Noisy-storage model

In information theoretic cryptography physical assumptions appear, which do not rely on any hardness assumptions, but merely assume a limit on some other resource. In classical cryptography, the bounded-storage model introduced by Ueli Maurer assumes that the adversary can only store a certain number of classical bits.[6][7] Protocols are known that do (in principle) allow the secure implementation of any cryptographic task as long as the adversary's storage is small. Very intuitively, security becomes possible under this assumption since the adversary has to make a choice which information to keep. That is, the protocol effectively overflows his memory device leading to an inevitable lack on information for the adversary. It was later discovered that any classical protocol which requires the honest parties to store ${\displaystyle n}$ bits in order to execute it successfully can be broken by an adversary that can store more than about ${\displaystyle O(n^{2})}$ bits.[8] That is, the gap between what is required to execute the protocol, and what is required to break the security is relatively small.

This gap changes dramatically when using quantum communication[9] . That is, Alice and Bob can send qubits to each other as part of the protocol. Likewise, one now assumes that the adversary's quantum storage is limited to a certain number of qubits. There is no restriction on how many classical bits the adversary can store. This is known as the bounded-quantum-storage model.[9][10] It was shown that there exist quantum protocols in which the honest parties need no quantum storage at all to execute them, but are nevertheless secure as long as Alice transmits more than twice the number of qubits than the adversary can store.

More generally, security is possible as long as the amount of information that the adversary can store in his memory device is limited. This intuition is captured by the noisy-storage model,[1] which includes the bounded-quantum-storage model as a special case.[11] Such a limitation can, for example, come about if the memory device is extremely large, but very imperfect. In information theory such an imperfect memory device is also called a noisy channel. The motivation for this more general model is threefold. First, it allows one to make statements about much more general memory devices that the adversary may have available. Second, security statements could be made when the signals transmitted, or the storage device itself, uses continuous variables whose dimension is infinite and thus cannot be captured by a bounded storage assumption without additional constraints. Third, even if the dimension of the signals itself is small, the noisy-storage analysis allows security beyond the regime where bounded-storage itself can make any security statement. For example, if the storage channel is entanglement breaking, security is possible even if the storage device is arbitrarily large (i.e., not bounded in any way).

• The storage device consists of ${\displaystyle N}$ qubits, each of which is subject to depolarizing noise. That is, ${\displaystyle {\mathcal {F}}={\mathcal {N}}^{\otimes N}}$, where ${\displaystyle {\mathcal {N}}(\rho )=\lambda \rho +(1-\lambda ){\mathsf {id}}/2}$ is the 2-dimensional depolarizing channel.
• The storage device consists of ${\displaystyle N}$ qubits, which are noise-free. This corresponds to the special case of bounded-quantum-storage. That is, ${\displaystyle {\mathcal {F}}={\mathsf {id}}^{\otimes N}}$, where ${\displaystyle {\mathsf {id}}}$ is the identity channel.

To demonstrate that all two-party cryptographic tasks can be implemented securely, a common approach is to show that a simple cryptographic primitive can be implemented that is known to be universal for secure function evaluation. That is, once one manages to build a protocol for such a cryptographic primitive all other tasks can be implemented by using this primitive as a basic building block. One such primitive is oblivious transfer. In turn, oblivious transfer can be constructed from an even simpler building block known as weak string erasure in combination with cryptographic techniques such as privacy amplification.

All protocols proposed to date allow one of the parties (Alice) to have even an unlimited amount of noise-free quantum memory. I.e., the noisy-storage assumption is applied to only one of the parties (Bob). For storage devices of the form ${\displaystyle {\mathcal {F}}={\mathcal {N}}^{\otimes N}}$ it is known that any two-party cryptographic task can be implemented securely by means of weak string erasure and oblivious transfer whenever any of the following conditions hold.

• For bounded-quantum-storage (i.e., ${\displaystyle {\mathcal {N}}={\mathsf {id}}}$), security can be achieved using a protocol in which Alice sends ${\displaystyle n>2N}$ BB84 encoded qubits.[11] That is, security can be achieved when Alice sends more than twice the number of qubits than Bob can store. One can also look at this from Bob's perspective and say that security can be achieved when Bob can store strictly less than half of the qubits that Alice sent, i.e., ${\displaystyle N<n/2}$.
• For bounded-quantum-storage using higher-dimensional memory cells (i.e., each cell is not a qubit, but a qudit), security can be achieved in a protocol in which Alice sends ${\displaystyle n}$ higher-dimensional qudits encoded one of the possible mutually unbiased bases. In the limit of large dimensions, security can be achieved whenever ${\displaystyle n\gtrapprox N}$. That is, security can always be achieved as long as Bob cannot store any constant fraction of the transmitted signals.[13] This is optimal for the protocols considered since for ${\displaystyle n=N}$ a dishonest Bob can store all qudits sent by Alice. It is not known whether the same is possible using merely BB84 encoded qubits.

• For noisy-storage and devices of the form ${\displaystyle {\mathcal {F}}={\mathcal {N}}^{\otimes N}}$ security can be achieved using a protocol in which Alice sends ${\displaystyle n}$ BB84 encoded qubits if

• ${\displaystyle n>2\cdot N\cdot C({\mathcal {N}})}$,[11] where ${\displaystyle C({\mathcal {N}})}$ is the classical capacity of the quantum channel ${\displaystyle {\mathcal {N}}}$, and ${\displaystyle {\mathcal {N}}}$ obeys the so-called strong converse property,[14] or, if

• ${\displaystyle n>2\cdot N\cdot E_{C}({\mathcal {N}})}$,[15] where ${\displaystyle E_{C}({\mathcal {N}})}$ is the entanglement cost of the quantum channel ${\displaystyle {\mathcal {N}}}$. This is generally much better than the condition on the classical capacity, however it is harder to evaluate ${\displaystyle E_{C}({\mathcal {N}})}$.

• For noisy-storage and devices of the form ${\displaystyle {\mathcal {F}}={\mathcal {N}}^{\otimes N}}$ security can be achieved using a protocol in which Alice sends ${\displaystyle n}$ qubits encoded in one of the three mutually unbiased bases per qubit, if

• ${\displaystyle n>Q({\mathcal {N}})N}$,[16] where ${\displaystyle Q}$ is the quantum capacity of ${\displaystyle {\mathcal {N}}}$, and the strong converse parameter of ${\displaystyle {\mathcal {N}}}$ is not too small.

The three mutually unbiased bases are the same encodings as in the six-state protocol of quantum key distribution. The last condition does form the best known condition for most channels, yet the quantum capacity as well as the strong converse parameter are generally not easy to determine.

Using such basic primitives as building blocks is not always the most efficient way to solve a cryptographic task. Specialized protocols targeted to solve specific problems are generally more efficient. Examples of known protocols are

• Bit commitment in the noisy-storage model,[11][13] and in the case of bounded-quantum-storage[10]
• Oblivious transfer in the noisy-storage model,[11] and in the case of bounded-quantum-storage[9][10]
• Secure identification in the bounded-quantum-storage model[17][18]