Continuous-variable quantum digital signatures over insecure channels

TL;DR

This paper introduces a continuous-variable quantum digital signature scheme that remains secure even with eavesdroppers, enabling practical implementation alongside existing quantum key distribution systems.

Contribution

The paper presents the first CV QDS scheme secure against eavesdroppers, using phase measurement of coherent states, with shorter signatures than previous protocols.

Findings

Secure against collective beamsplitter and entangling-cloner attacks

Allows eavesdropper presence with shorter signatures

Compatible with existing CV QKD platforms

Abstract

Digital signatures ensure the integrity of a classical message and the authenticity of its sender. Despite their far-reaching use in modern communication, currently used signature schemes rely on computational assumptions and will be rendered insecure by a quantum computer. We present a quantum digital signatures (QDS) scheme whose security is instead based on the impossibility of perfectly and deterministically distinguishing between quantum states. Our continuous-variable (CV) scheme relies on phase measurement of a distributed alphabet of coherent states, and allows for secure message authentication against a quantum adversary performing collective beamsplitter and entangling-cloner attacks. Crucially, for the first time in the CV setting we allow for an eavesdropper on the quantum channels and yet retain shorter signature lengths than previous protocols with no eavesdropper. This opens up the possibility to implement CV QDS alongside existing CV quantum key distribution (QKD) platforms with minimal modification.

Equations

$$p_{err}=\frac{1}{2}\text{erfc}\left(\sqrt{\frac{T}{2}}\alpha \right).$$

$${\epsilon }_{rob}\le 2\exp \left(-{\left(s_{\left(B,C\right)}-p_{err}\right)}^{2}L\right)$$

$${\epsilon }_{rep}\le 2\exp \left(-{\left(s_C-s_B\right)}^2\frac{L}{4}\right)$$

$${\epsilon }_{forg}\le 2\exp \left(-{\left(p_e-s_C\right)}^{2}L\right)$$

$$H\left(E_j,x_1^j,x_2^j|y_j\right)=H\left(E_j|x_1^j,x_2^j,y_j\right)+H\left(x_1^j,x_2^j|y_j\right).$$

$$H\left(E_j,x_1^j,x_2^j|y_j\right)=H\left(x_1^j,x_2^j|y_j\right).$$

$$H\left(E_j,x_1^j,x_2^j|y_j\right)$$

$$\le H\left(x_1^j,x_2^j|E_j,y_j\right)+H\left(E_j\right)$$

$$H\left(x_1^j,x_2^j|y_j\right)$$

$$=\left(1-p_e\right)H\left(x_1^j,x_2^j|E=0,y_j\right)$$

$$+p_{e}H\left(x_1^j,x_2^j|E_j=1,y_j\right)+H\left(E_j\right).$$

$$H\left(x_1^j,x_2^j|y_j\right)\le 2+H\left(E_j\right)=2+h\left(p_e\right).$$

$$H\left(x_1^j,x_2^j|y_j\right)$$

$$\ge 3-\chi \left(x_1^j,x_2^j:y_j\right)$$

$$h\left(p_e\right)\ge 1-\chi \left(x_1^j,x_2^j:y_j\right)$$

$$\chi \left(x_1^j,x_2^j:y_j\right)=S\left({\rho }_B^j\right)-\sum _{x_1^j,x_2^j}p\left(x_1^j,x_2^j\right)S\left({\rho }_B^{x_1^j,x_2^j}\right)$$

$${\rho }_A^j=\frac{1}{4}\sum _{k=1}^4|{\alpha }_k⟩⟨{\alpha }_k|$$

$${\rho }_{BC}^j=$$

$$\frac{1}{4}\sum _{k=1}^4|\sqrt{T}{\alpha }_k{⟩}_C⟨\sqrt{T}{\alpha }_k|\otimes |\sqrt{1-T}{\alpha }_k{⟩}_B⟨\sqrt{1-T}{\alpha }_k|.$$

$${\rho }_B^j=\frac{1}{4}\sum _{k=1}^4|\sqrt{1-T}{\alpha }_k{⟩}_B⟨\sqrt{1-T}{\alpha }_k|$$

$${\rho }_{B|c}^j$$

$$=\frac{1}{4}\sum _{k=1}^4⟨c|\sqrt{T}{\alpha }_k⟩⟨\sqrt{T}{\alpha }_k|c⟩|\sqrt{1-T}{\alpha }_k{⟩}_B⟨\sqrt{1-T}{\alpha }_k|$$

$$=\frac{1}{4}\sum _{k=1}^{4}p\left(c|{\alpha }_k\right)|\sqrt{1-T}{\alpha }_k{⟩}_B⟨\sqrt{1-T}{\alpha }_k|$$

$${\rho }_B^{x_1^j,x_2^j}=\int {\rho }_{B|c}^j{\mathrm{d}}^{2}c$$

$$|\Psi {⟩}_{B_1^{\prime }{B}_{2}C}^j=$$

$$\sum _{m=0}^{\infty }\frac{G_m}{\sqrt{m!}}{\left(\sqrt{T}{\hat{a}}_{B_1^{\prime }}^{†}-\sqrt{1-T}{\hat{a}}_C^{†}\right)}^m$$

$$|0{⟩}_{B_1^{\prime }}|m{⟩}_{B_2}|0{⟩}_C$$

$$p\left(c|{\alpha }_k\right)\left(\bar{n}\right)=\frac{\exp \left(-\frac{|c-\sqrt{T}{\alpha }_k{|}^2}{1+\left(1-T\right)\bar{n}}\right)}{\pi \left(1+\left(1-T\right)\bar{n}\right)}$$

$${\epsilon }_{fail}={\epsilon }_{rob}={\epsilon }_{rep}={\epsilon }_{forg}.$$

$${\epsilon }_{fail}\le 2\exp \left(-{\left(p_e-p_{err}\right)}^2\frac{L}{16}\right)$$

$$P\left(\bar{X}-\mathbb{E}\left(\bar{X}\right)\ge \epsilon \right)$$

$$P\left(\mathbb{E}\left(\bar{X}\right)-\bar{X}\ge \epsilon \right)$$

$$E_j=\{\begin{array}{ll}1& \text{if Fj is eliminated in Gj}\\ 0& \text{otherwise}\end{array}$$

$$P\left(\bar{E}\le s\right)$$

$$\le \exp \left(-2{\left(\mathbb{E}\left(\bar{E}\right)-s\right)}^{2}n\right)$$

$$P\left(s\le \bar{E}\right)\le \exp \left(-2{\left(s-\mathbb{E}\left(\bar{E}\right)\right)}^{2}n\right).$$

