Quantum to Classical Randomness Extractors Mario Berta, Omar Fawzi, - PowerPoint PPT Presentation

Quantum to Classical Randomness Extractors Mario Berta, Omar Fawzi, Stephanie Wehner - Full version preprint available at arXiv: 1111.2026v3 08/23/2012 - CRYPTO University of California, Santa Barbara

Outline • (Classical to Classical) Randomness Extractors

Outline • (Classical to Classical) Randomness Extractors • Main Contribution: Quantum to Classical Randomness Extractors

Outline • (Classical to Classical) Randomness Extractors • Main Contribution: Quantum to Classical Randomness Extractors • Application: Security in the Noisy-Storage Model

Outline • (Classical to Classical) Randomness Extractors • Main Contribution: Quantum to Classical Randomness Extractors • Application: Security in the Noisy-Storage Model • Entropic Uncertainty Relations with Quantum Side Information

Outline • (Classical to Classical) Randomness Extractors • Main Contribution: Quantum to Classical Randomness Extractors • Application: Security in the Noisy-Storage Model • Entropic Uncertainty Relations with Quantum Side Information • Conclusions / Open Problems

Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Source N = N 1 , N 2 , . . . , N q

Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Pr[ N 1 = 0] = 1 Pr[ N 2 = 0] = 1 Ex: Source N = N 1 , N 2 , . . . , N q 2 + δ 1 , 2 + δ 2 , . . .

Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Pr[ N 1 = 0] = 1 Pr[ N 2 = 0] = 1 Ex: Source N = N 1 , N 2 , . . . , N q 2 + δ 1 , 2 + δ 2 , . . . Function: f ( N = N 1 , . . . , N q ) = M

Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Pr[ N 1 = 0] = 1 Pr[ N 2 = 0] = 1 Ex: Source N = N 1 , N 2 , . . . , N q 2 + δ 1 , 2 + δ 2 , . . . Pr[ N i = 0] = 2 Pr[ N i = 1] = 1 Ex: Function: f ( N = N 1 , . . . , N q ) = M 3 3 M = f ( N 1 N 2 N 3 ) = N 1 + N 2 + N 3 mod 2 Pr[ M = 0] ≈ 0 . 52

Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Pr[ N 1 = 0] = 1 Pr[ N 2 = 0] = 1 Ex: Source N = N 1 , N 2 , . . . , N q 2 + δ 1 , 2 + δ 2 , . . . Pr[ N i = 0] = 2 Pr[ N i = 1] = 1 Ex: Function: f ( N = N 1 , . . . , N q ) = M 3 3 M = f ( N 1 N 2 N 3 ) = N 1 + N 2 + N 3 mod 2 Pr[ M = 0] ≈ 0 . 52 Only minimal guarantee about the randomness of the source, high min- entropy: . H min ( N ) P = − log max P N ( n ) = − log p guess ( N ) P n

Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Pr[ N 1 = 0] = 1 Pr[ N 2 = 0] = 1 Ex: Source N = N 1 , N 2 , . . . , N q 2 + δ 1 , 2 + δ 2 , . . . Pr[ N i = 0] = 2 Pr[ N i = 1] = 1 Ex: Function: f ( N = N 1 , . . . , N q ) = M 3 3 M = f ( N 1 N 2 N 3 ) = N 1 + N 2 + N 3 mod 2 Pr[ M = 0] ≈ 0 . 52 Only minimal guarantee about the randomness of the source, high min- entropy: . H min ( N ) P = − log max P N ( n ) = − log p guess ( N ) P n Not possible to obtain randomness using a deterministic function, invest a small amount of perfect randomness: N f D M = f D ( N ) Seed D

Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Pr[ N 1 = 0] = 1 Pr[ N 2 = 0] = 1 Ex: Source N = N 1 , N 2 , . . . , N q 2 + δ 1 , 2 + δ 2 , . . . Pr[ N i = 0] = 2 Pr[ N i = 1] = 1 Ex: Function: f ( N = N 1 , . . . , N q ) = M 3 3 M = f ( N 1 N 2 N 3 ) = N 1 + N 2 + N 3 mod 2 Pr[ M = 0] ≈ 0 . 52 Only minimal guarantee about the randomness of the source, high min- entropy: . H min ( N ) P = − log max P N ( n ) = − log p guess ( N ) P n Not possible to obtain randomness using a deterministic function, invest a small amount of perfect randomness: N f D M = f D ( N ) Seed D Lost randomness? Strong extractors: are jointly uniform. ( M, D )

