Fred Ulysse

Shouvik

Simon

Dominik, Luka Leo

Francesco, Victor, Rawad Adrien Nathan

Luka

Raja, Shane Andrea Pierre

Shraddha To

Damian Atul

Julien Adeline Martin

FRANÇAIS)

L es lois de la mécanique quantique présentent un fort potentiel d'amélioration pour la sécurité des réseaux de communication, du cryptage à clé publique au vote électronique, en passant par la banque en ligne. Cette thèse porte sur la sécurité pratique et l'implémentation de deux tâches cryptographiques quantiques : la monnaie quantique et le tirage à pile-ou-face faible.

La monnaie quantique exploite le théorème de non-clonage quantique pour générer des jetons, billets ou cartes de crédit strictement infalsifiables. Nous réalisons la première démonstration expérimentale de cette fonctionnalité sur une plateforme photonique aux longueurs d'onde télécom. Nous développons ensuite une analyse de sécurité pratique pour les cartes de crédit quantiques. La banque peut ainsi vérifier l'authenticité de la carte à distance, même en présence d'un terminal de paiement malhonnête. Enfin, nous proposons une expérience permettant le stockage sécurisé d'une carte de crédit quantique en utilisant la transparence électromagnétiquement induite au sein d'un nuage d'atomes refroidis.

Le tirage à pile-ou-face faible est une primitive cryptographique fondamentale: elle permet en effet la construction de tâches plus complexes telles que la mise en gage de bit et le calcul multipartite sécurisé. Lors d'un tirage à pile ou face, deux entités distantes et méfiantes jettent une pièce. Grâce à l'intrication quantique, il est possible de limiter la probabilité que l'entité malhonnête biaise la pièce. Dans ce projet, nous proposons la première implémentation du pile-ou-face faible. Celle-ci requiert un photon unique et une plateforme d'optique linéaire. Nous présentons l'analyse de sécurité en présence d'erreurs et de pertes, et démontrons que le protocole est réalisable à l'échelle d'une ville. Enfin, nous proposons de réduire davantage la probabilité du biais du protocole. i

ABSTRACT (ENGLISH)

H arnessing the laws of quantum theory can drastically boost the security of modern communication networks, from public key encryption to electronic voting and online banking. In this thesis, we bridge the gap between theory and experiment regarding two quantum-cryptographic tasks: quantum money and quantum weak coin flipping.

Quantum money exploits the no-cloning property of quantum physics to generate unforgeable tokens, banknotes, and credit cards. We provide the first proof-of-principle implementation of this task, using photonic systems at telecom wavelengths. We then develop a practical security proof for quantum credit card schemes, in which the bank can remotely verify a card even in the presence of a malicious payment terminal. We finally propose a setup for secure quantum storage of the credit card, using electromagneticallyinduced transparency in a cloud of cold cesium atoms.

Quantum weak coin flipping is a fundamental cryptographic primitive, which helps construct more complex tasks such as bit commitment and multiparty computation. It allows two distant parties to flip a coin when they both desire opposite outcomes. Using quantum entanglement then prevents any party from biasing the outcome of the flip beyond a certain probability. We propose the first implementation for quantum weak coin flipping, which requires a single photon and linear optics only. We provide the complete security analysis in the presence of noise and losses, and show that the protocol is implementable on the scale of a small city with current technology. We finally propose a linear-optical extension of the protocol to lower the coin bias.

INTRODUCTION 1.1 Context

Quantum networks

Modern communication networks are continuously expanding, with the increase in the number of users and available online resources. On a daily basis, users must inevitably trust local network nodes and transmission channels in order to perform sensitive tasks such as private data transmission, online banking, electronic voting, anonymous messaging, digital signatures, delegated computing and many more. In general, such complex networks are secured by relying on a collection of simpler cryptographic primitives, or building blocks, which are put together to guarantee overall security.

Let us illustrate this by considering a simple primitive, known as bit commitment. In this two-party protocol, we refer to Alice as the message sender, and Bob as the message receiver. Alice chooses a bit x, encrypts it according to some specific function, and sends it to Bob. The desired security property is two-way: Bob must not learn the value of x until Alice decides to reveal it, while Alice must not be able to change x once she has committed to it. Once this bit commitment primitive is acquired and provided as a black box, it may be used to construct a new primitive known as strong coin flipping. This primitive allows two parties to toss a fair coin from a distance without trusting each other. In a secure version of this task, none of the two parties should be able to bias the coin towards their preferred outcome. Assuming the parties use bit commitment as a 1 CHAPTER 1. INTRODUCTION secure resource, they may each commit to a bit, choose to reveal it at any given time, and take the sum of the two revealed bits as the outcome of the coin toss. Treating this new primitive as a black box in turn allows to construct more complex tasks relating to online gaming, multiparty computing [START_REF] Goldreich | How to play any mental game[END_REF], and randomized consensus protocols [START_REF] Alistarh | Communication-efficient randomized consensus[END_REF].

Cryptography often involves rigorously defining the notion of security for a given task, and constructing a protocol which achieves this security. Using classical resources only, the security of many primitives relies on computational assumptions. This type of security stems from the complexity of the encryption function used, and the time it takes for an adversary to reverse it. Essentially, a scheme is considered unbreakable when the time it takes for an adversary to computationally reverse the encryption function is much larger than the time over which the protocol must remain secure. A widely used public key encryption scheme, which relies on the computational difficulty in factoring large numbers, is the RSA method [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF]. It allows for two parties to exchange a secret key over a public channel, such that no eavesdropper can recover the secret key over the timescale of interest.

Strikingly, it turns out that encoding secret information onto quantum systems instead of classical ones can provide a much stronger level of security for public-key encryption, as well as for many other tasks. At the heart of quantum theory lie the uncertainty principle and the no-cloning theorem [START_REF] Wooters | A single quantum cannot be cloned[END_REF]. The first property states that, given two conjugate physical observables, decreasing the uncertainty on the value of one increases the uncertainty on the other. The second property states that it is physically impossible to perfectly clone an unknown quantum system, that is, to generate two identical copies of the system starting from a single copy. This contrasts with the classical world, in which measuring the properties of an unknown system allows to recreate many identical copies of it.

In the early seventies, Wiesner brought up an outrageously novel concept [START_REF] Wiesner | Conjugate coding[END_REF]: encoding information onto quantum observables instead of classical observables allows to exploit these fundamental properties to achieve information-theoretic security, i.e. security which does not rely on any computational assumption. This form of security already exists in the classical world for some tasks, such as the one-time-pad [START_REF] Miller | Telegraphic code to ensure privacy and secrecy in the transmission of telegrams[END_REF], which serves to encrypt a message with a pre-shared secret key of the same length. However, Wiesner's ground-breaking proposal allows to achieve information-theoretic security for many primitives which previously based their security on computational assumptions. These strong implications effectively gave birth to the field of quantum cryptography [START_REF] Bennett | Quantum cryptography: Public key distribution and coin tossing[END_REF][START_REF] Gisin | Quantum cryptography[END_REF][START_REF] Scarani | The security of practical quantum key distribution[END_REF].

Of course, claiming information-theoretic security with the laws of quantum mechanics 1.1. CONTEXT presents an implicit assumption: quantum theory must be an accurate description of the physical world. If this does not hold, the adversary could potentially exploit more general physical theories [START_REF] Barrett | No signaling and quantum key distribution[END_REF][START_REF] Barnum | Local quantum measurement and no-signaling imply quantum correlations[END_REF].

Wiesner illustrated his original paper with two potential applications, of which one was the fabrication of unforgeable quantum money. Simply speaking, quantum money involves a mint, a client, and a bank. The mint encodes a secret classical key into a sequence of two-level quantum states, known as qubits. These are stored in a quantum memory and handed to a client. The sequence of qubit states, along with the quantum storage device, constitute the physical money state, which the client may choose to spend wherever. The secret key specifies the quantum observable in which each qubit is encoded, and is known to the mint and the bank only. In an adversarial scenario, the client may attempt to counterfeit the money (i.e. produce several copies of it) in order to spend more than the initial amount. Thanks to the uncertainty principle and the no-cloning theorem, this is impossible to achieve without disturbing and modifying some of the quantum states in the money state. When a branch of the bank, in possession of the secret key, later verifies the authenticity of the money, inconsistencies with the key will be detected, and the payment will be rejected. Note that, in the classical world, it is always possible for a powerful adversary to duplicate banknotes, passports, signatures, keys and other objects, provided that they have enough time and computational power to reverse-engineer the complex design of such documents. A more formal introduction to quantum money will be provided in Chapter 3.

Wiesner's idea was subsequently used to boost the security of many quantum cryptographic schemes such as key distribution, coin flipping and bit commitment [START_REF] Broadbent | Quantum cryptography beyond quantum key distribution[END_REF]. In particular, the BB84 quantum key distribution protocol from [START_REF] Bennett | Quantum cryptography: Public key distribution and coin tossing[END_REF], along with its many variants, has since thrived as one of the most studied and successfully implemented quantum information applications [START_REF] Scarani | The security of practical quantum key distribution[END_REF][START_REF] Boaron | Secure quantum key distribution over 421 km of optical fiber[END_REF][START_REF] Diamanti | Practical challenges in quantum key distribution[END_REF]. Just like RSA, it allows for two parties to securely establish a secret key over a public, eavesdropped (this time quantum) channel. However, it exhibits the crucial advantage of achieving information-theoretic security, provided the required classical communication is performed over an authenticated channel.

A year only after quantum key distribution was invented, Deutsch defined and formalized the universal quantum computer, namely a device which uses quantum objects to perform computations [START_REF] Deutsch | Quantum theory, the church-turing principle and the universal quantum computer[END_REF]. Noticeably, exploiting quantum resources such as superposition enables quasi-exponential computation speedup over the best known classical algorithms for specific tasks, such as factoring large numbers. When Shor showed how such a hypothetical quantum computer could break specific schemes based on compu-tational assumptions in a very short time [START_REF] Shor | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF], scientists gradually entered a new era: that of constructing schemes which are secure against quantum adversaries. Quantum key distribution, along with most previously mentioned quantum-cryptographic tasks, provide this new, crucial form of security.

We note that, on top of quantum superposition, quantum theory provides a second significant resource for cryptography: entanglement, which Einstein originally qualified as "spooky action at a distance". This phenomenon effectively correlates the properties of two quantum systems at an arbitrary distance, in a way that cannot be explained by classical deterministic models [START_REF] Bell | On the einstein-podolsky-rosen paradox[END_REF]. It helps achieve quantum advantage in tasks involving weak coin flipping [START_REF] Spekkens | A quantum protocol for cheat-sensitive weak coin flipping[END_REF], anonymous message transmission [START_REF] Unnikrishnan | Anonymity for practical quantum networks[END_REF] and alternative forms of quantum key distribution [START_REF] Ekert | Quantum cryptography based on bell's theorem[END_REF]. Crucially, it also provides us with quantum teleportation [START_REF] Bennett | Teleporting an unknown quantum state via dual classical and einstein-podolskyrosen channels[END_REF][START_REF] Unnikrishnan | Authenticated teleportation with one-sided trust[END_REF], which greatly benefits quantum communication networks [START_REF] Wehner | Quantum internet: a vision for the road ahead[END_REF].