Full text

I Introduction

Digital signatures are among the most commonly used primitives in modern cryptography Diffie and Hellman (1976); Schneier (1996). Like a handwritten signature, a digital signature ensures the authenticity of both a classical message and its sender. Inherently involving multiple parties, the signature prevents a malevolent party from creating a false message and attributing it to an honest party; and if the signature convinces one party that a message is genuine then it should convince the other parties. Despite their far-reaching use in our modern technological infrastructure–e.g. in e-commerce, online banking and checking the integrity of downloads–currently used signature schemes such as RSA, DSA and ECDSA will be rendered insecure by a future quantum computer Shor (1997); Amiri and Andersson (2015); Nielsen and Chuang (2010); Schneier (1996).

Quantum digital signatures (QDS) rectify this by basing their security not on computational assumptions about difficult to invert “one-way functions”, but on physical properties, namely, the impossibility to perfectly and deterministically distinguish between non-orthogonal quantum states Gottesman and Chuang (2001); Amiri and Andersson (2015); Nielsen and Chuang (2010); Wallden et al. (2015); Donaldson et al. (2016); Dunjko et al. (2014); Collins et al. (2014); Croal et al. (2016); Andersson et al. (2006); Amiri et al. (2016); Collins et al. (2016); Puthoor et al. (2016); Yin et al. (2016). Quantum states are used to distribute a classical signature which is later used to sign a classical message. While modern QDS shares some similarities in implementation with quantum key distribution (QKD), their aims differ significantly. The most notable difference is that that–unlike QKD–in QDS any subset of the participants may be dishonest, and each dishonest player may have different goals and strategies which must be considered in a full proof.

Although the first QDS schemes Gottesman and Chuang (2001) relied on infeasible requirements like the production and storage of large entangled states, there has since been a push towards practical and implementable QDS. The past decade has done away with the need for an optical multiport Wallden et al. (2015); Donaldson et al. (2016), quantum memory Dunjko et al. (2014); Collins et al. (2014), and recent progress has even removed the need for single photon sources Croal et al. (2016); Andersson et al. (2006); Amiri et al. (2016); Collins et al. (2016) for secure QDS. More recently the assumption of secure quantum channels for distribution of quantum states has been discarded, and modern QDS protocols take into account both the ability for a player inside the scheme to be dishonest, and the presence of an external eavesdropper Amiri et al. (2016); Puthoor et al. (2016); Yin et al. (2016).

As with QKD, there are two approaches to QDS, the discrete-variable (DV) and continuous-variable (CV) protocols. DV QDS relies on photon-number detection of either weak coherent pulses Amiri et al. (2016); Collins et al. (2016, 2017); Roberts et al. (2017); Zhang et al. (2018) or single photons Yin et al. (2016, 2017a). The relatively low dimensional Hilbert space required for these schemes allows for an advanced level of security analysis, and their high resilience to loss allows for long distances to be bridged securely, with $O\left(10^{-1}\right)$ seconds required to sign a 1-bit message Collins et al. (2017, 2018); Yin et al. (2017b). The first QDS scheme over insecure channels required a signature length of $7.7\times 10^{5}$ to sign a $1$ bit message, in a scheme similar to decoy-state QKD Amiri et al. (2016).

In contrast, CV QDS encodes information into continuous degrees of freedom, usually the phase of the electromagnetic field, and homodyne detection Croal et al. (2016)–though a “hybrid” scheme has been proposed Andersson et al. (2006) and implemented Clarke et al. (2012), relying on both phase-encoded coherent states and single-photon detection. Despite the theoretical difficulties in dealing with large Hilbert spaces in a cryptographic setting the CV platform is much easier to implement, operates at room temperature and can use standard telecom hardware, making it thus closer to currently implemented large-scale infrastructure Weedbrook et al. (2012); Papanastasiou et al. (2018).

In the present paper we introduce a new CV QDS protocol based on a discrete-modulated alphabet of coherent states, and the heterodyne detection of phase. Such cheap and readily available resources make our scheme highly compatible with telecom infrastructure. Crucially, and in contrast to our previous paper Croal et al. (2016), we now take into account the fact that the quantum distribution channels may in general be insecure and under the control of a malevolent party. Thus, we guard not only against dishonest participants inside the protocol but also against an external eavesdropper.

Our scheme is the first fully CV QDS scheme to run over insecure quantum channels. Remarkably, despite relaxing an assumption on the quantum channels we are able to reduce the number of quantum states required to securely sign a message. We provide a conceptually new security proof and demonstrate that the success probability of an eavesdropper can be made arbitrarily small. Our security proof provides collective security against both beamsplitter attacks and entangling-cloner attacks, with the main feature of the proof being that a dishonest player may fail to correctly identify an element of the signature and yet still remain undetected to the honest parties.

