Efficient Simulation of Random States and Random Unitaries Gorjan - - PowerPoint PPT Presentation

▶
efficient simulation of random states and random unitaries
SMART_READER_LITE
LIVE PREVIEW

Efficient Simulation of Random States and Random Unitaries Gorjan - - PowerPoint PPT Presentation

Dec 05, 2022 346 likes •1.09k views

Efficient Simulation of Random States and Random Unitaries Gorjan Alagic, Christian Majenz and Alexander Russell QCrypt 2020, in Cyberspace Results overview We study the simulation of random quantum objects , i.e. random quantum states

slide-1
SLIDE 1

Efficient Simulation of Random States and Random Unitaries

Gorjan Alagic, Christian Majenz and Alexander Russell

QCrypt 2020, in Cyberspace

slide-2
SLIDE 2

Results — overview

  • We study the simulation of random quantum objects, i.e. random

quantum states and random unitary operations

  • We develop a theory of their stateful simulation, a quantum analogue of

“lazy sampling”

  • For random states, we develop an efficient protocol for stateful simulation
  • For random unitaries, we show that simulation can be done in polynomial

space

  • As an application, we design a quantum money scheme that is

unconditionally unforgeable and untraceable.

slide-3
SLIDE 3

Introduction

slide-4
SLIDE 4

Randomness…

…is extremely useful. Applications:

  • All of cryptography
  • Monte Carlo simulation
  • Randomized algorithms
  • …
slide-5
SLIDE 5

Easy example: random string

Random element x ∈R {0,1}n

slide-6
SLIDE 6

Easy example: random string

Random element x ∈R {0,1}n Randomness cost Runtime limit distinguisher Exact No

n

slide-7
SLIDE 7

Easy example: random string

Random element x ∈R {0,1}n Randomness cost Runtime limit distinguisher Exact No Pseudorandom generator

n poly(λ) poly(λ)

slide-8
SLIDE 8

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

slide-9
SLIDE 9

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Limit distinguisher Exact No None

n ⋅ 2m

f

slide-10
SLIDE 10

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Limit distinguisher Exact No None

n ⋅ 2m

f runtime, memory

≤

slide-11
SLIDE 11

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Limit distinguisher Exact No None

  • wise

independent function No

n ⋅ 2m

f

t

O(t ⋅ n)

q ≤ t

# of queries

slide-12
SLIDE 12

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Limit distinguisher Exact No None

  • wise

independent function No Pseudorandom function No

n ⋅ 2m

f

time ≤ poly(λ) poly(λ)

t

O(t ⋅ n)

q ≤ t

slide-13
SLIDE 13

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Limit distinguisher Exact No None

  • wise

independent function No Pseudorandom function No “Lazy sampling” Yes None

n ⋅ 2m

f

time ≤ poly(λ) poly(λ)

t

O(t ⋅ n)

q ≤ t

q ⋅ n

slide-14
SLIDE 14

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Limit distinguisher Exact No None

  • wise

independent function No Pseudorandom function No “Lazy sampling” Yes None

n ⋅ 2m

f

time ≤ poly(λ) poly(λ)

t

O(t ⋅ n)

q ≤ t

q ⋅ n

Information-theoretically secure message authentication

slide-15
SLIDE 15

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Limit distinguisher Exact No None

  • wise

independent function No Pseudorandom function No “Lazy sampling” Yes None

n ⋅ 2m

f

time ≤ poly(λ) poly(λ)

t

O(t ⋅ n)

q ≤ t

q ⋅ n

Information-theoretically secure message authentication Computationally secure symmetric-key crypto

slide-16
SLIDE 16

Another example: random function

Function such that independently

f : {0,1}m → {0,1}n f(x) ∈R {0,1}n

Oracle simulation for Randomness cost Stateful simulation Limit distinguisher Exact No None

  • wise

independent function No Pseudorandom function No “Lazy sampling” Yes None

n ⋅ 2m

f

time ≤ poly(λ) poly(λ)

t

O(t ⋅ n)

q ≤ t

q ⋅ n

Information-theoretically secure message authentication Computationally secure symmetric-key crypto Random oracle model security (e.g. indifferentiability)

slide-17
SLIDE 17

Quantum states and operations

slide-18
SLIDE 18

Quantum states and operations

Quantum state: unit vector

|ϕ⟩ ∈ S ⊂ ℂ2n Sphere

slide-19
SLIDE 19

Quantum states and operations

Quantum state: unit vector

|ϕ⟩ ∈ S ⊂ ℂ2n Sphere Strictly speaking: , projective space

|ϕ⟩ ∈ P2n−1(ℂ)

slide-20
SLIDE 20

Quantum states and operations

Quantum state: unit vector

|ϕ⟩ ∈ S ⊂ ℂ2n Sphere Strictly speaking: , projective space

|ϕ⟩ ∈ P2n−1(ℂ)