Since 2017, a large and collaborative network of European research teams has started to lay the foundations of a quantum internet [START_REF] Wehner | Quantum internet: a vision for the road ahead[END_REF], which would enable any two points on Earth to communicate efficiently and securely thanks to quantum technologies. This ambitious research effort gathers physicists, mathematicians and computer scientists to develop full stack quantum networks, from hardware implementation to compilers and user interface. In order to help such diverse scientists understand each other, an openaccess quantum protocol zoo has also been developed [START_REF]Quantum protocol zoo[END_REF]. This serves as an open-access repository, in which a comprehensive set of quantum primitives and tasks are compactly explained, and the links between them are made explicit. This thesis fits well within the quantum internet framework, as it develops practical security proofs for two pillars of quantum cryptography: quantum money, which protects against the forgery of physical money, and quantum weak coin flipping, which is involved in the construction of many tasks, such as quantum bit commitment and quantum strong coin flipping [START_REF] Chailloux | Optimal quantum strong coin flipping[END_REF][START_REF] Chailloux | Optimal bounds for quantum bit commitment[END_REF]. We rigorously show how information-theoretic security can be achieved with current technology for these two tasks, propose the first implementation for quantum weak coin flipping, and experimentally demonstrate a quantum money protocol for the first time. This is done using practical photonic systems.

Security in practice

Using quantum resources can drastically boost the performance and security parameters of cryptographic tasks, such as secret key rate in key distribution protocols and bias in coin flipping tasks. However, while information-theoretic security is guaranteed in theory through quantum properties, real-world implementation opens a whole new spectrum of 1.1. CONTEXT attacks and loopholes which must be characterized and fixed. This is exactly the focus of this thesis, as it aims to implement quantum money and quantum weak coin flipping protocols in such a way that information-theoretic security is preserved. In general, these practical attacks make use of two major experimental imperfections, noise and losses, which allow the adversary to exploit vulnerabilities in state generation, quantum channels and measurement devices. The performance and security of a quantum protocol with respect to its classical counterpart will therefore crucially depend on the parameters associated with a given experimental setup. In order to highlight this key point, we briefly describe three powerful attacks which may occur in the presence of losses for different quantum-cryptographic tasks. The first attack, which we label the 50/50 card split, relates to practical quantum money schemes, and actually arises from the results in this thesis. The second attack refers to dishonest aborts in protocols such as quantum weak coin flipping, which are also studied in this thesis. The third attack, unambiguous state discrimination, is already well documented [START_REF] Jahma | Unambiguous state discrimination in quantum cryptography with weak coherent states[END_REF], and may occur in quantum key distribution protocols, as well as quantum money schemes.

-The 50/50 Card Split. As previously mentioned, quantum money is a task which guarantees the unforgeability of physical money. We recall that the mint encodes a secret key into a sequence of quantum states, which physically embody the money state, stores it in a quantum memory, and hands it to a client. A dishonest client will be unable to copy the quantum object without partially altering the initial state, since the secret key is unknown to them. Upon verification, a bank will detect changes in the quantum states and conclude whether the money state is authentic or not. Thus, in theory, information-theoretic security is guaranteed by quantum-mechanical properties.

In a lossy implementation, however, the dishonest client may successfully extract twice the amount of money in two different banks without getting caught. This may occur when the honest quantum channel, or the quantum storage device, exhibits 50% losses or more. In this scenario, the client may simply replace the channel with a perfect one, and split the money state in two. They may then send the first half to one bank, and the second to another bank. Since cloning attacks have not been attempted, both banks will validate the money state, as the quantum states have not been altered. The client will then be able to spend twice the amount of money associated with the original state.

It is therefore crucial to upper bound and monitor the losses in any quantum money implementation.

-The Dishonest Abort. Quantum weak coin flipping is a task in which two parties wish to toss a fair coin from a distance without trusting each other. It effectively designates a winner and a loser. One of the parties is therefore very likely to cheat, by attempting to bias the coin in their favor. In a perfect implementation, quantum entanglement allows both parties to agree on an outcome without needing to simultaneously broadcast their respective bits. A clever protocol structure then prevents the dishonest party from biasing the outcome of the flip above a certain threshold. In the presence of losses, however, this security property may very quickly break down: in order to account for the potential loss of the quantum state, the notion of abort must be introduced in the protocol. When both parties are honest, this gives a third possible outcome to the coin flip, in which no one wins or loses. When one of the parties is dishonest, however, they can choose to falsely declare the loss of their quantum state, and hence force an abort, whenever the outcome of the coin flip designates them as the loser. In this case, it may be claimed that the protocol performs strictly better than classically provided that the losses do not exceed a specific threshold. When these become too important, a classical coin flipping protocol may actually perform better than the quantum protocol.

-Unambiguous State Discrimination (USD). This attack was originally studied in the context of quantum key distribution [START_REF] Jahma | Unambiguous state discrimination in quantum cryptography with weak coherent states[END_REF], in which two parties wish to establish a common secret key by communicating through a public quantum channel. An eavesdropper may intercept and measure each transmitted quantum state, in such a way that they can unambiguously discriminate a fraction of the states sent. An extra measurement "don't know" outcome is output for the remaining states that were not discriminated. In an ideal world, this attack can be detected by the two communicating parties since the "don't know" outcome limits to the amount of information that the adversary may retrieve about the key. In a lossy implementation however, the two honest parties will expect and tolerate a specific amount of losses due to their imperfect setup. The eavesdropper may then replace the lossy channel by a perfect one, perform a USD attack, and replace all states which they didn't manage to discriminate with losses [START_REF] Jahma | Unambiguous state discrimination in quantum cryptography with weak coherent states[END_REF]. In this way, the two parties do not record any errors, but simply losses which they discard from the final secret key. This attack also applies to quantum money, as described in this thesis.

When transitioning from ideal to practical protocols, these three examples highlight the need for new security proofs which are specifically targeted towards imperfect experimental setups. The core work in this thesis deals with such types of security analyses for quantum money schemes and quantum weak coin flipping schemes.

THESIS RESULTS

Thesis results

Outline

This thesis is split into two introductory chapters, four original research chapters, and one conclusion chapter. Two of the four research chapters are devoted to theoretical results, while the two others are devoted to experimental results.

Chapter 2 introduces the main technical tools required in this thesis. We first describe the mathematical framework and quantum resources which enable the construction of quantum protocols. We then introduce the basic concepts of semidefinite programming, which allow to derive both analytical and numerical results throughout the thesis. We finally explore the areas of quantum optics which are relevant to the implementation of both quantum money and quantum weak coin flipping protocols.

Chapter 3 introduces the foundations of quantum cryptography. We first explain how fundamental quantum properties can drastically improve the security of some cryptographic tasks. We then illustrate this with three protocol sections: quantum money, quantum key distribution and quantum coin flipping. The first and third sections provide functionality classifications which are crucial to the understanding of this thesis.

Chapter 4 describes the practical security analysis and proof-of-principle implementation of an unforgeable quantum credit card scheme, assuming a trusted payment terminal. We first show how to transition from the abstract two-dimensional security framework to a practical, infinite-dimensional one. We then provide a fibered experimental demonstration, using polarization-encoded weak coherent states of light at telecom wavelengths. The implementation is labeled "proof-of-concept" as it does not involve a quantum storage device, which is a key requirement in quantum credit card schemes.

Chapter 5 derives a practical and rigorous security analysis which deals with both trusted and untrusted terminals in quantum credit card schemes. We first highlight that the work from Chapter 4 does not account for all loss-dependent attacks, and that it assumes a trusted payment terminal. We then derive a new framework which allows to derive a more general security proof without requiring such assumptions. We do this by incorporating experimental parameters directly into a convex optimization framework.

By using the duality of semidefinite programs, we finally show that an adversary cannot better cheat by correlating the states in the credit card.

Chapter 6 builds upon the theoretical results from Chapter 5 to propose a secure demonstration of a credit card scheme with genuine quantum storage. We first de-CHAPTER 1. INTRODUCTION scribe the experimental setup for the trusted terminal scheme. This involves storing polarization-encoded weak coherent states of light in a cold atomic cloud, through the creation of electromagnetically-induced transparency (EIT). We then expose the new security issues which arise from the use of such an imperfect storage device, and clearly state the post-selection assumptions which are made.

Chapter 7 provides the first implementation proposal for quantum weak coin flipping.

We start by introducing the primitive and explaining why proposing an experimental setup for such a protocol is non-trivial. We then present a linear-optical implementation consisting of a single photon and three beamsplitters only. We derive the corresponding security proof in the presence of noise and losses, and show that protocol is implementable over a few kilometers of lossy optical fiber. Finally, we investigate a possible extension to lower both parties' cheating probabilities.

Chapter 8 provides a general discussion of the main thesis results and future perspectives. We sum up the key ideas from each research chapter, and describe how they fit within the larger quantum internet framework. We finally discuss major unsolved challenges.

Publications

The results from Chapters 4 and 5 were respectively published in the following articles:

• [START_REF] Bozzio | Experimental investigation of practical unforgeable quantum money[END_REF] Experimental investigation of practical unforgeable quantum money, M. Bozzio, A. Orieux, L.T. Vidarte, I. Zaquine, I. Kerenidis and E. Diamanti, npj Quantum Information, 4, 5 (2018).

• [START_REF] Bozzio | Semi-device-independent quantum money with coherent states[END_REF] Semi-device-independent quantum money with coherent states, M. Bozzio, E. Diamanti and F. Grosshans,

Physical Review A, 99, 022336 (2019).

Some theoretical results from Chapter 6 were also published in [START_REF] Bozzio | Semi-device-independent quantum money with coherent states[END_REF], although most of this work is currently in progress. The manuscript associated with Chapter 7 is in preparation:

• Quantum weak coin flipping with a single photon. This is joint work with E. Diamanti, I. Kerenidis

First resource: quantum coherence

The physical state of a quantum system may be described by a single vector, or wavefunction |ψ〉, living in a complex Hilbert space H . The Hermitian conjugate of such a vector is denoted by 〈ψ|. When all the information about the physical system can be contained in such vector form, the system is said to lie in a pure quantum state, which may be expressed as:

|ψ〉 = N k=1 c k |ψ k 〉 , (2.1)
where {c k } are complex coefficients and the vectors {|ψ k 〉} form an orthonormal basis for the N-dimensional Hilbert space H . Pure quantum states may always be expressed as a linear superposition, referred to as quantum superposition. When a measurement is performed on the system, the state is said to collapse to one of the |ψ k 〉 states with probability |c k | 2 . The state |ψ〉 must therefore be normalized to ensure N k=1 |c k | 2 = 1. One pure quantum state of interest is the two-dimensional qubit state, which allows to encode a classical information bit into a physical system, and takes the following general form:

|ψ〉 = α |0〉 + β |1〉 , (2.2)
with (α, β) ∈ C 2 and {|0〉 , |1〉} spanning a 2-dimensional Hilbert space.

An observer may sometimes lack some information about the state of a system, in which case the vector representation becomes insufficient. This usually occurs when the system of interest is a subsystem of a larger system with unknown degrees of freedom.

Since the probabilistic behaviour of the state which arises from the observer's lack of knowledge cannot be distinguished from the inherent probabilistic nature of quantum superposition described in (2.1), a new formalism is required to describe such mixed quantum states : the density matrix. Given a collection of pure quantum states {|ψ k 〉}, one possible expression for a mixed state's density matrix ρ is given by:

ρ = N k=1 p k |ψ k 〉 〈ψ k | , (2.3)
where p k is the probability, arising from classical statistics, that the system lies in pure state |ψ k 〉. The density matrix is positive semidefinite, and satisfies T r(ρ) = 1 to ensure that N k=1 p k = 1, as well as T r(ρ 2 ) = 1 if the quantum state is pure. For general mixed states, 0 T r(ρ 2 ) < 1. Let us now write the density matrix for the general qubit state presented in (2.2) in the {|0〉 , |1〉} basis:

ρ = |ψ〉 〈ψ| = |α| 2 α * β β * α |β| 2 .
(2.4)

This explicit expression for the qubit density matrix allows to identify T r(ρ) = 1, and interpret the diagonal terms |α| 2 and |β| 2 as the probabilities of measuring the system in pure states |0〉 〈0| and |1〉 〈1|, respectively. Other terms of interest are the off-diagonal terms, which play a crucial role in quantum information theory as they identify the quantum coherence of the state. This property is the first essential resource in quantum cryptography and computing, as it is an inherently quantum feature. We will detail its applications in further sections. When the coherent terms are zero, the state becomes an entirely classical state in the studied basis. For real a and b, the state given by:

σ = a 0 0 b (2.5)
may indeed not be written in the coherent superposition form of (2.1) in the {|0〉 , |1〉} basis, which implies no quantum feature. Such a density matrix may correspond to the output of an uncharacterized source for instance, which produces the states |0〉 〈0| or |1〉 〈1| with probabilities a and b respectively. We note, however, that this state may present quantum features when expressed in another basis.