The paper is structured as follows. In section II we describe our protocol and briefly discuss the origin of its security. Our security proof follows in section III, and in section IV we analyse the protocol’s performance. Finally, in section V we compare our protocol to its nearest competitors and discuss potential extensions to our security analysis. Technical details and a generalisation of the protocol may be found in the appendices.

II Protocol description

In the simplest instance we consider a signature scheme involving three parties: a sender, Alice ($A$), and recipients, Bob ($B$) and Charlie ($C$). Alice wishes to send a classical $1$ bit message $m$ to Bob, which he will forward to Charlie. This scheme may be readily extended to include more players Arrazola et al. (2016) or longer messages Wang et al. (2015, 2017).

In a successful QDS scheme, Bob and Charlie should be able to determine that Alice is the genuine author of $m$. In particular, the scheme should guard against a dishonest player–or an external Eve–from successfully forging a message which is then accepted as genuine. It should also prevent Alice from repudiating, which occurs if Alice convinces Bob that a message is genuine and Charlie that it is fake. The scheme should succeed if all parties are honest, except with negligible probability. We allow at most one of the players to be dishonest, noting that a three-party protocol fails trivially if more dishonest players are permitted.

We focus on the quadrature phase-shift keying (QPSK) alphabet of $4$ phase-encoded coherent states, denoted $\mathcal{A}_{4}$ Papanastasiou et al. (2018); Weedbrook et al. (2012); Leverrier and Grangier (2011) distributed equally around the axis in phase space (Fig. 1, inset). In Appendix B we demonstrate how larger alphabets $\mathcal{A}_{N}$ may be incorporated into our proof and analysis.

The QDS scheme is split into two stages, Distribution and Messaging, which can occur with significant time delay. The coherent states are sent by Alice and measured by Bob and Charlie during Distribution, while during Messaging Alice will send the message $m$ to Bob, accompanied by a classical signature. This signature is her classical declaration of which quantum states she sent. By comparing her declaration to their measurement outcomes, Bob and Charlie can determine whether $m$ is genuine. Our protocol is outlined in Fig. 1 and described in full, below.

II.1 Distribution stage: $1-4$

$1.$ Alice wishes to send a signed $1$ bit message $m$ to Bob and Charlie. For each possible $m$, Alice creates two different classical strings, one for Bob and one for Charlie, $\Phi_{m}^{\left(B,C\right)}=\{\phi_{j}^{\left(B,C\right)}\}_{j=1}^{L}$ where the $\phi_{j}$ are phases chosen uniformly at random from our alphabet $\mathcal{A}_{4}=\{1,i,-1,-i\}$. The signature length $L$ is an integer suitably chosen to ensure security.

$2.$ For each element $\phi_{j}^{\left(B,C\right)}$ Alice forms the corresponding coherent state $|\alpha\phi_{j}^{\left(B,C\right)}\rangle$ and sends it to $B,C$, Fig. 1. The amplitude $\alpha$ is chosen to optimise security. By analogy with classical digital signatures, we may think of the $\Phi_{m}^{\left(B,C\right)}$ as Alice’s private keys, and the corresponding sequences of quantum states as her public keys. In contrast to our previous QDS protocol we take $\Phi_{m}^{B}\neq\Phi_{m}^{C}$ Croal et al. (2016); Amiri et al. (2016). Since coherent states are non-orthogonal an eavesdropper on the quantum channel cannot gain full information about Alice’s signatures.

$3.$ Bob and Charlie measure the phases of the received states by heterodyne detection Weedbrook et al. (2012), and keep a record of the alphabet states which are most incompatible with their measurements, Fig. 2. For example, if Bob measures $b\in\mathbb{C}$ with $\text{Re}\left(b\right)>0$ and $\text{Im}\left(b\right)>0$ then he will “eliminate” states $|-\alpha\rangle$ and $|-i\alpha\rangle$ since these are the least likely of Alice’s sent states to generate this outcome. Recipients Bob and Charlie each now possess an “eliminated signature” Wallden et al. (2015); Croal et al. (2016); Donaldson et al. (2016) of length $L$ containing a record of which states were eliminated at each position in the sequence. Since measurements are performed immediately on receipt of the states, no quantum memory is required Wallden et al. (2015).

$4.$ Symmetrization: Bob and Charlie swap a random $L/2$ elements of their eliminated signatures over their encrypted classical channel, keeping the positions and values of the swapped elements secret from Alice. Signature elements which are forwarded by a recipient will no longer be used by them in the protocol. This swapping will provide security against repudiation. Bob and Charlie each now possess an eliminated signature in two halves, those elements received directly from Alice and those received during this Symmetrization step.

II.2 Messaging stage: $5-7$

$5.$ Messaging can occur at any time after Distribution. To sign $m$, Alice sends to Bob the classical triplet $\Sigma=\left(m,\Phi_{m}^{B},\Phi_{m}^{C}\right)$, consisting of the message $m$ and classical information $\Phi_{m}^{B,C}$ about the correponding sent quantum states.

$6.$ Bob compares elements of $\Phi_{m}^{\left(B,C\right)}$ with the corresponding elements of his eliminated signatures, and counts the number of mismatches. A mismatch occurs if Bob has eliminated a state which Alice claims to have sent. Note that even when all parties are honest there will still be some probability of mismatch as the alphabet states are not orthogonal, so if Alice sent $|\alpha\rangle$, Bob or Charlie can still measure $\text{Re}\left(x\right)<0$. If there are fewer than $s_{B}L/2$ mismatches, for threshold $s_{B}$, between each half of his eliminated signature and Alice’s declaration, then Bob accepts $m$ as genuine. Otherwise he rejects it and the protocol aborts.

$7.$ Bob forwards $\Sigma$ to Charlie, who similarly checks for mismatches. Charlie accepts the message if there are fewer than $s_{C}L/2$ mismatches between elements of $\Sigma$ and each half of his eliminated signature. If Charlie also accepts $m$ then the protocol has succeeded, otherwise it aborts. The crucial parameters in steps $6$ and $7$ are the $s_{\left(B,C\right)}$, which can be chosen to optimize security.

