

[TABLE]

B.2 : Phase-randomized states

We may express the four states in our protocol as:

[TABLE]

with global phase $\phi=0$ and relative phase $\theta\in\{0,\frac{\pi}{2},2\pi,\frac{3\pi}{2}\}$. This implies that an adversary must access $\theta$ to unveil the information encoded in the states. Phase randomization scrambles the global phase reference by allowing $\phi$ to take values from $[0,2\pi]$ uniformly at random instead of a single value. By considering the state $\ket{e^{i\phi}\alpha}$ and integrating over all possible values of $\phi$, the adversary sees a classical mixture of Fock states given by Lo and Preskill (2005):

[TABLE]

where $\mu=|\alpha|^{2}$ is the average photon number, and $\ket{n}$ are the photon number states. As the coherent superpositions of number states vanish, the security proof may simply proceed according to the result of quantum non demolition (QND) photon number measurements. If there is no photon in the state, then there is no information. If there is $1$ photon, then the qubit security proof may be applied. If there are more than $2$ photons in the pulse, perfect cheating is possible, since one photon can be sent to a terminal 1 and another to terminal 2. For our protocol, this allows us to express the phase randomized states $\rho_{k}$ in a $7$-dimensional orthonormal basis $\{\ket{v},\ket{q_{0}},\ket{q_{1}},\ket{m_{0}},\ket{m_{1}},\ket{m_{2}},\ket{m_{3}}\}$, where $\ket{v}$ is the vacuum state, $\ket{q_{0}}$ and $\ket{q_{1}}$ span a qubit space, and $\ket{m_{i}}$ constitute the four orthogonal outcomes which materialize the four perfectly distinguishable states in the multiphoton subspace. Our four phase-randomized coherent states may then be written as the following density matrices :

[TABLE]

where $\ket{+}$,$\ket{+i}$, $\ket{-}$, $\ket{-i}$ are the usual $\sigma_{x}$ and $\sigma_{y}$ eigenstates in the qubit space spanned by $\ket{q_{i}}$ and the Poisson distribution coefficients are given by

[TABLE]

Appendix C : Extension of SDP (5) to $n$ parallel repetitions.

Semidefinite programming presents a dual structure, which associates a dual maximization problem to each primal minimization problem Watrous (2011); Vandenberghe and Boyd (1996). The optimal value of the primal problem then upper bounds the optimal value of the dual problem, and the optimal value of the dual problem lower bounds that of the primal problem. This property is known as weak duality. We also note that a single problem may admit several feasible solutions, i.e., operators which satisfy all the constraints. The optimal solution is the feasible solution which optimizes the objective function (the quantity we aim to minimize or maximize). In our setting, SDP (5) may be labelled as the primal problem. The aim of this section is to extend SDP (5) to a credit card containing $n$ states, and to derive its corresponding dual problem. In order to show that the adversary does not gain any advantage in correlating the $n$ states to better succeed, we will first show that a tensor product of $n$ optimal solutions of (5) is a feasible solution to this new primal SDP. We then have to show that there also exists a feasible solution for the associated dual problem which yields the same optimal value as that of the primal. Such a feature is known as strong duality, and implies that these feasible solutions are both the optimal solutions to the primal and dual problem, respectively. We failed to prove this strong duality analytically, but as shown below, numerical evidence indicate it should hold.

To generalize the loss and error operators to the $n$ parallel repetition case, we introduce the projector $\mathcal{P}(n,j,\mathcal{C})$ which, given a collection $\mathcal{C}$ of $n$ quantum states living in Hilbert space $\mathcal{H}^{(n)}$, projects onto $j\leqslant n$ elements of $\mathcal{C}$ and the orthogonal subspace of the $(n-j)$ other elements. More formally, this operator is defined as

[TABLE]

where $\mathcal{C}_{i}$ is the $i$-th quantum state of $\mathcal{C}$ and $s_{i}(j)$ is the $i$-th element of a binary string $s(j)$ of length $n$ which contains $(n-j)$ zeros. The summation then runs over all $\binom{n}{j}$ possible $s(j)$ strings. Considering a new adversarial cloning map $\Lambda^{(n)}$ from the original $n$-state credit card living in $\mathcal{H}^{(n)}_{\text{mint}}$ to a duplicated credit card space $\mathcal{H}^{(n)}_{1}\otimes\mathcal{H}^{(n)}_{2}$, the new loss operators may then be written as:

[TABLE]

where $\mathcal{C}^{(\varnothing,n)}=\{\ket{\varnothing}\bra{\varnothing}\}^{n}$. The factors $\frac{j}{n}$ ensure that the total sum is normalized, as we are dealing with probabilities and not events. The new error operators read:

[TABLE]

where $\mathcal{C}^{(k_{1},\dots,k_{n})}=\{\frac{1}{2}\ket{\beta^{\perp}_{k_{1}}}\bra{\beta^{\perp}_{k_{1}}},\dots,\frac{1}{2}\ket{\beta^{\perp}_{k_{n}}}\bra{\beta^{\perp}_{k_{n}}}\}$. For a credit card containing $n$ states, problem (5) may then be recast as:

[TABLE]