It is worth noting that the density matrix of any mixed qubit state may be expanded in a specifically convenient basis as:

ρ = 1 2 1 + b x σ x + b y σ y + b z σ z , (2.6)
where {b x , b y , b z } are known as the coordinates of the Bloch vector b, 1 denotes the identity over the 2-dimensional Hilbert space, and the three traceless Hermitian Pauli matrices read:

σ x = 0 1 1 0 σ y = 0 -i i 0 σ z = 1 0 0 -1 . (2.7)

Second resource: quantum entanglement

The second crucial resource of quantum information is quantum entanglement, which arises when considering composite Hilbert spaces and multi-partite quantum states (shared between different parties). This property is a fundamental resource of quantum communication in that it allows to engineer and exploit correlations between distant states that cannot occur in the classical world. This enables to teleport quantum states across networks for instance, in which case classical communication and local quantum operations only are required to retrieve the state at the given destination [START_REF] Bennett | Teleporting an unknown quantum state via dual classical and einstein-podolskyrosen channels[END_REF]. This avoids the problem of sending quantum information through quantum channels to distant parties, where losses and errors inevitably occur as the quantum state interacts with its environment. It also provides the foundation of security for some quantumcryptographic protocols such as quantum key distribution (Section 3.3) and quantum coin flipping (Section 3.4).

More formally, let us consider a general pure quantum state |ψ (N) 〉 living in Hilbert space H = N i=1 H i , composed of N subsystems. The state is said to be a product state if it can be expressed in the following factorizable form:

|ψ (N) 〉 = N i=1 |ψ i 〉 , (2.8)
where {|ψ i 〉} is a pure state living in H i . When |ψ (N) 〉 may not be expressed in such a form, the state is said to be entangled. In this case, it may only be expressed as a coherent superposition of product states, and the partial trace over one subsystem is a mixed state. Similarly, a mixed quantum state ρ (N) , living in Hilbert space

H = N i=1 H i CHAPTER 2. PRELIMINARIES
and composed of N subsystems {ρ i }, is said to be separable if it can be expressed as the following classical mixture of product states:

ρ (N) = L k=1 m k N i=1 ρ i,k , (2.9)
where L k=1 |m k | 2 = 1. When it cannot be expressed in such a form, the mixed state is said to be entangled.

In order to gain insight into why quantum entanglement is a resource that cannot be retrieved with classical physics alone, we briefly introduce a famous thought experiment, linked to the Bell inequalities [START_REF] Bell | On the einstein-podolsky-rosen paradox[END_REF]. Setting aside quantum theory for a moment, let us consider a party Charlie, who can repeatedly (and identically) produce two particles: the first is sent to Alice, while the second is sent to Bob. At a pre-agreed time, both parties measure a property of their particle: Alice flips a coin to decide whether she measures observable A 1 or A 2 , while Bob flips a coin to decide whether he measures B 1 or B 2 . The set of observables {A 1 , A 2 , B 1 , B 2 } can take values ±1. They repeat the experiment a large number of times, and, at the end, compute the value of the following sum of expectation values:

E(A 1 B 1 ) + E(A 2 B 1 ) + E(A 2 B 2 ) -E(A 1 B 2 ).
Classical mechanics is a realist theory, in which physical properties have definite values independently of whether they are observed or not. It is also a local theory, in that the measurement that Alice makes on her particle should not influence the measurement that Bob makes on his particle. Under such assumptions, it can be shown that [START_REF] Bell | On the einstein-podolsky-rosen paradox[END_REF][START_REF] Clauser | Proposed experiment to test local hidden-variable theories[END_REF]:

E(A 1 B 1 ) + E(A 2 B 1 ) + E(A 2 B 2 ) -E(A 1 B 2 ) 2.
(2.10)

Let us now attempt this experiment with quantum particles. Strikingly, if Charlie sends pairs of particles described by the following entangled quantum state:

|ψ -〉 = 1 2 (|0〉 A ⊗ |1〉 B -|1〉 A ⊗ |0〉 B ) , (2.11)
and Alice and Bob perform measurements in two different bases such that:

A 1 = σ z A 2 = σ x B 1 = - 1 2 (σ z + σ x ) B 2 = 1 2 (σ z -σ x ) , (2.12)
then it is possible to violate the upper bound from Eq. (2.10) [START_REF] Clauser | Proposed experiment to test local hidden-variable theories[END_REF]:

E(A 1 B 1 ) + E(A 2 B 1 ) + E(A 2 B 2 ) -E(A 1 B 2 ) = 2 2 .
(2.13)

MATHEMATICAL FRAMEWORK

This surprising result shows that either one or both assumptions of realism and locality must be dropped if quantum mechanics is correct. The violation of this inequality, and hence the confirmation that quantum mechanics is complete without local realism, was experimentally demonstrated in [START_REF] Aspect | Experimental realization of einsteinpodolsky-rosen-bohm gedankenexperiment: a new violation of bell's inequalities[END_REF].

In quantum information, the maximally-entangled Bell states, composed of two subsystems A and B, play a significant role:

|ψ + 〉 = 1 2 (|0〉 A ⊗ |1〉 B + |1〉 A ⊗ |0〉 B ) |ψ -〉 = 1 2 (|0〉 A ⊗ |1〉 B -|1〉 A ⊗ |0〉 B ) |φ + 〉 = 1 2 (|0〉 A ⊗ |0〉 B + |1〉 A ⊗ |1〉 B ) |φ -〉 = 1 2 (|0〉 A ⊗ |0〉 B -|1〉 A ⊗ |1〉 B ) .
(2.14)

For such bipartite states, the reduced state of each subsystem is the maximally mixed state 1/2. This means that the joint system has a well-defined state, but no information can be gained by looking at each subsystem on its own. This can be mathematically derived by considering the partial trace over one system. Considering Hilbert space

H A ⊗ H B ,
where {|a i 〉} is the basis for the first space and {|b i 〉} for the second space, any bipartite quantum state ρ (AB) may be expressed as:

ρ (AB) = i jkl c i jkl |a i 〉 〈a j | ⊗ |b k 〉 〈b l | . (2.15)
The partial trace over system A and over system B are then respectively defined as:

Tr A (ρ (AB) ) = i jkl c i jkl |b k 〉 〈b l | 〈a j |a i 〉 , Tr B (ρ (AB) ) = i jkl c i jkl |a i 〉 〈a j | 〈b l |b k 〉 .
(2.16)

For bipartite entangled states, this operation allows to derive the reduced density matrix of one subsystem by tracing over the other subsystem. We may then confirm that:

T r A |ψ + 〉 〈ψ + | = T r A |ψ -〉 〈ψ -| = T r A |φ + 〉 〈φ + | = T r A |φ -〉 〈φ -| = 1 B 2 . T r B |ψ + 〉 〈ψ + | = T r B |ψ -〉 〈ψ -| = T r B |φ + 〉 〈φ + | = T r B |φ -〉 〈φ -| = 1 A 2 .
(2.17)

Quantum measurements

Any quantum observable is described by a Hermitian operator A, whose set of real eigenvalues describes the set of possible measurement outcomes. For each eigenvalue, the associated eigenstate gives the quantum state onto which the system collapses after it is measured. As the outcome of the measurement is probabilistic, the expectation value < A > of the measurement of observable A repeated over infinite identical copies of state ρ can be computed using:

< A >= T r(ρ A).
(2.18)

As an example, the Pauli matrices introduced in (2.7) may be used to describe observables such as photon polarization and particle spin. The expectation values for the measurement of the x, y or z-components of a polarization or spin state ρ are then given by T r(σ x ρ), T r(σ y ρ) and T r(σ z ρ) respectively.

One specific type of measurement is the projective measurement. It is described by a set of operators P = {P m } m=1...n , whose number of elements n is smaller or equal to the dimension of the Hilbert space. The projectors satisfy the following conditions:

       (i) P m P m = δ mm P m projectivity (ii) m P m = 1 completeness (iii) P m 0 semidefinite positivity (2.19)
Note that, when the projectors are rank 1, diagonalizing observable A allows to decompose it into the projectors on the different subspaces:

A = m e m P m , (2.20)
where P m is the projector onto the subspace associated with eigenvalue e m , and the probability p(m) of measuring outcome m given state |ψ〉 is given by:

p(m) = 〈ψ|P m |ψ〉 , (2.21)
while the post-measurement state then simply reads:

P m |ψ〉 p(m) . (2.22)
Such projective measurements are interesting, since their outcome may be determined with a single measurement on a pure state. However, a transition towards a more Finally, we define the commutator associated with two quantum observables A 1 and

A 2 : [A 1 , A 2 ] = A 1 A 2 -A 2 A 1 .
(2.23)

As we shall see in Chapter 3, one founding principle of quantum security is based on the fact that some quantum observables do not commute: A 1 and A 2 cannot be measured simultaneously when their commutator [A 1 , A 2 ] = 0.

Quantum operations

A quantum operation is a linear map Λ which takes a quantum state ρ 1 living in Hilbert space H 1 to another quantum state ρ 2 living in H 2 . In order for such a map to be physical (i.e. mapping a quantum state to another quantum state), it must satisfy the following conditions:

• Complete positivity: from Section 2.1.1, a density matrix ρ is positive semidefinite, and this must remain true when map Λ is only applied to a subsystem of this density matrix.

• Trace preservation (or trace decrease): from Section 2.1.1, a density matrix has unit trace, and this must be preserved (or decreased) at the output of the map.

Quantum operations may be expressed in matrix form. Kraus' theorem states that any such quantum operation may be decomposed in terms of Kraus operators {K i }, satisfying i K † i K i 1, as:

Λ(ρ) = i K i ρ 1 K † i . ( 2

.24)

A unitary operation on Hilbert space H is an operation which preserves the inner product, i.e. an operation which admits a single Kraus operator U in its decomposition, and for which:

U † U = UU † = 1. ( 2
|Φ + 〉 〈Φ + | = d i, j=1 |i〉 〈 j| ⊗ |i〉 〈 j| . (2.26)
We introduce a completely positive linear map Λ :

H d 1 → H d 3 ,
and define the Choi-Jamiołkowski operator J(Λ) :

H d 1 ⊗ H d 2 → H d 3 ⊗ H d 2 as
the operator which applies Λ to the first half of the maximally entangled state |Φ + 〉 〈Φ + |:

J(Λ) = d i, j=1 Λ(|i〉 〈 j|) ⊗ |i〉 〈 j| .
(2.27)

Choi's theorem then states that Λ is completely positive if and only if J(Λ) is positive semidefinite. This is obvious for the Λ → J(Λ) way of the equivalence, since Λ is applied only to a subsystem of |Φ + 〉 〈Φ + |, and we want the output state to remain a density matrix.

We also have that Λ is a trace-preserving map if and only if Tr [START_REF] Molina | Optimal counterfeiting attacks and generalizations for wiesner's quantum money[END_REF][START_REF] Watrous | Semidefinite Programming[END_REF][START_REF] Vandenberghe | Semidefinite programming[END_REF]. A physical interpretation of this equivalence arises from the fact that |Φ + 〉 is a maximally entangled state. Then, from Section 2.1.2, the partial trace over one subystem must yield the maximally mixed state on the other. These properties are implemented as constraints in the optimization problems from Chapter 5.