III Security proof and attack analysis

In order to be secure, a QDS protocol must abort when a forging or repudiation attack is attempted. From steps $6$ and $7$ in the protocol, the protocol aborts if the number of mismatches observed by Bob or Charlie is above $s_{B}L/2$ or $s_{C}L/2$, respectively. We now demonstrate that a forgery or repudiaton attack will induce such a large number of mismatches, so the attacks are therefore detectable. We also show that in the absence of an attack the protocol succeeds, that is, it is robust. The protocol fails if it allows a forging or repudiation attack, or if it aborts even when all parties are honest. The proofs of robustness and security against repudiation from Croal et al. (2016) can be directly applied to our new protocol. For completeness we reproduce the key results in Eqs. (2), (3) below, and full proofs may be found in Croal et al. (2016). Importantly, the security against forgery requires a completely new analysis and this will be one of the main results presented in the paper.

III.1 Robustness

A QDS protocol is called robust if it succeeds when all parties are honest, except with a negligible probability $\varepsilon_{rob}$. Since the alphabet $\mathcal{A}_{4}$ of distributed states is highly non-orthogonal, even when all parties are honest there is still a probability $p_{err}$ that a recipient eliminates the state which Alice sent. However, $p_{err}$ is predictable and can be estimated during the protocol. For a pure loss channel with transmission $T$, the rate $p_{err}$ corresponds to the probability of a heterodyne measurement outcome $\text{Re}\left(x\right)<0$ when Alice sent the coherent state $|\alpha\rangle$ with $\alpha\in\mathbb{R}\geq 0$

[TABLE]

With mismatch rate $p_{err}$, we may use Hoeffding’s inequalities, Appendix A, to bound the probability that Bob or Charlie detect more than $s_{\left(B,C\right)}L/2$ mismatches as

[TABLE]

provided that $s_{\left(B,C\right)}>p_{err}$. Eq. (2) is derived in Croal et al. (2016) using Eq. (24). The probability $\varepsilon_{rob}$ of the protocol aborting even when all parties are honest can thus be made arbitrarily small by choice of $L$.

III.2 Security against repudiation

Alice succeeds in a repudiation attack if she convinces Bob that a message is genuine and Charlie that it is fake. During Messaging, Alice will declare $\tilde{\Phi}_{m}^{B}$ and $\tilde{\Phi}_{m}^{C}$ chosen with the aim that there should be fewer than $s_{B}L/2$ mismatches with each half of Bob’s signature, but more than $s_{C}L/2$ mismatches with at least one of Charlie’s halves.

Intuitively, security against repudiation arises from Symmetrization (step $4$ of the protocol). Since the swapping occured in secret from Alice, she does not know who holds a particular eliminated signature element. Alice is therefore unlikely to succeed in creating a declaration which will pass Bob’s test but fail Charlie’s.

The probability of successful repudiation is

[TABLE]

provided that $s_{C}>s_{B}$. Eq. (3) is derived fully in Croal et al. (2016) using Eqs. A.2, 24. The probability $\varepsilon_{rep}$ of successful repudiation can thus be made arbitrarily small by choice of $L$.

III.3 Security against forgery

It is the forging attack in which our analysis significantly differs from Croal et al. (2016). In a successful forging attack, a dishonest player will declare some fake $m^{\prime}$ with the aim that it is accepted as genuinely having originated with Alice. The message $m^{\prime}$ must have an appended signature $\Phi_{m}^{\prime C}$, and so a forger’s goal is to determine a fake signature which will be accepted. Since Bob already knows half of Charlie’s eliminated signature elements–those which Bob himself forwarded–and since it is easier to convince Charlie than Bob to accept a fake signature ($s_{C}>s_{B}$), the most dangerous forger is a dishonest Bob. A bound for the probability that Bob succeeds in a forging attack provides an automatic upper bound against any other forging player.

Since the empahsis of earlier papers Gottesman and Chuang (2001); Wallden et al. (2015); Dunjko et al. (2014); Collins et al. (2014); Donaldson et al. (2016); Croal et al. (2016) was on internal dishonesty between participants, eavesdropping on the quantum channels was not permitted. A dishonest Bob had only his states received from Alice with which to gain information about Charlie’s outcomes. However, Alice distributed identical signatures $\Phi_{m}^{B}=\Phi_{m}^{C}$ to Bob and to Charlie, so in-effect Bob had a perfect copy of Charlie’s signature. Now, to mitigate against an eavesdropping Bob, we choose $\Phi_{m}^{B}\neq\Phi_{m}^{C}$, so that even though dishonest Bob can gain some additional information on Charlie’s quantum states, Bob now has a less perfect copy of Charlie’s states than he did previously Amiri et al. (2016).

Dishonest Bob will eavesdrop on the quantum states as Alice is distributing them to Charlie, and will try to determine what he can declare in $\Phi_{m}^{\prime C}$ to not cause a mismatch. Defining $p_{e}$ as the probability that Bob will induce a mismatch on a given signature element, and $s_{C}$ as Charlie’s mismatch threshold, the probability $\varepsilon_{forg}$ of a successful forging attack is

[TABLE]

which is derived via Eq. (A.2) by analogy with Croal et al. (2016). Since $s_{C}\leq p_{e}$ can be freely chosen, we must now calculate a lower bound on the probability $p_{e}$.

