Secure Multi-party Quantum Computation with a Dishonest Majority - - PowerPoint PPT Presentation

Secure Multi-party Quantum Computation with a Dishonest Majority

Yfke Dulek, Alex Grilo, Stacey Jeffery, Christian Majenz, Christian Schaffner

Introduction

Multi-party computation (MPC)

100 10 55 11 102 83

102

Input (player i): xi Output: f(x1, …, xk) Output (player i): fi(x1, …, xk)

false false false false false true

This is the ideal situation. What if there is no ?

Icons by Pixel perfect. e.g., what is the maximum input? e.g., was my input the highest?

Multi-party computation (MPC)

100 10 55 11 102 83

xi ↦ fi(x1, …, xk) We want:

• privacy of inputs
• correctness of outputs

We cannot prevent:

• lying about inputs
• unfairness

9001

Goal: Quantum MPC (MPQC)

R2 R3 R4 R5 R6 R1

Φ(ρR1—6) This talk: protocol for MPQC

• subroutine: classical MPC
• Up to k-1
• Computationally secure
• gate-by-gate, using 


quantum
 rounds for the {CNOT,T}- depth of the q computation

O

• k(d + log(n))
• <latexit sha1_base64="dCi9Fg4oHmpgMznLzo1C1pBvLcU=">ACBHicbZC7SgNBFIbPeo3xtmqZjAIWYSwa6Nl0MbOCOYCSYizs5PNkNnZWZWiEsKG1sfw8ZCEVsfws63cXIpNPGHgY/nMOZ8/sJZ0q7re1tLyurae28hvbm3v7Np7+3UVp5LQGol5LJs+VpQzQWuaU6biaQ48jlt+IOLcb1xR6VisbjRw4R2IhwK1mMEa2N17cJV2dhCQ1KATpGbR6HJeE4aGw6Xbvolt2J0CJ4MyhWnKf7WwCodu2vdhCTNKJCE46VanluojsZlpoRTkf5dqpogskAh7RlUOCIqk42OWKEjowToF4szRMaTdzfExmOlBpGvumMsO6r+drY/K/WSnXvrJMxkaSaCjJd1Es50jEaJ4ICJinRfGgAE8nMXxHpY4mJNrnlTQje/MmLUD8pe4avTRrnMFUOCnAIJfDgFCpwCVWoAYEHeIZXeLMerRfr3fqYti5Zs5kD+CPr8wc9tpdr</latexit><latexit sha1_base64="eGbrNDlSIF7Bj4JmsU3DWqiozU=">ACBHicbZC7TsMwFIadcivlVmDsYlEhJUKqEhYK1jYKBK9SG1UOY6TWnWcyHaQStSBhZWVJ4CFAYRYeQg23gan7QAtv2Tp03/O0fH5vYRqWz72ygsLa+srhXSxubW9s75d29loxTgUkTxywWHQ9JwignTUVI51EBR5jLS94Xleb98QIWnMr9UoIW6EQk4DipHSVr9cuex5NDTh0PThEeyxODS5ZcHctPrlql2zJ4KL4MygWrcebpPi02OjX/7q+TFOI8IVZkjKrmMnys2QUBQzMi71UkShIcoJF2NHEVEutnkiDE81I4Pg1joxWcuL8nMhRJOYo83RkhNZDztdz8r9ZNVXDqZpQnqSIcTxcFKYMqhnki0KeCYMVGhAWVP8V4gESCudW0mH4MyfvAit45qj+UqncQamKoIKOAmcMAJqIML0ABNgMEdeAav4M24N16Md+Nj2lowZjP74I+Mzx8GSJjB</latexit><latexit sha1_base64="eGbrNDlSIF7Bj4JmsU3DWqiozU=">ACBHicbZC7TsMwFIadcivlVmDsYlEhJUKqEhYK1jYKBK9SG1UOY6TWnWcyHaQStSBhZWVJ4CFAYRYeQg23gan7QAtv2Tp03/O0fH5vYRqWz72ygsLa+srhXSxubW9s75d29loxTgUkTxywWHQ9JwignTUVI51EBR5jLS94Xleb98QIWnMr9UoIW6EQk4DipHSVr9cuex5NDTh0PThEeyxODS5ZcHctPrlql2zJ4KL4MygWrcebpPi02OjX/7q+TFOI8IVZkjKrmMnys2QUBQzMi71UkShIcoJF2NHEVEutnkiDE81I4Pg1joxWcuL8nMhRJOYo83RkhNZDztdz8r9ZNVXDqZpQnqSIcTxcFKYMqhnki0KeCYMVGhAWVP8V4gESCudW0mH4MyfvAit45qj+UqncQamKoIKOAmcMAJqIML0ABNgMEdeAav4M24N16Md+Nj2lowZjP74I+Mzx8GSJjB</latexit><latexit sha1_base64="lJ+jakwEFstGI8oFfzqS5CWcxTQ=">ACBHicbZDLSsNAFIYn9VbrLeqym8EipAglcaPLoht3VrAXaEKZTCbp0MkzEyErpw46u4caGIWx/CnW/jpM1CW38Y+PjPOZw5v58yKpVtfxuVtfWNza3qdm1nd2/wDw86skE5h0cISMfCRJIxy0lVUMTJIBUGxz0jfn1wX9f4DEZIm/F5NU+LFKOI0pBgpbY3M+q3r08iCEyuAZ9BlSWTxZhMWZnNkNuyWPRdcBaeEBijVGZlfbpDgLCZcYakHDp2qrwcCUxI7Oam0mSIjxBERlq5Cgm0svnR8zgqXYCGCZCP67g3P09kaNYymns684YqbFcrhXmf7VhpsJL6c8zRTheLEozBhUCSwSgQEVBCs21YCwoPqvEI+RQFjp3Go6BGf5FXonbczXd2o31VxlEFdXACLOCAC9AGN6ADugCDR/AMXsGb8WS8GO/Gx6K1YpQzx+CPjM8fyEaVmQ=</latexit>