Quantum operation: unitary matrix U ∈ U(2n) ⊂ ℂ2n×2n

(Compact Lie-)group

  • f unitary
  • matrices

2n × 2n

slide-21
SLIDE 21

Quantum states and operations

Quantum state: unit vector

|ϕ⟩ ∈ S ⊂ ℂ2n Sphere Strictly speaking: , projective space

|ϕ⟩ ∈ P2n−1(ℂ)

Quantum operation: unitary matrix U ∈ U(2n) ⊂ ℂ2n×2n

(Compact Lie-)group

  • f unitary
  • matrices

2n × 2n

Really nice mathematical objects with a natural notion of a uniform distribution!

slide-22
SLIDE 22

Quantum states and operations

Quantum state: unit vector

|ϕ⟩ ∈ S ⊂ ℂ2n Sphere Strictly speaking: , projective space

|ϕ⟩ ∈ P2n−1(ℂ)

Quantum operation: unitary matrix U ∈ U(2n) ⊂ ℂ2n×2n

(Compact Lie-)group

  • f unitary
  • matrices

2n × 2n

Really nice mathematical objects with a natural notion of a uniform distribution! Haar measure

slide-23
SLIDE 23

Example application: Haar money

No-cloning principle: quantum information cannot be copied.

slide-24
SLIDE 24

Example application: Haar money

No-cloning principle: quantum information cannot be copied. Oldest idea in quantum crypto: Let’s make money out of it!

slide-25
SLIDE 25

Example application: Haar money

No-cloning principle: quantum information cannot be copied. Oldest idea in quantum crypto: Let’s make money out of it! |ϕ⟩ ∈R S ⊂ ℂ2n Haar money (JLS ’19):

slide-26
SLIDE 26

Example application: Haar money

No-cloning principle: quantum information cannot be copied. Oldest idea in quantum crypto: Let’s make money out of it! |ϕ⟩ ∈R S ⊂ ℂ2n |ϕ⟩ |ϕ⟩ |ϕ⟩ |ϕ⟩ Haar money (JLS ’19):

slide-27
SLIDE 27

Example application: Haar money

No-cloning principle: quantum information cannot be copied. Oldest idea in quantum crypto: Let’s make money out of it! |ϕ⟩ ∈R S ⊂ ℂ2n |ϕ⟩ |ϕ⟩ |ϕ⟩ |ϕ⟩ Unforgeable ✓ Haar money (JLS ’19):

slide-28
SLIDE 28

Example application: Haar money

No-cloning principle: quantum information cannot be copied. Oldest idea in quantum crypto: Let’s make money out of it! |ϕ⟩ ∈R S ⊂ ℂ2n |ϕ⟩ |ϕ⟩ |ϕ⟩ |ϕ⟩ Unforgeable ✓ Untraceable ✓ Haar money (JLS ’19):

slide-29
SLIDE 29

Example application: Haar money

No-cloning principle: quantum information cannot be copied. Oldest idea in quantum crypto: Let’s make money out of it! |ϕ⟩ ∈R S ⊂ ℂ2n |ϕ⟩ |ϕ⟩ |ϕ⟩ |ϕ⟩ Unforgeable ✓ Untraceable ✓

Can the Bank sample such a random state?

Haar money (JLS ’19):

slide-30
SLIDE 30

Simulation of random quantum

  • bjects
slide-31
SLIDE 31

Can we sample a random quantum state?

Haar-random state .

|ϕ⟩ ∈ S ⊂ ℂ2n

slide-32
SLIDE 32

Can we sample a random quantum state?

Oracle simulation for Randomness/ Memory cost Simulation Limit distinguisher Exact inefficient, stateless None

∞

1 ↦ |ϕ⟩ Haar-random state .

|ϕ⟩ ∈ S ⊂ ℂ2n

slide-33
SLIDE 33

Can we sample a random quantum state?