III.4 Calculating $p_{e}$

Our main contribution is a conceptually new bound for $p_{e}$, which fully takes into account the ambiguity in Bob’s declaration. This ambiguity stems from the following. Because Charlie eliminates two states, Fig. 2, there are two possible states from $\mathcal{A}_{4}$ which Bob can declare without introducing a mismatch. Therefore, the probability that Bob misidentifies an element of the eliminated signature is not equivalent to the probability of mismatch. We allow for this discrepancy by working directly in terms of mismatch probability $p_{e}$ via an error variable $E$, and in the proof we highlight quantities which are affected by the degeneracy in Bob’s possible declaration. In what follows we explicitly consider the QPSK alphabet $\mathcal{A}_{4}$. Our security proof readily generalises to larger alphabets $\mathcal{A}_{N}$ with $N=6,8,10,\dots$, and the required modifications to the proof are discussed in Appendix B.

Let $X_{j},1\leq j\leq L/2$ be an element of the half of $C$’s eliminated signature which he received directly from Alice, and on which Bob will attempt to gain some information. We write $X_{j}=\{x_{1}^{j},x_{2}^{j}\}$ where $x_{1}^{j}$ and $x_{2}^{j}$ describe the states from $\mathcal{A}_{4}$ which Charlie eliminated. The $x_{1}^{j}$ and $x_{2}^{j}$ must be adjacent in $\mathcal{A}_{4}$, e.g. if $x_{1}^{j}=1$ then $x_{2}^{j}=\pm i$. Let the string $Y=\{y_{j}\}_{j}$ be Bob’s declaration, subject to an unspecified but optimal POVM and classical strategy.

A mismatch occurs when $y_{j}=x_{1}^{j}$ or $y_{j}=x_{2}^{j}$. To analyse the probability that this occurs we define a variable $E_{j}$, which takes value $1$ if a mismatch occurs at position $j$ and [math] otherwise. Then Bob’s average mismatch rate $p_{e}=P\left(E_{j}=1\right)$. Because $E_{j}$ can take one of two values, the Shannon entropy $H\left(E_{j}\right)$ is equal to the binary entropy $h\left(p_{e}\right)=-p_{e}\log p_{e}-\left(1-p_{e}\right)\log\left(1-p_{e}\right)$.

Consider the conditional entropy $H\left(E_{j},x_{1}^{j},x_{2}^{j}|y_{j}\right)$, which is related to the uncertainty about whether a mismatch has occured under Bob’s declaration $y_{j}$. Using the chain rule for conditional entropies Nielsen and Chuang (2010) we write

[TABLE]

Since a choice of $y_{j},x_{1}^{j}$ and $x_{2}^{j}$ uniquely determines $E_{j}$, the first term on the right hand side of Eq. (5) must equal [math], so we have

[TABLE]

Using the chain rule for conditional entropies once more on the left hand side of Eq. (5),

[TABLE]

where we can write the upper bound because conditioning cannot increase entropy.

Combining Eqs. (6), (III.4),

[TABLE]

Now because of the ambiguity in Bob’s declaration, i.e. because there are two eliminated signature elements consistent with a given $E_{j}=0$ and $y_{j}$, and since we can permute and relabel $x_{1}^{j}\leftrightarrow x_{2}^{j}$, we have $H\left(x_{1}^{j},x_{2}^{j}|E_{j}=0,y_{j}\right)\leq\log_{2}4=2$. We also use the fact that Charlie eliminates exactly half of the alphabet in order to write $H\left(x_{1}^{j},x_{2}^{j}|E_{j}=0,y_{j}\right)=H\left(x_{1}^{j},x_{2}^{j}|E_{j}=1,y_{j}\right)$. Therefore

[TABLE]

From the definition of mutual information Nielsen and Chuang (2010), we have

[TABLE]

where we have used that the Holevo information $\chi$ maximizes the mutual information $I$ over all POVMs, and that $H\left(x_{1}^{j},x_{2}^{j}\right)=\log_{2}8=3$ because of the four possible eliminated signature elements, and an additional factor of $2$ due to relabeling.

Combining Eqs. (9), (III.4) we arrive at

[TABLE]

which is one of the main results of the paper. This inequality can be implicitly solved for Bob’s mismatch rate $p_{e}$, and provides security against collective attacks provided that Bob’s Holevo information $\chi$ can be estimated.

III.5 Attack analysis

Eqs. (4), (11) determine the required signature length to provide security of our scheme in any situation where $\chi$ can be bounded. In order to gain some insight into the behaviour of our protocol, in what follows we restrict Bob to two classes of attack, the beamsplitter attack and the entangling-cloner attack, which correspond to a pure-loss ($\xi=0\%$) and thermal-loss ($\xi\neq 0\%$) channel, respectively. In an implementation it is the measured excess noise $\xi$ at the receiver which will determine the attack class that Bob is assumed to have performed Papanastasiou et al. (2018). In section V we remark about the optimality of these attacks.

By definition Bob’s Holevo information is Nielsen and Chuang (2010)

[TABLE]

with $S\left(.\right)$ the Von Neumann entropy, $\rho_{B}^{j}$ Bob’s total a priori mixed state at position $j$, and $\rho_{B}^{x_{1}^{j},x_{2}^{j}}$ Bob’s state conditioned on Charlie’s $j^{\text{th}}$ eliminated signature element $X_{j}$ being $\{x_{1}^{j},x_{2}^{j}\}$.

III.5.1 Beamsplitter attack

We first consider the so-called beamsplitter attack, Fig. 3, in which a purely lossy channel is modelled using a beamsplitter with transmission $T$ and vacuum input at the fourth port, and in which Bob collects his state $\rho_{B}^{j}$ from the reflected output port.

Letting $|\alpha_{k}\rangle\langle\alpha_{k}|$ with $k=1,2,3,4$ be an element of $\mathcal{A}_{4}$, Alice’s average input state may be written as

[TABLE]

which is transformed by the beamsplitter with vacuum input to become

[TABLE]

Then Bob’s a priori state $\rho_{B}^{j}$ is given by

[TABLE]

from which the first term in Eq. (12) can be calculated.