Classical to Classical (CC)-Randomness Extractors (I) Given an (unknown) weak source of classical randomness, how to convert it into uniformly random bits? Pr[ N 1 = 0] = 1 Pr[ N 2 = 0] = 1 Ex: Source N = N 1 , N 2 , . . . , N q 2 + δ 1 , 2 + δ 2 , . . . Pr[ N i = 0] = 2 Pr[ N i = 1] = 1 Ex: Function: f ( N = N 1 , . . . , N q ) = M 3 3 M = f ( N 1 N 2 N 3 ) = N 1 + N 2 + N 3 mod 2 Pr[ M = 0] ≈ 0 . 52 Only minimal guarantee about the randomness of the source, high min- entropy: . H min ( N ) P = − log max P N ( n ) = − log p guess ( N ) P n Not possible to obtain randomness using a deterministic function, invest a small amount of perfect randomness: N f D M = f D ( N ) Seed D Lost randomness? Strong extractors: are jointly uniform. ( M, D ) Applications in information theory, cryptography and computational complexity theory [1,2]. [1] Nisan and Zuckerman, JCSS 52:43, 1996 [2] Vadhan, http://people.seas.harvard.edu/~salil/pseudorandomness/

Classical to Classical (CC)-Randomness Extractors (II) Deal with prior knowledge (trivial for classical side information [3]), in general problematic for quantum side information [4]! Source described by classical-quantum (cq)- state: X p n | n ih n | N ⌦ ρ n . ρ NE = E n [3] König and Terhal, IEEE TIT 54:749, 2008 [4] Gavinsky et al., STOC, 2007

Classical to Classical (CC)-Randomness Extractors (II) Deal with prior knowledge X p n | n ih n | N ⌦ ρ n E N ρ NE = (trivial for classical side E n information [3]), in general problematic for quantum id D Mix side information [4]! D D Source described by f D classical-quantum (cq)- Discard state: k ρ MED � id M M ⌦ ρ ED k 1  ε X p n | n ih n | N ⌦ ρ n . p ρ NE = E X † X ] k X k 1 = tr[ M D n E [3] König and Terhal, IEEE TIT 54:749, 2008 [4] Gavinsky et al., STOC, 2007

Classical to Classical (CC)-Randomness Extractors (II) Deal with prior knowledge X p n | n ih n | N ⌦ ρ n E N ρ NE = (trivial for classical side E n information [3]), in general problematic for quantum id D Mix side information [4]! D D Source described by f D classical-quantum (cq)- Discard state: k ρ MED � id M M ⌦ ρ ED k 1  ε X p n | n ih n | N ⌦ ρ n . p ρ NE = E X † X ] k X k 1 = tr[ M D n E Guarantee about conditional min-entropy of the source: . H min ( N | E ) ρ = − log p guess ( N | E ) ρ [3] König and Terhal, IEEE TIT 54:749, 2008 [4] Gavinsky et al., STOC, 2007

Classical to Classical (CC)-Randomness Extractors (II) Deal with prior knowledge X p n | n ih n | N ⌦ ρ n E N ρ NE = (trivial for classical side E n information [3]), in general problematic for quantum id D Mix side information [4]! D D Source described by f D classical-quantum (cq)- Discard state: k ρ MED � id M M ⌦ ρ ED k 1  ε X p n | n ih n | N ⌦ ρ n . p ρ NE = E X † X ] k X k 1 = tr[ M D n E Guarantee about conditional min-entropy of the source: . H min ( N | E ) ρ = − log p guess ( N | E ) ρ Ex: Two-universal hashing / privacy amplification [5]. For all cq-states with ρ NE k ρ MED � id M , we have for . M = 2 k · ε 2 H min ( N | E ) ρ ≥ k M ⌦ ρ ED k 1  ε Strong extractor (against quantum side information), . ( k, ε ) D = O ( N ) [3] König and Terhal, IEEE TIT 54:749, 2008 [5] Renner, PhD Thesis, ETHZ, 2005 [4] Gavinsky et al., STOC, 2007

Quantum to Classical (QC)-Randomness Extractors - Definition (I) Motivation: How to get weak randomness at first? How much randomness can be gained from a quantum source?

Quantum to Classical (QC)-Randomness Extractors - Definition (I) Motivation: How to get weak randomness at first? How much randomness can be gained from a quantum source? N ρ NE E N id D Mix D D Measure M D Measurement Discard M k ρ MED � id M M ⌦ ρ ED k 1  ε M D E

Quantum to Classical (QC)-Randomness Extractors - Definition (I) Motivation: How to get weak randomness at first? How much randomness can be gained from a quantum source? N ρ NE E N id D Mix D D Measure M D Measurement Discard M k ρ MED � id M M ⌦ ρ ED k 1  ε M D E Idea: Same setup as in the classical case (no control of the source)! Only guarantee about the conditional min-entropy [6]: N 1 X | Φ i NN 0 = p | n i N ⌦ | n i N 0 N n =1 F ( ρ , σ ) = kp ρ p σ k 2 H min ( N | E ) ρ = − log N max Λ E ! N 0 F ( Φ NN 0 , (id N ⊗ Λ E → N 0 )( ρ NE )) 1 [6] König et al., IEEE TIT 55:4674, 2009