Oracle simulation for Randomness/ Memory cost Simulation Limit distinguisher Exact inefficient, stateless None

  • Net

inefficient, stateless

∞

1 ↦ |ϕ⟩ Haar-random state .

|ϕ⟩ ∈ S ⊂ ℂ2n O(log (1/ε) ⋅ 2n) q ≤ O (1/ε)

ε

# of queries

slide-34
SLIDE 34

Can we sample a random quantum state?

Oracle simulation for Randomness/ Memory cost Simulation Limit distinguisher Exact inefficient, stateless None

  • Net

inefficient, stateless State -design efficient, stateless

∞

1 ↦ |ϕ⟩

t

poly(n, t)

q ≤ t

Haar-random state .

|ϕ⟩ ∈ S ⊂ ℂ2n O(log (1/ε) ⋅ 2n) q ≤ O (1/ε)

ε

slide-35
SLIDE 35

Can we sample a random quantum state?

Oracle simulation for Randomness/ Memory cost Simulation Limit distinguisher Exact inefficient, stateless None

  • Net

inefficient, stateless State -design efficient, stateless

Pseudorandom quantum state (JLS ’19, BS ’20)

efficient, stateless

∞

1 ↦ |ϕ⟩

time ≤ poly(λ) poly(λ)

t

poly(n, t)

q ≤ t

Haar-random state .

|ϕ⟩ ∈ S ⊂ ℂ2n O(log (1/ε) ⋅ 2n) q ≤ O (1/ε)

ε

slide-36
SLIDE 36

Can we sample a random quantum state?

Oracle simulation for Randomness/ Memory cost Simulation Limit distinguisher Exact inefficient, stateless None

  • Net

inefficient, stateless State -design efficient, stateless

Pseudorandom quantum state (JLS ’19, BS ’20)

efficient, stateless This work: quantum state “lazy sampling” efficient, stateful None

∞

1 ↦ |ϕ⟩

time ≤ poly(λ) poly(λ)

t

poly(n, t)

q ≤ t

poly(q, n)

Haar-random state .

|ϕ⟩ ∈ S ⊂ ℂ2n O(log (1/ε) ⋅ 2n) q ≤ O (1/ε)

ε

slide-37
SLIDE 37

Can we simulate a random unitary?

Haar-random unitary U ∈ U(2n)

slide-38
SLIDE 38

Can we simulate a random unitary?

Oracle simulation for Randomness/ Memory cost Simulation Limit distinguisher Exact inefficient, stateless None

  • Net

inefficient, stateless Haar-random unitary U ∈ U(2n)

∞

q ≤ O (1/ε)

ε

O(log (1/ε) ⋅ 22n) U

slide-39
SLIDE 39

Can we simulate a random unitary?

Oracle simulation for Randomness/ Memory cost Simulation Limit distinguisher Exact inefficient, stateless None

  • Net

inefficient, stateless Unitary -design efficient, stateless

t

poly(n, t)

q ≤ t

Haar-random unitary U ∈ U(2n)

∞

q ≤ O (1/ε)

ε

O(log (1/ε) ⋅ 22n) U

slide-40
SLIDE 40

Can we simulate a random unitary?

Oracle simulation for Randomness/ Memory cost Simulation Limit distinguisher Exact inefficient, stateless None

  • Net

inefficient, stateless Unitary -design efficient, stateless

Pseudorandom unitary??? (JLS ’19)

efficient, stateless

time ≤ poly(λ) poly(λ)

t

poly(n, t)

q ≤ t

Haar-random unitary U ∈ U(2n)

∞

q ≤ O (1/ε)

ε

O(log (1/ε) ⋅ 22n) U

slide-41
SLIDE 41

Can we simulate a random unitary?

Oracle simulation for Randomness/ Memory cost Simulation Limit distinguisher Exact inefficient, stateless None

  • Net

inefficient, stateless Unitary -design efficient, stateless

Pseudorandom unitary??? (JLS ’19)

efficient, stateless This work space-efficient, stateful None

time ≤ poly(λ) poly(λ)

t

poly(n, t)

q ≤ t

poly(q, n)

Haar-random unitary U ∈ U(2n)

∞

q ≤ O (1/ε)

ε

O(log (1/ε) ⋅ 22n) U

slide-42
SLIDE 42

Example application: Haar money

No-cloning principle: quantum information cannot be copied. |ϕ⟩ ∈R S ⊂ ℂ2n Unforgeable ✓ Untraceable ✓

Can the Bank sample such a random state?