Charlie performs heterodyne measurement on his half of $\rho_{BC}^{j}$ and receives outcome $c_{j}\in\mathbb{C}$. The state $\rho_{BC}^{j}$ is transformed as

[TABLE]

where $p\left(c|\alpha_{k}\right)=1/\pi\exp\left(-|c-\sqrt{T}\alpha_{k}|^{2}\right)$ is the probablity of Charlie measuring $c$ when the state $|\sqrt{T}\alpha_{k}\rangle$ is received, and $|c\rangle$ is a coherent state centered on $c\in\mathbb{C}$.

On average, each eliminated signature element $X_{j}=\{x_{1}^{j},x_{2}^{j}\}$ is equally likely, so for Eq. (12) it will suffice to calculate $S\left(\rho_{B}^{x_{1}^{j},x_{2}^{j}}\right)$ for just one. An element $X_{j}$ is uniquely determined by the quadrant in which the outcome $c$ lies, Fig. 4. Using Eq. (III.5.1) we may write

[TABLE]

where the integration is perfomed over an entire quadrant in phase space. The states $\rho_{B}^{j}$ and $\rho_{B}^{x_{1}^{j},x_{2}^{j}}$ from Eqs. (15), (17) can be inserted into Eq. (12) and the mismatch rate $p_{e}$ can now be calculated.

III.5.2 Entangling cloner attack

The thermal loss channel exhibits both loss and excess noise and can be modelled by a beamsplitter with a thermal state $\rho_{th}\left(\bar{n}\right)$ input into the fourth port, where $\bar{n}$ is the average number of photons in the thermal state. However, the presence of this thermal noise will allow an eavesdropping Bob to hide a more general attack, known as an entangling cloner attack Grosshans et al. (2003); Weedbrook et al. (2012). In this attack, Bob starts with an entangled two-mode squeezed vacuum (TMSV) state, and one of the two entangled modes is injected into the fourth port of the beamsplitter, Fig. 5. Once again he collects the reflected output, and performs an optimal collective measurement on his two modes. Since the TMSV state purifies the thermal state Weedbrook et al. (2012), this attack manifests itself just as thermal noise in the channel.

After the beamsplitter, Bob holds a two-mode state which is entangled with Charlie’s. The full state is

[TABLE]

where $G_{m}=\left(\tanh r\right)^{m}/\cosh r$; $\bar{n}=\sinh^{2}r$ is the average number of thermal photons in one mode of the input TMSV state; and $\hat{D}\left(\alpha\right)=\exp\left(\alpha\hat{a}^{\dagger}-\alpha^{*}\hat{a}\right)$ is the displacement operator. After performing heterodyne measurement on mode $C$ and receiving outcome $c\in\mathbb{C}$, the state $\rho_{B|c}^{j}\left(\bar{n}\right)=\langle c|\Psi\rangle\langle\Psi|c\rangle$ can be used to calculate the Holevo information as before via Eqs. (12), (17). The states $|\Psi\rangle_{B_{1}^{\prime}B_{2}C}$ and $\rho_{B|c}^{j}\left(\bar{n}\right)$ are derived in Appendix C.

Finally, we note that Charlie’s probability of measuring $c\in\mathbb{C}$ when Alice sends state $|\alpha_{k}\rangle$ through the channel with transmission $T$ and thermal noise input $\rho_{th}\left(\bar{n}\right)$ is Papanastasiou et al. (2018)

[TABLE]

and so the excess noise measured at Charlie is $\xi=\left(1-T\right)\bar{n}/2$. From Eq. (19) we can calculate $p_{err}\left(\xi\right)$ as the probability $P\left(\text{Re}\left(c\right)<0|\alpha\right)\left(\bar{n}\right)$ that Charlie’s heterodyne output eliminates the sent state, analogously with Eq. (1).

III.6 Signature length $L$

Now that we have calculated $p_{e}$ and $p_{err}$ for both beamsplitter and entangling-cloner attacks, the probability $\varepsilon_{fail}$ that the protocol fails can be found by calculating via Eqs. (2), (3), (4) the probability that the protocol is not robust $\varepsilon_{rob}$; the probability of successful repudiation $\varepsilon_{rep}$; and the probability of successful forgery $\varepsilon_{forg}$б. For a figure of merit, we assume that the protocol can fail in any of these ways with equal probability and set

[TABLE]

By choosing $s_{B}=p_{err}+\left(p_{e}+p_{err}\right)/4$ and $s_{C}=p_{err}+3\left(p_{e}-p_{err}\right)/4$ we satisfy the second two equalities, and so the overall probability of failure becomes

[TABLE]

provided that $p_{e}\geq s_{C}\geq s_{B}\geq p_{err}$. The security parameter $g=p_{e}-p_{err}$ quantifies the advantage that an honest party holds over a dishonest party, and if $g>0$ then our QDS protocol can be made arbitrarily secure by an appropriate choice of $L$. The signature length $L$ required to sign $m$ to a security level $\varepsilon_{fail}$ may thus be calculated using Eq. (21).

IV Performance of the protocol

The main figure of merit for a QDS protocol is the signature length, $L$, required to sign a $1$ bit message to a given security level $\varepsilon_{fail}$. We choose the probability of failure to be $\varepsilon_{fail}=0.01\%$ and solve Eq. (21) for $L$, under both beamsplitter and entangling-cloner attacks, corresponding to $\xi=0\%$ and $\xi>0\%$, respectively, and for several different coherent state amplitudes used in the alphabet.