H d 3 (J(Λ)) = 1 H d 2

Semidefinite programming

In this section, we briefly introduce the terminology and field of semidefinite programming from a quantum-information perspective. The techniques presented here will be extensively used in Chapters 5 and 7, for the derivation of both analytical and numerical 2.2. SEMIDEFINITE PROGRAMMING bounds. For a more complete study, the lecture notes from [START_REF] Watrous | Semidefinite Programming[END_REF] provide a simple introduction to the field, while the book from [START_REF] Vandenberghe | Semidefinite programming[END_REF] allows a deeper understanding of general convex optimization.

Convex cone

As emphasized in Section 2.1.1, quantum theory heavily relies on linear algebra. In quantum cryptography, security analyses often involve optimizing over semidefinite positive objects to find the adversary's optimal cheating strategy. Most of the time, these objects are density matrices, measurement operators, or more general CPTP maps.

Semidefinite programming provides a suitable framework for this, as it allows to optimize over semidefinite positive variables, given linear constraints.

More formally, positive semidefinite matrices belong to the convex cone C . This is a subset, closed under linear operations with positive ordered coefficients, of a larger vector space V . In other words, any operators X and Y in C satisfy:

X , Y ∈ C ⇒ αX + βY ∈ C , (2.28)
for positive scalars α and β. Note that C is not bounded due to the scaling of α and β.

We now define an affine slice A , which is the subset of matrices Z of a general vector space V which satisfy:

Z ∈ A ⇒ Λ(Z) = C, (2.29)
given a linear map Λ and operator C ∈ V . Semidefinite programming optimizes convex functions over all operators which lie in the intersection of an affine slice (i.e. satisfying a specific linear constraint) with the convex cone (i.e. the set of positive semidefinite matrices).

Primal problem

A semidefinite program may be defined as a triple (Λ, F, C) where Λ is a Hermitianpreserving CPTP map, and F and C are Hermitian operators living in complex Hilbert spaces H F and H C , respectively.

We start by defining a maximization problem, which will serve as our primal problem.

The primal problem maximizes a primal objective function, Tr F † X , over all positive semidefinite variables X , given a set of linear constraints expressed as a function of C:

maximize Tr F † X s.t. Λ(X ) = C X 0.
(2.30)

Any operator X which satisfies these constraints is said to be primal feasible, and thus belongs to the following primal feasible set :

S p = X ∈ H F | X 0, Λ(X ) = C . (2.31)
We define the primal optimal value s p as the supremum over all values taken by the objective function for X ∈ S p :

s p = su p Tr F † X | X ∈ S p , (2.32)
Note that when there is no feasible solution, the optimal value may be +∞. If the optimal value can be reached, the primal optimal solution is the operator X p for which the objective function achieves this optimal value.

Dual problem

Semidefinite programs present an elegant dual structure, which associates a dual minimization problem to each primal maximization problem. Effectively, the new variable(s)

of the dual problem may be understood as the Lagrange multipliers associated with the constraints of the primal problem (one for each constraint).

Let us start by re-writing problem (2.30) in the following standard form, where max and min are short for maximize and minimize (i.e. search for a supremum or infimum over the set, respectively):

max X 0 Tr F † X s.t. Λ(X ) -C = 0. ( 2
Y Tr F † X -Tr (Λ(X ) -C) † Y s.t. Y = Y † .
(2.34)

We now re-order this expression in order to isolate a term which depends on Y only:

Tr F † X -Tr (Λ(X ) -C) † Y = Tr F † X -Tr Λ † (X )Y + Tr C † Y = Tr F † X -Tr X † Λ * (Y ) + Tr C † Y = Tr F -Λ * (Y ) † X + Tr C † Y , (2.35)
where Λ * is the unique adjoint map of Λ, i.e. the map which satisfies: (F -Λ * (Y )) 0. Without this constraint, the maximization would become trivial, as one could always make Tr (F -Λ * (Y )) † X tend to infinity by picking X large enough, which would always yield an optimal value of +∞. We may finally write the dual problem associated with (2.30) as:

Tr Λ † (X )Y = Tr X † Λ * (Y ) . ( 2
minimize Tr C † Y s.t. Λ * (Y ) -F 0 Y = Y † .
(2.37)

Similarly to the primal problem, we have that any Hermitian operator Y which satisfies these constraints is said to be dual feasible, and thus belongs to the following dual feasible set:

S d = Y ∈ H C | Y = Y † , Λ * (Y ) -F † 0 . (2.38)
We define the dual optimal value s d as:

s p = in f Tr C † Y |Y ∈ S d , (2.39)
and the optimal solution is the operator X s which allows to achieve this solution. Note that there may be no feasible solution, and in that case, the optimal value can be -∞.

Weak and strong duality

The Lagrange multiplier method allows to find the local extremum of a constrained function. The optimal value s p of the primal problem therefore upper bounds the optimal value s d of the dual problem, while the optimal value of the dual lower bounds that of the primal. This property is known as weak duality, and may be simply expressed as:

s p s d . (2.40)
In many quantum-cryptographic applications however, we wish to ensure that the upper bound derived in the primal problem is tight, i.e. that the local maximum is in fact a global maximum for the objective function. The dual problem will help to prove this when there exists strong duality:

s p = s d . (2.41)
We will encounter concrete examples of how to apply theses methods in Chapters 5 and 7.

Quantum optics

Quantum states of light

In quantum cryptography, information is often encoded onto single photon states and other weak-intensity states of light, which cannot be simply described by the wavelike picture: the electromagnetic field must be quantized. For this purpose, we introduce the creation operator a † and annihilation operator a, which express the creation and destruction of a photon in the electromagnetic field, respectively. Their action can be explicited by considering the Fock states (or photon number states), labeled {|n〉} n=0→∞ .

These are eigenstates of the quantum harmonic oscillator of frequency ω, whose energy levels are described by the following Hamiltonian: .42) In this picture, the action of a † and a can be interpreted as increasing and lowering the number of photons in the quantum field:

H = ω a † a + 1 2 . ( 2
2.3. QUANTUM OPTICS a † |n〉 = n + 1 |n + 1〉 a |n〉 = n |n -1〉 (2.43)
Note that the action of the annihilation operator on the vacuum state |0〉 gives the zero vector in the given Hilbert space. While the vacuum state should definitely not be confused with the zero vector, applying the annihilation operator on such a state yields the zero vector since no photon can be subtracted from the quantum vacuum. The vacuum state materializes the lowest possible non-zero energy state of the quantum field, which interestingly still presents a fundamental constant energy of value ω 2 :

H |0〉 = ω 2 |0〉 (2.44)
We now have a framework which allows the description of single photon states. For practical reasons however (see Chapters 4 and 6), we may also want to encode quantum information onto coherent states, which can be easily produced by laser sources. Such states may be expressed in the infinite Fock state basis as as a function of their amplitude α:

|α〉 = e -|α| 2 2 e αa † |0〉 = e -|α| 2 2 ∞ n=0 α n n! |n〉 . (2.45)
It is important to note that this expression describes classical states very well: increasing the amplitude α shifts the peak of the probability distribution to higher number Fock states. At very low amplitudes, however, coherent states are a good candidate to encode quantum information, as they can be reduced to mostly the 0 and 1-photon components, thus mimicking a qubit and a third vacuum dimension.

Linear optics

A linear optical circuit consists of a sequence of unitary operations which preserve the input photon number. The protocols that we implement in this thesis heavily rely on linear optical elements. Here, we introduce the beam-splitter (BS) and polarizing beamsplitter (PBS) transformations, as the well as the phase shift (PS), half wave-plate (HWP)

and quarter wave-plate (QWP) transformations.

The BS transformation is the basic component of interferometers, and may also be used to create the two fundamental resources from Section 2.

a † 1 → r a † 3 + t a † 4 , a † 2 → t a † 3 -r a † 4 .
(2.46)

The PBS operation allows to perform a projective polarization measurement: in a given {|0〉 , |1〉} polarization basis, a |0〉-polarized photon will be transmitted, while the orthogonally |1〉-polarized photon will be reflected.

The PS operation simply introduces a φ phase-shift on one of the components of the incoming photonic state. Its action on the creation operators a † 1 and a † 2 , associated with two orthogonal components of the input optical mode, reads:

a † 1 → a † 1 , a † 2 → e iφ a † 2 .
(2.47)

The HWP operation transforms any linear polarization state (a superposition of |0〉 and |1〉 with real coefficients, up to global complex phase) into another linear polarization state. This operation may be realized by sending the photon through an anisotropic crystal, which essentially produces a ±π phase shift on one of the polarization components.

This will change the input linear polarization vector to its symmetric with respect to one of the crystal's axes. In terms of creation operators for the two polarization modes a † H and a † V , its action on an input polarization state rotated by an angle θ from the main crystal axis reads:

a † H → cos 2θ a † H + sin 2θ a † V , a † V → sin 2θ a † H -cos 2θ a † V .
(2.48)

The QWP operation transforms linear polarization states into circularly-polarized states (a ±π/2 relative phase between the |0〉 and |1〉 components, up to global complex phase). In terms of creation operators a † H and a † V , its action on the input polarization state, rotated by an angle θ from the main crystal axis, then reads:

a † H → cos 2 θ -i sin 2 θ a † H + (1 + i) cos θ sin θ a † V , a † V → (1 + i) cos θ sin θ a † H + sin 2 θ -i cos 2 θ a † V .
(2.49)

QUANTUM OPTICS

Note that the action of HWP and QWP on the input polarization vector, along with any arbitrary waveplate transformation, may be derived by:

• Expressing the input polarization in the basis described by the crystal's axes.

• Applying the desired phase-shift to one of the components.

• Re-expressing the transformed state back into the original polarization basis.

EIT and slow light

In order to fully demonstrate the quantum money scheme in Chapter 6, we use Electromagnetically Induced Transparency (EIT). This scheme creates and exploits the destructive interference process that occurs between two transitions in a Λ-type atomic system, such as the one presented in Fig. 2.1. The quantum information is effectively stored in the collective excitation of a cloud of cold atoms: the group velocity of the incident light in the cloud is considerably reduced, whilst a transparency window is created which results in no photon absorption. While there exist other mechanisms for light storage in atomic ensembles, such as photon echo schemes [START_REF] Chanelière | Quantum optical memory protocols in atomic ensembles[END_REF], or using other platforms like single emitters [START_REF] Specht | A single-atom quantum memory[END_REF][START_REF] Maurer | Room-temperature quantum bit memory exceeding one second[END_REF], here we simply provide theoretical intuition for how to create EIT in a cloud of atoms. Note that a more complete derivation of the dark state phenomenon may be found in [START_REF] Lambropoulos | Fundamentals of Quantum Optics and Quantum Information[END_REF], while a thorough interpretation of slow light can be found in [START_REF] Keeling | Light-Matter Interactions and Quantum Optics[END_REF].

We provide a semi-classical treatment of the dynamics of the Λ-system, displayed in Fig. 2.1: the three-level atomic system is treated as a fully quantum system, while the incident electromagnetic fields are treated as classical waves. We assume that the |1〉 → |2〉 transition is forbidden. For simplicity, we neglect the decay rates from the upper level to the lower levels caused by spontaneous decays and dephasing, as well as the decays in the two ground levels.

The total Hamiltonian describing the time evolution of the driven system may be written as a sum of the constant unperturbed atomic Hamiltonian H a , and the interaction Hamiltonian H i (t), which describes the dynamics due to the interaction with the electromagnetic fields:

H(t) = H a + H i (t) (2.50)
Considering the eigenbasis {|1〉 , |2〉 , |3〉}, with energy eigenvalues ω 1 , ω 2 , and ω 3 , respectively, allows to express the unperturbed atomic Hamiltonian as: transition.