Haar money (JLS ’19): Oldest idea in quantum crypto: Let’s make money out of it!

slide-43
SLIDE 43

Example application: Haar money

No-cloning principle: quantum information cannot be copied. |ϕ⟩ ∈R S ⊂ ℂ2n Unforgeable ✓ Untraceable ✓

Can the Bank sample such a random state?

Haar money (JLS ’19): Oldest idea in quantum crypto: Let’s make money out of it! No, but they can simulate it!

slide-44
SLIDE 44

Example application: Haar money

No-cloning principle: quantum information cannot be copied. |ϕ⟩ ∈R S ⊂ ℂ2n Unforgeable ✓ Untraceable ✓

Can the Bank sample such a random state?

Haar money (JLS ’19): Oldest idea in quantum crypto: Let’s make money out of it! No, but they can simulate it! Two options:

  • Use pseudorandom quantum state, computationally

secure untraceable quantum money (JLS ’19)

slide-45
SLIDE 45

Example application: Haar money

No-cloning principle: quantum information cannot be copied. |ϕ⟩ ∈R S ⊂ ℂ2n Unforgeable ✓ Untraceable ✓

Can the Bank sample such a random state?

Haar money (JLS ’19): Oldest idea in quantum crypto: Let’s make money out of it! No, but they can simulate it! Two options:

  • Use pseudorandom quantum state, computationally

secure untraceable quantum money (JLS ’19)

  • Use stateful simulation, unconditionally secure

untraceable quantum money (AMR)

slide-46
SLIDE 46

Limitations of stateless simulation

Stateless simulation scheme , pick , output copies of

⇔ {|ϕk⟩}k∈K k ∈R K |ϕk⟩

slide-47
SLIDE 47

Limitations of stateless simulation

Stateless simulation scheme , pick , output copies of

⇔ {|ϕk⟩}k∈K k ∈R K |ϕk⟩

Problem: quantum states can be distinguished with probability

|ϕ⟩ ≠ |ψ⟩ ⇒ |ϕ⟩⊗n, |ψ⟩⊗n p(n) → 1 (n → ∞)

slide-48
SLIDE 48

Limitations of stateless simulation

Stateless simulation scheme , pick , output copies of

⇔ {|ϕk⟩}k∈K k ∈R K |ϕk⟩

Problem: quantum states can be distinguished with probability

|ϕ⟩ ≠ |ψ⟩ ⇒ |ϕ⟩⊗n, |ψ⟩⊗n p(n) → 1 (n → ∞)

Also works for random states sampled according to different measures.

slide-49
SLIDE 49

Limitations of stateless simulation

Stateless simulation scheme , pick , output copies of

⇔ {|ϕk⟩}k∈K k ∈R K |ϕk⟩

Problem: quantum states can be distinguished with probability

|ϕ⟩ ≠ |ψ⟩ ⇒ |ϕ⟩⊗n, |ψ⟩⊗n p(n) → 1 (n → ∞)

Statelessness implies query limit! Also works for random states sampled according to different measures.

slide-50
SLIDE 50

Limitations of stateless simulation

Stateless simulation scheme , pick , output copies of

⇔ {|ϕk⟩}k∈K k ∈R K |ϕk⟩

Problem: quantum states can be distinguished with probability

|ϕ⟩ ≠ |ψ⟩ ⇒ |ϕ⟩⊗n, |ψ⟩⊗n p(n) → 1 (n → ∞)

Statelessness implies query limit! Also works for random states sampled according to different measures. Similar argument for unitaries.

slide-51
SLIDE 51

Techniques

slide-52
SLIDE 52

Going to both churches…

A random state and part of an entangled state look the same.

slide-53
SLIDE 53

Going to both churches…

A random state and part of an entangled state look the same.

Deterministic

slide-54
SLIDE 54

Going to both churches…

A random state and part of an entangled state look the same.

Random!

slide-55
SLIDE 55

Going to both churches…

A random state and part of an entangled state look the same.

Random!

stateful oracle simulation without any randomness, just by maintaining entanglement with the distinguisher!

⇒

slide-56
SLIDE 56

Going to both churches…

A random state and part of an entangled state look the same.

Random!

stateful oracle simulation without any randomness, just by maintaining entanglement with the distinguisher!