The signature lengths for the $\mathcal{A}_{4}$ alphabet are displayed in Fig. 6. As expected, we see that $L\rightarrow\infty$ as $T\rightarrow 0$ and the protocol can no longer be made secure in this limit. However, for all $T>0$, the security parameter $g$ is positive and so the protocol is secure, albeit with infeasibly large $L$ for the smallest values of $T$. The presence of realistic amounts of excess noise increases $L$ at all $T$, with increasingly drastic effects at small $T$–even though Charlie will allow fewer thermal photons in the channel as $T$ decreases.

For values of $T$ corresponding to realistic metropolitan distances we observe that our QDS scheme can be made secure with surprisingly short signature lengths $L$. Assuming optical fiber with $0.2$ dB loss per km, we calculate $T$ corresponding to $1$ km and $20$ km channels. At these distances, displayed in the vertical gridlines of Fig. 6, we can securely sign a $1$ bit message with only $L\sim O\left(10^{5}\right)$ coherent states. Combined with fast sending rates typical to the CV platform, this opens up the possiblity of signing a message in times competitive with the $O\left(10^{-1}\right)$ seconds found in DV schemes (Collins et al. (2017), and see Fig. $7$ of Collins et al. (2018)). For example, with a feasible sending rate of $100$ MHz our protocol could securely sign a $1$ bit message in $O\left(10^{-3}\right)$ seconds over $20$ km.

The signature lengths required under our new security proof are shorter than under our previous protocol, despite now making fewer assumptions about the power of an eavesdropping party. For example, at $T=0.5$, our current protocol gives $L=34139$ whereas the protocol from Croal et al. (2016) would give $L=44010$. This improvement is beacuse in our new protocol we have chosen $\Phi_{m}^{B}\neq\Phi_{m}^{C}$, so a dishonest party is forced to eavesdrop and thus receives an imperfect copy of Charlie’s states, whereas previously they were given a perfect copy Croal et al. (2016); Amiri et al. (2016).

To understand the optimal behaviour of our protocol, we consider security parameter $g$ instead of signature length, via Eq. (21). We observe in Fig. 7 that the maximum $g$–therefore smallest $L$–varies strongly with $T$ and $\alpha$ and only slightly with $\xi$. Therefore, for a given channel it is important to pick the optimal $\alpha$ in order to minimise the quantum resources required for security. This is in sharp contrast to Croal et al. (2016), shown in Fig 7 by red, dot-dashed lines, where the optimal $\alpha\approx 0.5$ for all channels.

For each channel we minimize $L$ by optimizing over $\alpha$, and the results are plotted in Fig. 8, with the required $\alpha_{opt}$ displayed in the inset. For large $T$ a large $\alpha$ is optimal. In this case an eavesdropper gains little information so honest parties should try to minimise their mismatch rate. As $T$ decreases a smaller $\alpha$ will increase the eavesdropper’s mismatch rate but at the cost of also increasing honest mismatches. Taking $\xi\neq 0\%$ was found to slightly decrease $\alpha_{opt}$.

We have also considered the alphabet sizes $\mathcal{A}_{6}$, $\mathcal{A}_{8}$ and $\mathcal{A}_{2}$, Appendix B, with their optimal $L$’s also plotted in Fig. 8. Surprisingly, although for larger alphabets the optimal $\alpha$ is decreased, the minimal $L$ is slightly increased. As has been found elsewhere Leverrier and Grangier (2011), the biggest leap in behaviour should occur between $\mathcal{A}_{2}\rightarrow\mathcal{A}_{4}$, and indeed this is what we see, noting that for $\mathcal{A}_{2}$ we no longer need to think about an eliminated signature or ambiguity and we simply consider optimal guessing probabilities. As the alphabet tends towards a Gaussian mixture of coherent states, we expect the two attack strategies considered in this paper to become increasingly optimal, which explains the slight increase in $L$ for larger alphabets.

V Discussion

Quantum digital signatures, which allow for secure authentication of a classical message, have only recently been proven secure against a quantum eavesdropper on the channels Amiri et al. (2016); Puthoor et al. (2016); Yin et al. (2016). In the present paper, we have advanced QDS protocols operating on the continuous-variable platform by providing security against beamsplitter and entangling-cloner attacks on the quantum channels. Surprisingly, short signature lengths (even shorter than in Croal et al. (2016) under the assumption of secure quantum channels) are sufficient to ensure secure QDS over metropolitan distances. The conceptually new security proof has enabled us to include the fact that for each eliminated signature element there are multiple “correct” declarations which a dishonest player can make, and which must be taken into account.

Our security proof relied on several assumptions which reflect the state-of-the-art of CV quantum cryptography with our chosen alphabet, but which future work should endeavour to relax Papanastasiou et al. (2018); Zhao et al. (2009); Brádler and Weedbrook (2018); Weedbrook et al. (2012). Firstly, the eavesdropping attacks permitted by a malevolent Bob in this work do not give him the full power afforded by quantum mechanics. The non-Gaussianity of our alphabet is restrictive here, and the entangling-cloner attack is only expected to be optimal as the limiting case that the alphabet becomes Gaussian, i.e. for $\alpha\rightarrow 0$ Navascués et al. (2006); García-Patrón and Cerf (2006). For our alphabet with discrete modulation, a wider class of non-Gaussian attacks may provide an eavesdropper with an advantage, and more work is needed to explore optimal classes of non-Gaussian attack. In a general protocol these effects could be taken into account for example by tomographically reconstructing the state $\rho_{B}$ which maximizes the Holevo information $\chi$, while remaining consistent with Charlie’s measurement outcomes–though we note that the resources required for this will be expensive and may undermine the ease-of-use which our scheme currently boasts. Another possible route towards improving security would be an extension of results known for QKD with $2$ state Zhao et al. (2009) and $3$ state Brádler and Weedbrook (2018) alphabets to our $\mathcal{A}_{4}$, noting recent progress in Papanastasiou et al. (2018).