H a = ω 1 |1〉 〈1| + ω 2 |2〉 〈2| + ω 3 |3〉 〈3| . ( 2

.51)

Let us now derive a simple expression for the interaction Hamiltonian. In order to store and retrieve quantum information from a Λ-type system, the presence of two electromagnetic fields is required. The first one, which we call the signal field, is a weak electromagnetic field which drives the |1〉 → |3〉 transition. In our experiment, this field actually contains the quantum information that we wish to store. The second one is labelled the control field, and drives the |2〉 → |3〉 transition. It is a much stronger field which allows to steer the Λ system such that the quantum information from the signal field is mapped onto the atomic state, and then retrieved.

We first assume that the wavelength λ of the incident light is much larger than the radius of the atom. This assumption, known as the dipole approximation, allows us to discard the spatial part of the incident electric fields. The total electric field applied on the atom is then the sum of the signal and control fields, which oscillate with angular frequency ω s and ω c and amplitudes E s and E c , respectively:

E(t) = E s cos (ω s t) + E c cos (ω c t).
(2.52)

QUANTUM OPTICS

We now define the dipole moment, which occurs when the center of the total positive charge and the center of the total negative charge do not spatially overlap. Assuming that the total atomic dipole moment D is aligned with the electric field E allows to write the interaction Hamiltonian, defined as H i (t) = -D • E(t), in the following way:

H i (t) = -e rE(t), (2.53)
where E(t) = E s cos (ω s t) + E c cos (ω c t). The larger the distance between the center of the positive and negative charges, described by r, the higher the dipole moment. As in many three-level systems, an interesting feature is that the dipole transition |1〉 → |2〉

is forbidden due to the specific selection rules of the physical system. This will be of use to create EIT, and implies that the elements of r associated with this transition satisfy r 12 = r 21 = 0. Furthermore, we assume no permanent dipole on the atom, which is true for atoms such as Rubidium, and implies r 11 = r 22 = r 33 = 0. This allows a simple expression of the interaction Hamiltonian from Eq. (2.53):

H i (t) = -eE(t) (r 13 |1〉 〈3| + r 23 |2〉 〈3| + cc.) (2.54)
We now apply a unitary transformation U i (t) to H i (t), which allows to work in the interaction picture:

U i (t) = e iω 1 t |1〉 〈1| + e iω 2 t |2〉 〈2| + e iω 3 t |3〉 〈3| (2.55) This picture allows both the states and the operators to carry a time-dependence. We may then express the cosines from E(t) in their exponential form and expand out all terms from U i H i U † i (t), which can be gathered in fast and slow-rotating terms. Since the signal field drives the |1〉 → |3〉 transition, the fast-rotating terms are those which contain the expression e -i(ω 1 -ω 3 +ω s )t , since ω 1 -ω 3 + ω s ≈ 2ω s . One the other hand, the terms which contain the expression e -i(ω 1 -ω 3 -ω s )t rotate very slowly since, ω 1 -ω 3 -ω s ≈ 0. So we may use the rotating wave approximation to discard the fast-rotating terms, as these evolve much faster than the dynamics we are interested in. Applying a similar reasoning to the control field and the |2〉 → |3〉 transition allows to drop the other fast-rotating terms containing the expression e -i(ω 2 -ω 3 +ω c )t . We then apply the unitary U i (t) again to transform back to the original picture. The new interaction Hamiltonian may then be written: This unitary may be expressed as:

H i (t) = - 1 2 e
U(t) = e -iφ s e -iω s t | 1〉 〈1| + e -iφ c e -iω c t | 2〉 〈2| + | 3〉 〈3| . (2.59)
The transformed Hamiltonian H(t) must still satisfy the Schrödinger equation, which governs the dynamics of all quantum systems:

H | k〉 = i ∂ ∂t | k〉 = i ∂ U ∂t U † + U H U † | k〉 . (2.60)
where | k〉 ∈ {| 1〉 , | 2〉 , | 3〉}. Solving Eq. (2.60) for H allows to derive the final time-independent expression for H in the co-rotating basis. We express this in matrix form so that the significance of each matrix element is clear:

H = 2     2(ω 1 + ω s ) 0 -Ω s 0 2(ω 2 + ω c ) -Ω c -Ω s -Ω c 2ω 3     (2.61)
In order to explain the EIT process, we now give the energy eigenvalues and their corresponding eigenvectors for the interaction component of this full Hamiltonian (the unperturbed Hamiltonian only shifts the eigenvalues by the intrinsic energy of the atomic levels):

E ± = ± Ω 0 |Ψ ± 〉 = Ω s | 1〉 + Ω c | 2〉 ∓ Ω 0 | 3〉 2 Ω 0 (2.62)
Figure 2.2: Real and imaginary parts of first-order susceptibility χ (1) . These are plotted as a function of signal detuning ∆. The real part of χ (1) corresponds to the dispersion profile of the medium, while the imaginary part corresponds to the absorption profile. The red dotted lines indicate the profiles without the presence of a control field, and the solid black lines indicate the new profiles when the control beam is applied. All units are arbitrary.

E d = 0 |Ψ d 〉 = Ω s | 1〉 -Ω c | 2〉 Ω 0 (2.63)
where we define Ω 0 = Ω 2 s + Ω 2 c . Eq. (2.63) shows that one of the interaction Hamiltonian's eigenstates, which we label |Ψ d 〉, is not coupled to the third state by the incident field. Any population decaying from the excited state to the |Ψ d 〉 state will therefore remain trapped, without ever getting excited back to the third state. Such a state is known as a dark state, as it cannot interact with light and so does not present any photon absorption: transparency has effectively been induced by applying two near-resonant fields to the three-level system. From Eq. (2.63), it is also evident that slowly turning off the control field (i.e. Ω c → 0) causes the dark state to slowly evolve towards the | 2〉 state.

When the information must be retrieved, the control field is switched back on such that the state | 3〉 is coupled to the light field again. This process is responsible for the storage and retrieval of quantum information.

We now turn to a more optical interpretation of EIT in a cloud of N cold atoms, each bearing the same Λ-type structure. Here, the response of the atomic ensemble to the incident electric field can be characterized by its first-order susceptibility χ (1) , which is a dimensionless proportionality constant describing the extent to which the medium polarizes due to the presence of an electric field:

29 CHAPTER 2. PRELIMINARIES χ (1) = N V |d 31 | 2 0 i i∆ + γ 21 i∆ + γ 31 i∆ + γ 21 + Ω 2 s (2.64)
where ∆ = ω 1 -ω 3 -ω s is the signal detuning, d 31 is the dipole moment for the |3〉 → |1〉 transition, γ i j is the decoherence rate for the |i〉 → | j〉 transition, and V is the volume occupied by the N atoms. As shown in Fig. 2.2, plotting the real part of χ (1) as a function of ∆ provides the dispersion profile of the medium, while the imaginary part provides the absorption profile. The effects of the creation of a dark state are therefore explicited:

the absorption can be decreased significantly around zero detuning, which explains the transparency effect. Furthermore, the dispersion is also significantly increased around zero detuning. By relating this quantity to the medium's refractive index n(ω), and recalling the expression for the light's phase and group velocities v p and v g as a function

of n(ω), allows to derive the following expression:

v p ≈ c v g ≈ c 1 + N Ω 2 s ω 31 |D 31 | 2 2 0 V (2.65)
where c is the speed of light in vacuum. The phase velocity of the light is more or less preserved, but it is interesting to see that the group velocity can be significantly decreased by increasing the atomic density N/V and controlling the energy of the fields. The signal light is therefore slowed down, which results in effective storage of the information.

C H A P T E R 3

QUANTUM CRYPTOGRAPHY

Foundations of information-theoretic security

Conjugate coding

In the early 70s, Stephen Wiesner proposed a novel idea in a paper entitled Conjugate Coding, which was published 10 years later [START_REF] Wiesner | Conjugate coding[END_REF]. He suggested that the laws of quantum mechanics could be used to achieve information-theoretic security in specific cryptographic tasks. One famous example is the unforgeable quantum money application, which this thesis aims to implement, and for which a full introduction is provided in Section 3.2. This idea paved the way to the famous BB84 quantum key distribution protocol [START_REF] Bennett | Quantum cryptography: Public key distribution and coin tossing[END_REF], which we shall discuss further in Section 3.3.

The concept of conjugate coding is based on the uncertainty principle, which bears no classical analogue. The uncertainty principle states that, for a pair of conjugate variables x 1 and x 2 describing two different properties of a quantum system, decreasing the uncertainty on the value of one observable increases the uncertainty on the other.

Recalling Section 2.1.3, this occurs when the variables do not commute, i.e. [x 1 , x 2 ] = 0.

In this way, performing a measurement to learn the exact value of one observable completely destroys the information on the value of the other observable. More formally, the uncertainty principle may be described by the following product: state. The value of the bit is then partially hidden, provided that the adversary does not know the preparation basis. Performing a projective measurement in one basis will then completely destroy any information encoded in the other basis. This provides a type of security which can never be achieved with computational assumptions: informationtheoretic security. That is, unlike most classical protocols in which assumptions are made on the computational power of the adversary to perform a hard operation, quantum cryptography can provide a much higher level of security in which none of these assumptions are required. Once again, security in this setting assumes that quantum theory provides a correct description of our physical world.

∆x 1 ∆x 2 C, (3.1

No-cloning theorem

The no-cloning theorem embodies a fundamental difference between classical and quantum information, and represents the second founding principle of quantum cryptography.

In fact, it is a more general and abstract way of stating the uncertainty principle, and also allows for conjugate coding. The theorem states that an unknown quantum system cannot be perfectly copied with unit probability. This is in contrast with the classical world, in which a bit of information may be read or measured without destroying its properties, and hence reproduced an infinite amount of times with no error. This property arises once again from the linearity of quantum mechanics described in Section 2.1.1, and the proof may be derived by contradiction.

U |ψ〉 A ⊗ |0〉 B = |ψ〉 A ⊗ |ψ〉 B . (3.3)
There exists such a cloning unitary for the basis eigenstates, since it is always possible to discriminate them perfectly, and hence create any number of perfect copies. This implies that:

U |0〉 A ⊗ |0〉 B = |0〉 A ⊗ |0〉 B , U |1〉 A ⊗ |0〉 B = |1〉 A ⊗ |1〉 B . (3.4)
Expressing |ψ〉 as a general qubit state, we may then rewrite the left-hand side of (3.3) as:

U α |0〉 A + β |1〉 A ⊗ |0〉 B = α U |0〉 A ⊗ |0〉 B + β U |1〉 A ⊗ |0〉 B = α |0〉 A ⊗ |0〉 B + β |1〉 A ⊗ |1〉 B . (3.5)
Let us now rewrite the right-hand side of (3.3):

|ψ〉 A ⊗ |ψ〉 B = α |0〉 A + β |1〉 A ⊗ α |0〉 B + β |1〉 B = α 2 |0〉 A ⊗ |0〉 B + αβ |0〉 A ⊗ |1〉 B + βα |1〉 A ⊗ |0〉 B + β 2 |1〉 A ⊗ |1〉 B . ( 3

Quantum money

Classification

The aim of a quantum money protocol is to protect against forgery of cheques, banknotes or credit cards by associating them with a secret key encoded into quantum-mechanical states. By appropriately using conjugate coding, information-theoretic security is then guaranteed by the uncertainty principle and the no-cloning theorem (Section 3.1). Here,

we briefly define what we mean by cheques, credit cards and banknotes in the quantum setting, and propose a classification of quantum money schemes, summarized in Fig. 3.1.

All quantum money schemes involve a mint, which generates the quantum money state, stores it in a quantum memory and hands it to a client. Depending on the type of key and verification, the presence of other parties will vary.

In a private-key money scheme, the quantum state is encoded according to a secret classical key, which is known by the mint and the verification bank only. The key contains a sequence of secret information bits, as well as a sequence of secret basis bits, which indicate the random preparation basis of each information bit. This ensures that a dishonest client willing to duplicate the money state will introduce errors in at least one of two states, due to no-cloning (Section 3.1.2). Upon verification, these errors will be detected by the bank, which measures each sub-system of the money state in the correct basis and compares the measurement outcomes with the secret key.