⇒

What do copies of a Haar random state look like to the distingusher?

ℓ

slide-57
SLIDE 57

Going to both churches…

A random state and part of an entangled state look the same.

Random!

stateful oracle simulation without any randomness, just by maintaining entanglement with the distinguisher!

⇒

What do copies of a Haar random state look like to the distingusher?

ℓ

From representation theory: 𝔽|ψ⟩∼Haar [|ψ⟩

⟨ψ |⊗ℓ ] = τSymℓℂd

slide-58
SLIDE 58

Stateful simulation algorithm

Fact: copies of a Haar random state look like a single Haar random state on the symmetric subspace

  • f

looks like half a maximally entangled state on

ℓ Symd,ℓ ℂd ⊗ ℂd ⊗ … ⊗ ℂd Symd,ℓ ⊗ Symd,ℓ

slide-59
SLIDE 59

Stateful simulation algorithm

Fact: copies of a Haar random state look like a single Haar random state on the symmetric subspace

  • f

looks like half a maximally entangled state on

ℓ Symd,ℓ ℂd ⊗ ℂd ⊗ … ⊗ ℂd Symd,ℓ ⊗ Symd,ℓ

Strategy: 1. Maintain maximally entangled state of two copies of . 2. On query: extend it from to by acting on one of the copies only.

Symd,ℓ ℓ ℓ + 1

slide-60
SLIDE 60

Stateful simulation algorithm

} }

Distinguisher Stateful simulator

slide-61
SLIDE 61

Stateful simulation algorithm

} }

Distinguisher Stateful simulator Vℓ→ℓ+1

slide-62
SLIDE 62

Stateful simulation algorithm

} }

Distinguisher Stateful simulator

slide-63
SLIDE 63

Stateful simulation algorithm

} }

Distinguisher Stateful simulator

slide-64
SLIDE 64

} }

Stateful simulation algorithm

Distinguisher Stateful simulator

slide-65
SLIDE 65

Technical contributions

slide-66
SLIDE 66

Technical contributions

  • Several new algorithmic tools for garbageless quantum state preparation
slide-67
SLIDE 67

Technical contributions

  • Several new algorithmic tools for garbageless quantum state preparation
  • Concrete algorithms: approximate algorithms for the extension of

maximally entangled states on symmetric subspaces by an additional copy

slide-68
SLIDE 68

Technical contributions

  • Several new algorithmic tools for garbageless quantum state preparation
  • Concrete algorithms: approximate algorithms for the extension of

maximally entangled states on symmetric subspaces by an additional copy

  • Stateful simulation of random unitaries: combining several nice ingredients.
slide-69
SLIDE 69

Technical contributions

  • Several new algorithmic tools for garbageless quantum state preparation
  • Concrete algorithms: approximate algorithms for the extension of

maximally entangled states on symmetric subspaces by an additional copy

  • Stateful simulation of random unitaries: combining several nice ingredients.
  • first (we think) quantum application of exact unitary designs (Kane ’15)
slide-70
SLIDE 70

Technical contributions

  • Several new algorithmic tools for garbageless quantum state preparation
  • Concrete algorithms: approximate algorithms for the extension of

maximally entangled states on symmetric subspaces by an additional copy

  • Stateful simulation of random unitaries: combining several nice ingredients.
  • first (we think) quantum application of exact unitary designs (Kane ’15)
  • Exact adaptive-to-nonadaptive reduction using “postselection”
slide-71
SLIDE 71

Technical contributions

  • Several new algorithmic tools for garbageless quantum state preparation
  • Concrete algorithms: approximate algorithms for the extension of

maximally entangled states on symmetric subspaces by an additional copy

  • Stateful simulation of random unitaries: combining several nice ingredients.
  • first (we think) quantum application of exact unitary designs (Kane ’15)
  • Exact adaptive-to-nonadaptive reduction using “postselection”
  • Uniqueness property of the Stinespring dilation
slide-72
SLIDE 72

Summary, open questions

Summary:

  • We develop a theory of stateful simulation of random quantum primitives.
  • Random quantum states can be approximately simulated efficiently using a stateful

algorithm

  • Random unitaries can be simulated exactly in a space-efficient way using a stateful

algorithm.

  • The random state simulator can be used to construct unconditionally secure untraceable

quantum money. Open questions:

  • Can we simulate random unitaries efficiently?
  • (From JLS ’19) Construct pseudorandom unitaries!