Techniques used in our security proof will in future allow us for possibility to explore different security tasks, such as secret sharing Kogias et al. (2017) or oblivious transfer Broadbent and Schaffner (2016), and to design protocols relying on the same modest physical requirements which we used here. One may also begin to consider consider finite-size effects Tomamichel (2016), which are intrinsic to any QDS scheme, noting the operational links between the guessing probabilities considered in this paper and the smooth min-entropy König et al. (2009). Advances in calculating optimal lower bounds for the smooth min-entropy will have immediate and direct application to CV QDS, and may be readily incorporated into our security proof.

The security of our QDS protocol and the short time required to sign a message, stemming both from the conceptually new security proof and the practical advantages of the CV platform, make CV QDS an attractive scheme for secure communications in a quantum future. It may soon be possible to move to real-world implementation of our scheme, with opportunity to run alongside related QKD schemes Heim et al. (2014).

Appendix A Hoeffding’s inequalities

Hoeffding’s inequalities Hoeffding (1963); Watrous (2018) provide a bound for the probability that the empirical mean of $n$ independent outcomes differs from the expectation. The most useful form for our purposes is shown below, and we briefly demonstrate how they may be utilised in our security proof. A full treatment can be found in Croal et al. (2016); Collins et al. (2014).

A.1 Hoeffding’s inequalities.

Let $X_{1},\ldots,X_{n}$ be independent binary random variables. Let $\bar{X}$ be their empirical mean, and $\mathbb{E}\left(\bar{X}\right)$ their expected value. Then for every $\varepsilon\geq 0$ the following are true

[TABLE]

A.2 Application to QDS.

Let $\mathcal{F}$ be a string of declared phases, and $\mathcal{G}$ be an eliminated signature. Define a string $E$

[TABLE]

which measures the number of mismatches between $\mathcal{F}$ and $\mathcal{G}$. All strings are of length $n$. We wish to bound the probability that the number of mismatches is below some threshold $sn$, or equivalently the probability $P\left(\bar{E}\leq s\right)$ that the observed mismatch rate $\bar{E}=1/n\sum_{j=1}^{n}E_{j}$ is below $s$. Then we have

[TABLE]

where the equality follows trivially provided that $\mathbb{E}\left(E\right)-s\geq 0$, and the inequality is an application of Eq. (A.1). Bounds on $P\left(s\leq\bar{E}\right)$ may be similarly derived:

[TABLE]

Appendix B Larger alphabets

We show that our central result, Eq. (11), holds for all alphabets $\mathcal{A}_{N}$ with $N=2k$; $k\in\mathbb{N}$; consisting of coherent states equally distributed about the origin in phase space. We also remark on any required modifications to the calculations presented in the paper.

During the protocol, Bob and Charlie should eliminate exactly $N/2$ coherent states, using the same strategy as in Fig 2. Otherwise the running of the protocol remains the same.

As before, Eqs. (5), (6), (III.4), we start with $H\left(E_{j},x_{1}^{j},\dots,x_{N/2}^{j}|y_{j}\right)$ and use the chain rule for conditional entropies twice, giving

[TABLE]

once we have taken into account that $H\left(E_{j}|x_{1}^{j},\dots,x_{N/2}^{j},y_{j}\right)=0$. Using $H\left(E_{j}|y_{j}\right)\leq h\left(p_{e}\right)$ and the fact that Bob and Charlie eliminate exactly $N/2$ out of $N$ possible alphabet states, we arrive at

[TABLE]

therefore

[TABLE]

To complete the proof of Eq. (11) we simply observe

[TABLE]

where we have taken into account relabeling, and Eq. (11) follows immediately.

The quantities used to calculate the Holevo information must also be altered in order to reflect the different alphabet. Bob’s a priori state becomes

[TABLE]

the state $\rho_{B|c}^{j}$ is similarly transformed–both for beamsplitter attack and entangling-cloner attack. The integration limits of Eq. (17) are also altered so that each segment now occupies an angular width of $2\pi/N$. Finally, since Bob and Charlie eliminate exactly $N/2$ of the alphabet, the probability $p_{err}$ that a heterodyne measurement should eliminate Alice’s sent state remains unchanged.

Appendix C Two-mode squeezed vacuum

We will calculate the $|\Psi\rangle_{B_{1}\prime B_{2}C}^{j}$ and $\rho_{B|c}^{j}$ required for the entangling cloner attack, Fig. 5. Our starting point is the state shared between Alice and Bob before the channel. Alice generates coherent state $|\alpha\rangle$ and Bob generates a two-mode squeezed vacuum (TMSV) state Leonhardt (2010). Then Alice and Bob share the three-mode state

[TABLE]

where $|\alpha\rangle=\hat{D}\left(\alpha\right)|0\rangle$ and $\hat{D}\left(\alpha\right)=\exp\left(\alpha\hat{a}^{\dagger}-\alpha^{*}\hat{a}\right)$ is the displacement operator; and where we have written $|m\rangle_{B_{1}}=\left(\hat{a}_{B_{1}}^{\dagger}\right)^{m}/\sqrt{m!}|0\rangle_{B_{1}}$. The coefficient $G_{m}=\left(\tanh r\right)^{m}/\cosh r$ where $r$ parametrises the number of thermal photons $\bar{n}$ in each of the two modes via $\bar{n}=\sinh^{2}r$.

The beamsplitter transforms our creation operators as

[TABLE]

Using Eq. (27) we transform our input state to give

[TABLE]

where we have used the fact that $\hat{a}_{B_{1}^{\prime}}$ and $\hat{a}_{C}$ commute. The state Eq. (C) may be computed by using the binomial expansion on the brackets, and the state $\rho_{B|c}^{j}\left(\bar{n}\right)=\langle c|\Psi\rangle\langle\Psi|c\rangle$ can now be computed.