Two types of verification may be used in a private-key scheme: quantum and classical verification. The original scheme, introduced by Wiesner around the mid 70s, and later published in [START_REF] Wiesner | Conjugate coding[END_REF], involved quantum verification: the client has to send the entire quantum money state to a distant bank for verification. In this thesis, this money state will be called a cheque, since the state must physically reach the bank for it to be declared authentic. Such quantum money schemes are described in Section 3.2.2. We note that, in [START_REF] Moulik | Quantum cheques[END_REF], the term cheque is also used for private-key money schemes with quantum verification, but with the extra property that the issuer of the cheque should be identified.

This requires the combination of quantum money with digital signature schemes.

From an implementation perspective, quantum verification is not practical, as it subjects the money state to unwanted errors and losses due to imperfect, long-distance transmission. This may cause an honest money state to be rejected by the bank. Much later, Gavinsky therefore introduced quantum money with classical verification [START_REF] Gavinski | Quantum money with classical verification[END_REF], in which the measurements are performed locally by a vendor, and the distant bank verifies the authenticity of the money state through classical communication only. We shall refer to such schemes as credit card schemes, since the vendor performs the measurements locally with a payment terminal (measurement setup), and classically transfers the outcomes to a distant bank for verification. Such quantum money schemes are described in Section 3.2.3. As we shall see in Chapter 5, this raises the question of whether the payment terminal should be trusted or not, as it may potentially help the client in double spending.

For completeness, we finally introduce the concept of public-key quantum money, which will not be studied in this thesis. This refers to banknotes (i.e. real, physical money): a mint generates a quantum banknote according to a public key, which may then freely circulate amongst clients and vendors. However, any party must be able to verify the authenticity of a banknote without requiring communication with a bank. It has been shown that, unlike private-key schemes, such schemes cannot achieve informationtheoretic security, and must therefore rely on computational assumptions. However, they still provide a security advantage over the classical world for physical money, as briefly explained in Section 3.2.4.

Private-key with quantum verification

In Wiesner's original scheme [START_REF] Wiesner | Conjugate coding[END_REF], the mint generates a random secret classical key k (s) and encodes it according to a secret classical basis key b (s) . The quantum cheque state associated to public serial number s and secret classical keys k (s) and b (s) may then be written:

|e (k,b) 〉 = n j=1 |ψ (k,b) j 〉 , (3.7)
where |ψ

(k,b) j 〉 ∈ {|+〉 , |+i〉 , |-〉 , |-i〉}.
More specifically, bit k (s) j is encoded in the σ x basis when b (s) j = 0, and in the σ y basis when b (s) j = 1. The mint stores |e (k,b) 〉 in a quantum memory and hands it to a client. When a transaction must be performed, the client sends all n qubits of the cheque to the bank for verification. The bank, who shares the secret classical keys with the mint, measures each of the n qubits of |e (k,b) 〉 in the correct preparation basis, and checks whether all outcomes coincide with k (s) . If there are no errors, the cheque is deemed authentic and the transaction can proceed. In the honest scenario, this occurs with probability p h = 1.

If there are some errors, the bank rejects the payment. Note that, unlike the original Wiesner proposal, the bank should NOT send the state back to the client in any case, as sending the quantum state back and forth can lead to powerful adaptive attacks [START_REF] Brodutch | An adaptive attack on wiesner's quantum money[END_REF].

This protocol guarantees information-theoretic security against counterfeiting thanks to the principles of Section 3.1: it is strictly impossible for a counterfeiter to produce two copies of the initial quantum cheque which both pass the verification in two separate branches of the bank. For a cheque consisting of a single state (i.e. n = 1), the dishonest strategy only succeeds with probability p d 3/4 [START_REF] Wiesner | Conjugate coding[END_REF][START_REF] Molina | Optimal counterfeiting attacks and generalizations for wiesner's quantum money[END_REF]. This upper bound is reached for a strategy in which the dishonest client measures the unknown state randomly in one of the two conjugate bases. If basis σ i was picked, and outcome j is measured, the client then encodes bit j into two identical quantum states prepared in the σ i basis. When σ i is the correct preparation basis, the client succeeds with probability 1. If it is the incorrect preparation basis, they succeed with probability 1/2 only. Since each basis is picked with probability 1/2, the total winning probability indeed reads

p d = 1 2 × 1 + 1 2 × 1 2 = 3 4 .
For a cheque consisting of n states, the honest success probability remains 1, while the probability that a dishonest client succeeds can be made arbitrarily close to 0. This is because the client cannot succeed any better in performing a general attack on the n states. The best strategy is therefore to perform the same attack on each individual qubit, which leads to p d (n) 3 4 n . This property arises from the product rule of semidefinite programs [START_REF] Molina | Optimal counterfeiting attacks and generalizations for wiesner's quantum money[END_REF][START_REF] Mittal | Product rules in semidefinite programming[END_REF][START_REF] Georgiou | New constructions for quantum money[END_REF]. The protocol therefore satisfies the following properties:

p h (n) = 1 correctness p d (n) 3 4 n security (3.8)

Private-key with classical verification

Classical verification was originally proposed by Gavinsky in [START_REF] Gavinski | Quantum money with classical verification[END_REF], and was later extended to simpler quantum states in [START_REF] Pastawski | Unforgeable noisetolerant quantum tokens[END_REF]. As previously highlighted, we shall refer to such schemes as quantum credit card schemes, since the verification proceeds through an intermediate payment terminal, which sends classical data to a distant bank. The basic idea behind the removal of quantum verification is that the bank can verify the authenticity of the credit card through classical challenge questions only.

Mint Client Terminal Bank

(i) H H H H (ii) H D H H (iii) H D/H D H (iv) D D/H D H (v) D D/H D/H D
In the work from [START_REF] Bozzio | Semi-device-independent quantum money with coherent states[END_REF], we summarize all possible adversarial scenarios which may occur in such protocols (involving a mint, a client, a payment terminal and a bank). This summary is displayed in Table 3.1. Scenario (i) involves honest parties only. In this case, the property of interest is the correctness c of the protocol: the credit card must always be verified with probability c = 1.

Scenario (ii) relates to cases where the credit card is verified through classical communication, but the payment terminal which performs the local quantum measurements follows the protocol honestly. In this thesis, Chapter 4 proposes a proof-of-principle implementation of this scenario.

Scenario (iii) extends the security to cases in which the payment terminal cannot be trusted, and is therefore not constrained to follow the protocol's measurements: it can perform any POVM or quantum operation on the initial quantum credit card state. In

Chapter 5, we propose a rigorous and practical security proof for Scenario (iii). Scenario (ii) is also studied again in a semi-device-independent regime, in which the squashing models from [START_REF] Beaudry | Squashing models for optical measurements in quantum communication[END_REF] are used to strongly limit the assumptions on the terminal detectors, while both (iii) and (iv) are by definition semi-device-independent. Note that the notion of semi-device-independence will be introduced in Chapter 5.

Scenario (iv) treats cases in which all parties are dishonest, except the bank. This

will not be treated in this thesis, but was very recently studied in [START_REF] Horodecki | Semi-device independent quantum money[END_REF], and was shown to be impossible without assumptions on the dimensionality of the quantum states and the type of attacks allowed. Finally, scenario (v) is of no cryptographic interest since none of the parties are honest.

CHAPTER 3. QUANTUM CRYPTOGRAPHY

Public-key

In the classical world, money schemes are impossible with information-theoretic security and are therefore based on computational assumptions. We have just seen that, provided

the key is private, then information-theoretic security may be achieved with quantum mechanics. Regarding quantum banknotes, such public-key schemes cannot base their security solely on the no-cloning theorem, even in the quantum world. They require some computational assumptions, involving knot problems or quantum obfuscation for instance [START_REF] Lutomirski | Breaking and making quantum money: towards a new quantum cryptographic protocol[END_REF][START_REF] Mosca | Quantum coins[END_REF][START_REF] Aaronson | Quantum money from hidden subspaces[END_REF][START_REF] Farhi | Quantum money from knots[END_REF][START_REF] Alagic | On quantum obfuscation[END_REF][START_REF] Bartkiewicz | Experimental quantum forgery of quantum optical money[END_REF]. This computational security is still interesting since in the classical world there can be no notion of mathematical security for banknotes; their security is based only on the fact that it is difficult for a counterfeiter to copy a banknote due to its intricate coloring and hologram design. The recent experimental work from [START_REF] Bartkiewicz | Experimental quantum forgery of quantum optical money[END_REF] has

shown how such quantum banknotes can be constructed on-the-fly but also forged.

Quantum key distribution

BB84 protocol

A year after Wiesner's seminal work was published [START_REF] Wiesner | Conjugate coding[END_REF], and after closely working with him on the proposal of unforgeable quantum subway tokens [START_REF] Bennett | Quantum cryptography, or unforgeable subway tokens[END_REF], Bennett and Brassard proposed the first idea for quantum key distribution (QKD): the BB84 protocol [START_REF] Bennett | Quantum cryptography: Public key distribution and coin tossing[END_REF]. This has been the most widely studied and implemented quantum-cryptographic task up to now [START_REF] Boaron | Secure quantum key distribution over 421 km of optical fiber[END_REF][START_REF] Diamanti | Practical challenges in quantum key distribution[END_REF]. Since some of the security tools used in this thesis were originally designed for quantum key distribution, we give here a brief outline of the protocol.

Unlike quantum money or quantum coin flipping however, the two parties involved in QKD trust each other: Alice and Bob wish to establish a common secret key over a public channel. However, they want to ensure that the unwanted presence of an eavesdropper, Eve, on the channel is always detected. Information-theoretic security for such a task may be achieved with Wiesner's conjugate coding principle (Section 3.1.1). Once a secret key has successfully been established, Alice and Bob may use it to encrypt a secret message through one-time padding [START_REF] Miller | Telegraphic code to ensure privacy and secrecy in the transmission of telegrams[END_REF]. This encryption technique requires a secret key whose length is at least equal to the message length.

As displayed in Fig. Alice encodes her secret key bits into a sequence of polarized photon states, randomly prepared in the σ z or σ z basis. She sends the photons to Bob over a quantum channel. Upon reception, Bob picks a measurement basis at random for each photon, and records the measurement results. Over a classical channel, Alice and Bob then dismiss all results for which the basis picked by Bob does not match Alice's initial preparation basis. Such cases are indicated by red crosses. Only the results for which the preparation and measurement bases match (green ticks) will constitute the final secret key. For the image source, please see [START_REF] Iqbal | Quantum cryptography: a brief review of the recent developments and future perspectives[END_REF].

|-〉. The states are sent over a quantum channel to distant Bob, who does not know the encoding basis, and thus randomly measures each qubit in either σ z or σ x . He records each qubit's measurement basis, along with the associated measurement outcomes.

Once the quantum communication stage is over, Alice and Bob proceed to a classical reconciliation stage: Bob communicates his sequence of measurement bases (without the measurement outcomes) to Alice. After comparing it with her stored sequence, Alice reports to Bob the elements for which her preparation basis does not match Bob's measurement basis. They both agree to dismiss all bits which correspond to a basis mismatch from the final key.

After basis reconciliation, Alice and Bob then compare a pre-agreed random subset of their corrected key to ensure that all bits match. If any of the bits disagree, they may conclude on the presence of Eve and abort the protocol. If all bits agree, the key has then successfully been established, and they may use it to encrypt a secret message. Note that an additional stage, known as privacy amplification, is required in the noisy setting, in order to decrease the amount of information that Eve acquires from Alice and Bob's classical communication [START_REF] Deutsch | Quantum privacy amplification and the security of quantum cryptography over noisy channels[END_REF].