To derive the dual problem associated with (7), we first note that we can replace all inequalities by equalities (except the last semidefinite positive constraint) without loss of generality. This is due to the fact that the adversary can always symmetrize the probabilities by increasing the error rate or losses on card 2 to make them equal to those on card 1. The right hand side elements of the constraints from (7) may then be gathered in a $(4^{2n}+3)$-dimensional column vector $\vec{b}^{(n)}$. The first three elements read $(e,e,0)$, and correspond to the value of $\operatorname{Tr}\left(E^{(n)}_{1}(\mu)J(\Lambda^{(n)})\right)$, $\operatorname{Tr}\left(E^{(n)}_{2}(\mu)J(\Lambda^{(n)})\right)$ and $\operatorname{Tr}\left(\left(L^{(n)}_{1}(\mu)-L^{(n)}_{2}(\mu)\right)J(\Lambda^{(n)})\right)$, respectively. The $4^{2n}$ other elements, corresponding to the first, trace-preserving constraint of (7), may be written as the vector representation of the identity over space $\mathcal{H}^{(n)}_{\text{mint}}$. The vector representation $vec(O)$ of an operator $O$ is obtained through the following isomorphism D’Ariano et al. (2017) :

[TABLE]

The dual problem then maximizes the overlap of variable $\vec{d}^{(n)}$ with constraint vector $\vec{b}^{(n)}$ as:

[TABLE]

where $D^{(n)}$ is a $4^{n}\times 4^{n}$ matrix containing the elements $d^{(n)}_{4}$ to $d^{(n)}_{4^{2n}+3}$ arranged in order left to right, top to bottom. The objective function reads $\vec{b}^{(n)T}\vec{d}^{(n)}=ed_{1}^{(n)}+ed_{2}^{(n)}+\operatorname{Tr}(D^{(n)})$. We note that a tensor product of optimal solutions $J(\Lambda^{(n)})=\bigotimes_{j=1}^{n}J(\Lambda)$ represents a feasible solution to primal problem (7), as it satisfies all the constraints. We label the associated primal objective function value as $s_{p}^{(n)}$, and remark that $s_{p}^{(n)}=s_{p}^{(1)}=f_{d}$ for all $n$. We then search for a feasible solution $\vec{d}^{(n)}$ to the dual problem (9) which allows to achieve $s_{p}^{(n)}=s_{d}^{(n)}$, where $s_{d}^{(n)}$ is the dual objective function value. While we were not able to find a generic analytical solution to this problem, we have always found a numerical solution $\vec{d}^{(n)}$ for a representative set of parameters $\mu$ and $e$ (specified in Table 2), satisfying

[TABLE]

and presenting a duality gap of order $10^{-9}$. Furthermore, adding the last condition as constraint to the SDP does not change the optimal value (within $10^{-4}$ error, due to the fact the the value of $s_{p}^{(n)}$ is a numerical primal optimal value which is rounded up when added as a constraint in the dual problem). The conditions on $d^{(n)}_{1},d^{(n)}_{2},d^{(n)}_{3}$ enforce the following expression of the dual constraint:

[TABLE]

Since the error and loss operators are all positive semidefinite, then it follows that the sum of the first four terms in (11) is a negative semidefinite operator. Numerically, it appears to be possible to satisfy (11) by choosing appropriately the diagonal elements of $D^{(n)}$, and we conjecture it is always possible.

In conclusion, we have found two feasible solutions such that $s_{p}^{(n)}=s_{d}^{(n)}$, and strong duality holds for problems (7) and (9), at least up to numerical precision. The optimal solution to the primal problem for $n$ states can therefore be written as a tensor product of optimal solutions to the primal problem for $n=1$ state. This implies that the adversary does not gain any advantage in correlating the states in the card when performing an attack against a trusted terminal without phase randomization. A similar approach works to prove strong duality for the untrusted terminal case, and we conjecture that this method also works for both scenarios with phase-randomized states.

Appendix D : Optimal adversarial strategy with qubits in an untrusted terminal scenario.

A simple strategy corresponding to the error rate $e=1/8$ for a state encoded in the basis $b$ is :

$c_{i}=c_{j}$

Adopt the honest strategy and duplicate the classical outcome.

Success probability: $1$

$c_{i}\neq c_{j}$

Pick a basis $b$ (or $\overline{b}$) at random, measure the state in this basis, and send the classical outcome to answer challenge $c_{b}$ (or $c_{\overline{b}}$). Send a random measurement outcome to the other challenge $c_{\overline{b}}$ (or $c_{b}$). If the correct basis $b$ was picked, then the adversary succeeds with probability $1$. If the wrong basis $\overline{b}$ was picked, then the success probability is $\frac{1}{2}$.

Success probability : $\frac{1}{2}\times 1+\frac{1}{2}\times\frac{1}{2}$ = $\frac{3}{4}$.

Since the bank will ask each of these challenge combinations with probability $\frac{1}{2}$, then we have a total success probability $\frac{7}{8}$, which yields $e=\frac{1}{8}$.

Appendix E : Optimal error rate

If one wishes to minimize the error rate given a fixed honest loss rate, then one may cast the following SDP, which has a similar structure to (5) :

[TABLE]

The first constraint imposes that $\Lambda$ is trace-preserving, the second imposes that the error on card $1$ is greater or equal to that on card $2$, the third and fourth impose that the losses on each card are smaller or equal to the honest expected losses $f_{h}$, and the fifth imposes that $\Lambda$ is completely positive. Tables 3 give optimal numerical solutions to (12) for different scenarios, varying the phase-randomization, detection efficiencies, terminal trust, losses and average photon number $\mu$.