d

MPQC: two approaches

R2 R3 R4 R5 R6 R1

• 1. Secret sharing [CGS02]
• distribute inputs
• up to <k/2 dishonest
• 2. Authentication [DNS12]
• protect inputs
• hope: up to k-1 dishonest

[CGS02] Crépeau, Gottesman, and Smith. Secure multi-party quantum computation. (STOC 2002) [DNS12] Dupuis, Nielsen, and Salvail. Actively secure two-party evaluation of any quantum operation. (CRYPTO 2012)

Authentication

Computation Magic-state generation Summary Introduction

Clifford code

Key: Encoding: Decoding: apply , measure traps

|ψi 7! C

• |ψi ⌦ |0i⊗n

C† C ∈R Cliffordn+1

Subgroup of unitaries Generated by H, √ Z, CNOT Looks “random” traps

Theorem (informal): for any on qubits, the probability that changes , but is not detected at decoding is very small ( ).

A n + 1 A |ψi 2−n

Bonus: the Clifford code also provides privacy.

Clifford code in MPQC

R2 R3 R4 R5 R6 R1

• What if the encoding player

is dishonest?

• How to do computation?

Data is unalterable! Answers: use classical multi- party computation!

Public authentication test

R2 R3 R4 R5 R6 R1

C1(|ψi ⌦ |02ni) C2 C3 C4 C5 C6

Public authentication test

C1(|ψi ⌦ |02ni) C2 C3 C4 C5 C6 C6C5C4C3C2C1 | {z } C

Unknown to all Player 1 created these

Using classical MPC:

• Select . Note: iff 


Lemma: apply random and measure traps 
 measure traps

• Let player 1 apply for random
• Let player 1 measure last qubits (check if outcome is )

Result: authenticated state

g ∈R GL(2n, F2) g n 2n ≈ (C0 ⊗ Xr)(I ⊗ g)C† C0, r r n C0(|ψi ⌦ |0ni) g(y) = 02n

y = 02n

Public authentication test

One player performs the test: applies Clifford, measures, … All players verify the test through classical MPC The test can be used:

• to test encodings (as in previous slide);
• to test whether a computation step was executed honestly

Computation

Magic-state generation Summary Introduction Authentication

Computation

Protocols ( ) for these :

• 1-qubit Cliffords
• CNOT (2-qubit Clifford)
• T (non-Clifford)
• (Computational-basis measurement)

C(|ψi ⌦ |0ni) 7! C0(G|ψi ⌦ |0ni) G |ψi

G|ψi

Single-qubit Cliffords

R2 R3 R4 R5 R6 R1

= C(|ψi ⌦ |0i⊗n)

Using classical MPC: update classical key Then will decode to

C 7! C0 := C(G† ⌦ I⌦n) (C0)†C(|ψi ⌦ |0i⌦n) = G|ψi ⌦ |0i⊗n

CNOT

Same strategy does not work: is not in product form. Instead:

• Player 1 applies for freshly

random .

• Player 1 executes public authentication test.

⊗ (C1 ⊗ C2)(CNOT † ⊗ I⊗2n) (C0

1 ⊗ C0 2)CNOT(C† 1 ⊗ C† 2)

C0

1, C0 2

= (C1 ⌦ C2)(|ψ1i ⌦ |0ni ⌦ |ψ2i ⌦ |0ni)

Non-Clifford gate

T =  1 eπi/4

• Magic-state computation:

C3(T|ψi ⌦ |0ni) C2(T|+i ⌦ |0ni) C1(|ψi ⌦ |0ni) ⊗ 7!

“magic state” Nobody can be trusted to create encoded magic states!

Magic-state generation

Introduction Authentication Computation Summary

Magic-state generation

= C(T|+i ⌦ |0ni)

• 1. “cut-and-choose”:

✦ every player tests

random states

✦ remaining copies are

“pretty good”

• 2. magic-state distillation:

✦ a Clifford circuit ✦ remaining copy is “very

good”

n n

Summary

A protocol for multiparty computation of any quantum circuit:

• Computationally secure against cheaters (out of )
• Encoded states of size (vs. in [DNS12])
• Computation:
• Cliffords are simple (CNOT requires quantum

communication & public authentication test)

• T gate: requires magic states (vs. in [DNS12])

≤ k − 1

k

2n + 1

kn + 1

kn nk

Thank you!