For the security definition, let us now consider the following tripartite states: When the three parties share ρ ABE , Eve gains no information about the key. When the three parties share a partially correlated state σ ABE , then Eve gains some information about the key. The security requirement for QKD may be expressed as an upper bound on the trace distance between these two states:

• ρ ABE = N k=1 1 N |k〉 〈k| AB ⊗ ρ E :
1 2 ||σ ABE -ρ ABE || 1 , (3.9)
where is the security parameter, which should be chosen as small as possible, given a specific protocol and implementation constraints. We note that in practice, losses and noise will allow adversaries to cheat differently in quantum money and in quantum key distribution schemes. Practical attacks in quantum money will be treated rigorously in Chapter 5. For practical attacks in QKD, the works from [START_REF] Diamanti | Practical challenges in quantum key distribution[END_REF][START_REF] Brassard | Limitations on practical quantum cryptography[END_REF] provide a good overview.

Other variants

While implementations of BB84 have been realized with a multitude of different encodings (polarization, phase, time-bin, etc...), using discrete degrees of freedom of coherent states [START_REF] Lo | Security of quantum key distribution using weak coherent states with nonrandom phases[END_REF][START_REF] Duligall | Low cost and compact quantum cryptography[END_REF], we note the existence of other types of QKD protocols:

• Entanglement-based QKD [START_REF] Ekert | Quantum cryptography based on bell's theorem[END_REF]: Alice and Bob establish a secret key by sharing the Bell states from Eq. (2.14). Checking that the correlations are inherently quantum allow them to detect the presence of Eve.

• Continuous-variable QKD [START_REF] Grosshans | Continuous variable quantum cryptography using coherent states[END_REF]: Alice and Bob establish a secret key by sending coherent states (Section 2.3.1) instead of qubit states. The information is encoded on continuous photonic degrees of freedom (electromagnetic field quadratures), and the measurements are also continuous. Eve's presence will introduce excess noise just like in BB84.

Quantum coin flipping

Strong coin flipping

From a quantum network perspective, the last task that we introduce, two-party coin flipping, is a fundamental cryptographic primitive: it helps in the construction of more complex security tasks.

Strong coin flipping (SCF) allows two distant parties, Alice and Bob, to generate and agree on a random bit. They do not trust each other and wish to ensure that the bit is truly random. We call the coin flip fair when two honest parties each win with probability 1/2. On the other hand, security for this task must guarantee that none of the two parties can force the other to declare outcome i ∈ {0, 1} with probability higher

than P = 1 2 + (i)
, where (i) is the protocol bias. In its most general form, SCF does not necessarily involve equal cheating probabilities for both parties, but when it does, the protocol is labelled balanced. We define the following upper bounds on Alice and Bob's probabilities of forcing their opponent to declare outcome i:

P (i) A 1 2 + (i)
A Alice forces Bob to declare i

P (i) B 1 2
+ (i) B Bob forces Alice to declare i (3.10)
The bias of a given SCF protocol is then defined as the highest of all four biases:

= max (0) A , (1) A , (0) B , (1) B .

(3.11)

In the classical world, a naive way of perform SCF with zero bias would involve Alice and Bob generating two random bits x A and x B , respectively. They would then simultaneously broadcast their bits at a pre-agreed time, and calculate the outcome of the flip as (x A ⊕ x B ). However, this property requires perfect clock synchronization, which effectively amounts to trusting a third party, such as a GPS for instance. Trusting a third party defies the very purpose of two-party coin flipping, as it is a much stronger assumption. Classically therefore, two-party SCF may only achieve computational secu-rity, as it requires some form of bit commitment, whose security is based on hardness assumptions.

In the quantum world, it has been shown by Kitaev that information-theoretically secure SCF is possible, but with a fundamental lower bound on the achievable bias [START_REF] Kitaev | Quantum coin flipping[END_REF]:

1 2 - 1 2 ≈ 0.207. (3.12)
This fundamental no-go theorem appears quite unfortunate, but it still allows to perform fair protocols in which a dishonest party can bias the flip with probability no higher than ≈ 0.707, without requiring any computational assumption. Quantum SCF has been implemented using a variety of different encodings in [START_REF] Pappa | Experimental plug and play quantum coin flipping[END_REF][START_REF] Berlín | Experimental loss-tolerant quantum coin flipping[END_REF][START_REF] Molina-Terriza | Experimental quantum coin tossing[END_REF]. However, such implementations present fairly high biases which exceed 0.30.

Weak coin flipping

Two-party weak coin flipping (WCF) allows Alice and Bob to agree on a random bit when they both have known, preferred, opposite outcomes. In other words, the outcome of the flip will designate a winner and a loser. In terms of biases and cheating probabilities, WCF may be seen as a more restricted version of SCF for which:

P (0) A 1 2 + (0)
A Alice forces Bob to declare 0

P (1) A = 1
Alice forces Bob to declare 1

P (0) A = 1
Bob forces Alice to declare 0

P (1) B 1 2
+ (i)

B

Bob forces Alice to declare 1

(3.13)
Note that a protocol which satisfies these conditions is labelled weak as two out of four bias parameters remain unconstrained: (1) A and (0) B are both allowed to reach their trivial 1 2 values. This means that Alice and Bob can always choose to lose with probability P (1) A = P (0) B = 1. Interestingly however, quantum WCF schemes are crucial to constructing optimal quantum SCF schemes [START_REF] Chailloux | Optimal quantum strong coin flipping[END_REF], as well as other useful cryptographic primitives such as bit commitment [START_REF] Chailloux | Optimal bounds for quantum bit commitment[END_REF].

Unified framework with abort cases

As we shall see in Chapter 7, constructing loss-tolerant weak coin flipping protocols is very challenging, since it allows any dishonest party to declare an abort whenever they are not satisfied with the outcome of the flip. Furthermore, allowing for abort cases may enable some classical coin flipping protocols to perform better than quantum protocols. This is because increasing the abort probability effectively decreases Alice and Bob's cheating probabilities. We say that the protocol achieves quantum advantage when it provides strictly better bounds than any classical coin flipping protocol (here, this relates to the bias).

In this section, we highlight the conditions on the protocol parameters which enable quantum advantage. We recall the general coin flipping formalism from [START_REF] Hänggi | Tight bounds for classical and quantum coin flipping[END_REF], in which any classical or quantum coin flipping protocol may be expressed as a:

CF P 00 , P 11 , P (0)

A , P (1)

A , P (0) B , P (1) B , (3.14)
where P ii is the probability that two honest players output value i ∈ {0, 1}, P (i) A is the probability that Dishonest Alice forces Honest Bob to declare outcome i, and

P (i)
B is the probability that Dishonest Bob forces Honest Alice to declare outcome i. Note that this formalism takes into account the abort probability, as the correctness P ii may be rewritten:

P ii = f (i, a), (3.15)
where a is the probability that the protocol aborts when both parties are honest, and f is some function of a. In this formalism, an ideal SCF protocol can then be expressed as a:

CF 1 2 , 1 2 , 1 2 , 1 2 , 1 2 , 1 2 , (3.16)
while an ideal WCF may be expressed as a:

CF 1 2 , 1 2 , 1 2 , 1, 1, 1 2 .
(3.17)

From [START_REF] Hänggi | Tight bounds for classical and quantum coin flipping[END_REF], the condition for which quantum protocols achieve strictly better bounds than classical protocols (Q>C), reads: Historically, quantum money with classical verification was first proposed in [START_REF] Gavinski | Quantum money with classical verification[END_REF]: the distant bank verifies the authenticity of the quantum money state by asking some classical challenge questions and ensuring that the answers match the secret key. This was based on the quantum retrieval game (QRG) formalism from [START_REF] Arrazola | Practical quantum retrieval games[END_REF], while the information was encoded on hidden-matching states [START_REF] Bar-Yossef | Exponential separation of quantum and classical one-way communication complexity[END_REF]. Several rounds of classical communication between the vendor and the bank were required, and implementing such a scheme implied generating high-dimensional entangled states. These impractical requirements were recently dismissed in [START_REF] Amiri | Quantum money with nearly optimal error tolerance[END_REF], by proposing to map this high-dimensional encoding on a separable train of phase-encoded coherent states. Independently, a new encoding for classical verification was proposed in [START_REF] Pastawski | Unforgeable noisetolerant quantum tokens[END_REF], making use of the simple {|0〉 , |1〉 , |+〉 , |-〉} states. The latter scheme is the one we aim to implement in this chapter.

Q > C ⇐⇒ P (0) A + P (1) A > 1 P (0) B + P (1) A > 1 (3.18) C H A P T E R
As emphasized in Section 3.2.3, classical communication raises the question of whether the bank can always trust the distant terminal to perform the correct quantum measurements and provide the true measurement outcomes. In this chapter, we focus on the practical security analysis and first proof-of-principle implementation of a quantum credit scheme in which the bank trusts its distant terminal. The untrusted terminal treatment is left for Chapter 5. Furthermore, the security analysis is targeted towards the proof-of-concept experiment in which we post-select on losses. While the noisy security analysis is rigorous, we only consider specific loss-dependent attacks, while the general loss-dependent treatment is also left for Chapter 5.

The protocol presented in this chapter builds upon the work in [START_REF] Pastawski | Unforgeable noisetolerant quantum tokens[END_REF] in conjunction with the techniques developed in [START_REF] Georgiou | New constructions for quantum money[END_REF], and uses only pairs of {|0〉 , |1〉 , |+〉 , |-〉} states and a single round of classical communication for verification. The elegant quantum retrieval game formalism from [START_REF] Arrazola | Practical quantum retrieval games[END_REF] allows the payment terminal to choose the measurement basis at random, and also to formulate conditions for correctness and security that can be experimentally tested. These conditions are satisfied experimentally using a practical photonic setup based on polarization encoding of weak coherent states of light, and secure regimes of operation are derived. The experiment includes the full procedure of credit card state generation, readout and verification without a quantum memory. The full experimental demonstration involving genuine quantum storage of the credit card state is left for Chapter 6. Finally, we provide a comparison of our work from [START_REF] Bozzio | Experimental investigation of practical unforgeable quantum money[END_REF] with independent work that appeared in [START_REF] Guan | Experimental preparation and verification of quantum money[END_REF].

Protocol and correctness

For simplicity, we start by describing the honest protocol with a quantum credit card consisting of a single state. The mint generates a unique public serial number s, which will serve to identify the credit card when a transaction occurs. It then generates a random secret classical key k (s) consisting of three bits {b, c 0 , c 1 }, which collectively identify one of the states from the following set: A transaction consists of three distinct steps, as illustrated in Fig. 4.1. First, the client hands the credit card to the vendor, who chooses at random one of two challenge questions and measures the credit card with a trusted payment terminal. The aim here is to perform a measurement on the stored qubit pair in order to provide a correct answer to the randomly selected challenge. As a second step, the vendor sends the measurement outcomes, along with the chosen challenge, to the bank. Finally, the bank verifies the authenticity of the credit card using the secret string k (s) and allows the transaction if and only if the measurement outcomes coincide with the triplet {b, c 0 , c 1 }. In the opposite case, the card is rejected and declared as a counterfeit. The two challenges, which we label Q zz and Q xx , effectively ask the trusted terminal to provide the correct bit c i for one of the qubits prepared in a specific basis, and a random answer c i for the qubit prepared in the other basis:

S pair = {|0+〉 , |0-〉 , |1+〉 , |1-〉 , |+0〉 , |+1〉 , |-0〉 , |-1〉}, ( 4
Q zz = Provide two bits c 0 and c 1 , such that the bit corresponding to the qubit prepared in the σ z basis is correct.

Q xx = Provide two bits c 0 and c 1 , such that the bit corresponding to the qubit prepared in the σ x basis is correct.

The main idea here is that a valid credit card can always be verified in the ideal case.

In order to answer the Q zz challenge, the trusted terminal performs a measurement in the σ z ⊗ σ z basis. In order to verify the Q xx challenge, it performs a measurement in the σ x ⊗ σ x basis. We denote by c the probability of successfully answering Q zz or Q xx , and name it the correctness parameter. In a perfect implementation, c always equals 1 for the above challenges, since measuring both qubits in the σ z basis always answers the Q zz challenge correctly, and similarly for Q xx . In a realistic implementation, however, c

might not be equal to 1 due to system imperfections. It might also take different values, c zz and c xx , depending on whether the Q zz or Q xx challenge is selected by the terminal.

In this case, c can be defined as the average of c zz and c xx :

c = c zz + c xx 2 (4.2)
For a fragment of the credit card consisting of n qubit pairs, the vendor's trusted terminal picks only one challenge for the n pairs. It then proceeds to measure the 2n qubits in the same basis, before sending the measurement outcomes and the selected challenge to the bank for verification. In an ideal implementation, the probability of accepting an honest credit card fragment remains 1. We denote by the upper bound on the probability of successfully answering this challenge, and call it the security parameter. The value of was derived in [START_REF] Gavinski | Quantum money with classical verification[END_REF][START_REF] Pastawski | Unforgeable noisetolerant quantum tokens[END_REF] using semidefinite programming techniques, and shown to be 3/4. The set of three challenges Q zz , Q xx and Q , which may be answered at best with probability c, c and , respectively, can be gathered in a 1-out-of-2 (c, ) quantum retrieval game G. Informally, this is a game in which, given a quantum state ρ, one of two possible challenges may be asked. Each challenge may be correctly answered with probability c at most, while the conjunction of both challenges may only be correctly answered with probability [START_REF] Georgiou | New constructions for quantum money[END_REF].

Security

Two spacelike-separated payment terminals (which cannot communicate with one another) will randomly pick the same challenge with probability 1/2, in which case a dishonest client can apply the honest strategy from Section 4.2 and pass the verification with probability 1. However, these two terminals may also pick different challenges with probability 1/2, in which case a dishonest client cannot pass with probability higher than . We therefore deduce that the following relation between the correctness and security parameters must hold for game G:

c > + 1 2 . (4.3)

Extension to n pairs

A crucial property of game G is that, if one attempts to answer in parallel n such challenges, then one can upper bound the probability that a dishonest client will successfully answer challenge Q for all n repetitions by n [START_REF] Gavinski | Quantum money with classical verification[END_REF]. This bound follows naturally from the product property of semidefinite programs [START_REF] Mittal | Product rules in semidefinite programming[END_REF][START_REF] Georgiou | New constructions for quantum money[END_REF]. Such a product bound implies that performing a general attack on the composite Hilbert space of all qubit pairs in the card cannot yield a higher cheating probability than performing an optimal attack on each individual pair.

Starting from a game G for which Eq. (4.3) holds, we may then construct a different game G that consists of n parallel repetitions of game G. Here again, the vendor chooses at random one of two challenge questions and performs a measurement on all 2n qubits accordingly: either σ z ⊗σ z on all n pairs or σ x ⊗σ x on all n pairs. Considering a tolerance parameter δ > 0, we now define the two challenges as: (i) answering the challenge Q zz correctly for at least a fraction (cδ) of the n pairs, and (ii) answering the challenge Q xx for at least a fraction (cδ) of the n pairs.

Since the honest strategy for winning game G can be obtained by performing the same measurement on each of the n pairs individually, then we may use a Chernoff argument [START_REF] Mitzenmacher | Probability and Computing: Randomized Algorithms and Probabilistic Analysis[END_REF] to bound the new correctness parameter c . That is, the number of pairs among the n pairs for which the challenge is answered correctly will be close to its expectation value cn with high probability. In other words, if X 1 , ...X n are independent random Bernouilli variables that take the value 1 if the challenge for pair i is passed, then we have that the sum X = i X i satisfies:

Pr[X ≥ (1 -δ)cn] ≥ 1 -e -cn 2 δ 2 . (4.4)
Similarly for the security parameter, the optimal cheating strategy consists in performing the same attack on each pair individually. We may then use the same Chernoff argument to bound the new security parameter : for n pairs, with very high probability the number of pairs among these n pairs for which the challenge is answered correctly is very close to its expectation value n. In other words, if Y 1 , ...Y n are independent random Bernouilli variables that take the value 1 if the challenge for pair i is passed, then the sum Y = i Y i satisfies:

Pr[Y ≥ (1 + δ) n] ≤ e -n 3 δ 2 . (4.5)
We may then label the lower and upper bounds from Eqs. (4.4) and (4.5) in terms of the correctness c and security of game G :

c = 1 -e -cn 2 δ 2 and = e -n 3 δ 2 . ( 4.6)
This means that, for game G , the correctness is exponentially close to 1 and the security parameter is exponentially close to zero. This is the desired behaviour in a noisy implementation: the probability than an honest noisy card gets accepted should be very close to 1, while the probability that a counterfeit passes the verification should be arbitrarily

small. An expression for δ in terms of c and is derived in Appendix A.1, allowing us to compute c and explicitly:

δ = 2c --1 3 . (4.7)
Enforcing δ > 0 then allows to recover the security condition from Eq. (4.3). Since in our initial game G we have = 3/4, then we can see from Eq. ( 4.3) that in any secure implementation of game G we need to achieve c > 7/8 = 0.875. The more c exceeds this 4.3. SECURITY bound, the better security (i.e., the lower ) we will get for a game G with n parallel repetitions.

The above description provides a game with exponentially good security parameters for a quantum credit card fragment, or àmini-scheme [START_REF] Georgiou | New constructions for quantum money[END_REF]. By including quantum states that correspond to many such games in the same credit card as well as a unique classical serial number, one can use theorems from [START_REF] Gavinski | Quantum money with classical verification[END_REF][START_REF] Georgiou | New constructions for quantum money[END_REF][START_REF] Aaronson | Quantum money from hidden subspaces[END_REF] to extend the above scheme into a full quantum prepaid credit card scheme, where the quantum credit card may be re-used multiple times and a dishonest client cannot create a copy of the credit card even if they have in their possession multiple credit cards. Hence, satisfying Eq. ( 4.3) experimentally is enough to implement a full quantum money scheme with information-theoretic security given by correctness and security parameters from Eq. (4.6).

Weak coherent states with fixed phase

In our discussion up till now, we have assumed that the mint creates true single qubit states and stores them in the credit card. In practice, this assumption would be compatible with an implementation using either a quantum memory based on single emitters [START_REF] Specht | A single-atom quantum memory[END_REF][START_REF] Maurer | Room-temperature quantum bit memory exceeding one second[END_REF], which are expected to emit true single photons to be measured by the vendor for verification regardless of the input state used by the bank in the card preparation stage, or a quantum memory based on atomic ensembles [START_REF] Nicolas | A quantum memory for orbital angular momentum photonic qubits[END_REF][START_REF] Rui | Operating spin echo in the quantum regime for an atomic-ensemble quantum memory[END_REF] when the input state is a true single-photon state. In the following, we shall refer to this case as the "single-photon state" protocol. The correctness and security parameters defined in Section 4.3.2 apply to this case.

In other cases of practical interest, however, we would like to use atomic-ensemble quantum memories and also weak coherent states as an input, as is typically the case in quantum cryptographic applications. In this case, the memory preserves the Poisson photon statistics of the input coherent state and simply introduces attenuation, hence reducing the average photon number per pulse µ that characterizes such states. The security threshold therefore has to be modified. More specifically, the bound that c must exceed has to be a function of µ. In the following, we shall refer to this case as the "weak coherent state" protocol.

Our security analysis first considers specific attacks that may take place in an experiment, and were briefly introduced in Chapter Following the analysis from [START_REF] Jahma | Unambiguous state discrimination in quantum cryptography with weak coherent states[END_REF] and [START_REF] Chefles | Optimum unambiguous discrimination between linearly independent symmetric states[END_REF] for our set of states gives the probability for successful USD:

P D = 2e -µ 2 sinh µ 2 -sin µ 2 . ( 4.8)
By a Chernoff bound argument [START_REF] Mitzenmacher | Probability and Computing: Randomized Algorithms and Probabilistic Analysis[END_REF], we then have that for n pulses (in the 2n-qubit sequence) that are created according to the Poisson distribution with a mean photon number µ, with very high probability the number of pulses among these n pulses for which the USD is successful is very close to its expectation. If L 1 , ...L n are random variables that take the value 1 when the pulse leads to successful USD, then we have for the sum L = i L i that:

Pr[L ≥ (1 + η)P D ] ≤ e -P D n 3 η 2 , ( 4.9)
where η > 0 is a parameter accounting for finite number statistics that can be optimized as discussed further on. We may now define a new parameter:

δ = 2c --(1 + η)P D -1 3 > 0, (4.10)
derived in Appendix A.1, and restate the condition of Eq. ( 4.3) as:

c > + (1 + η)P D + 1 2 . (4.11)
This leads to the following correctness and security parameters that take into account possible USD attacks:

c = 1 -e -cn 2 δ 2 and ≤ e -n 3 δ 2 + e -P D n 3 η 2 . (4.12)
Note that the second term in the expression of comes from the fact that, in case L is bigger than its expectation, then the dishonest client can perfectly cheat on a larger number of pairs. 4.3. SECURITY

Weak coherent states with randomized phase

Although USD leads to some of the most powerful explicit attacks in quantum-cryptographic implementations involving coherent states, considering them does not provide a general security bound against all attacks. In this section, we aim to derive a more pessimistic yet rigorous bound which does not require any assumption on the type of attack. As emphasized previously however, we limit ourselves to attacks which do not exploit losses.

A general security analysis which considers the subtle interplay between noise and losses will be derived in Chapter 5. Here, we use the technique of phase-randomization [START_REF] Lo | Phase randomization improves the security of quantum key distribution[END_REF] to suppress the coherence between Fock states that the client can exploit. We first explicit the mapping between qubit states and polarized coherent states, which will help us gain insight into the effects of phase randomization:

|0〉 → |α〉 ⊗ |vac〉 |1〉 → |vac〉 ⊗ |-α〉 |+〉 → | α 2 〉 ⊗ | α 2 〉 |-〉 → | α 2 〉 ⊗ |-α 2 〉 |+i〉 → | α 2 〉 ⊗ |i α 2 〉 |-i〉 → | α 2 〉 ⊗ |-i α 2 〉 , (4.13)
where α is the coherent state amplitude, |vac〉 denotes the vacuum state (Section 2.3.1), and the tensor product is over the two polarization modes. The last four states from Eq.

(4.13) may then be expressed more compactly as:

e iφ α 2 ⊗ e i(φ+θ) α 2 , ( 4.14)
where the global phase φ = 0 and the relative phase θ ∈ {0, π 2 , 2π, 3π 2 }. This formulation shows that an adversary must access θ to unveil the information encoded in the states.

Phase randomization scrambles the global phase reference by allowing φ to take values from [0, 2π] uniformly at random instead of a single value. Appendix A.2 details how integrating over all possible values of φ leads to the adversary seeing a classical mixture of Fock states given by [START_REF] Lo | Phase randomization improves the security of quantum key distribution[END_REF]:

1 2π 2π 0 | µ e iφ 〉 〈 µ e iφ | dφ = e -µ ∞ n=0 µ n n! |n〉 〈n| , (4.15)
where µ = |α| 2 is the average photon number, and |n〉 are the photon number states. As the coherent superposition of number states vanishes in Eq. (4.15), the security proof may simply proceed according to the result of quantum non demolition (QND) photon number measurements, considering three distinct cases:

• 0 photon: no information content.

• 1 photon: qubit proof from Section 4.3.1 may be applied.

• 2 photons or more: perfect cheating is assumed, since the information is effectively cloned within the original pulse, and so one photon can be sent to each of the two terminals and pass the verification test with probability 1.

The photon number content of a coherent state follows Poisson statistics. The probability λ of finding two photons or more in a given pulse may therefore be expressed as:

λ = 1 -p(0|µ) -p(1|µ) = 1 -(1 + µ)e -µ 1 -e -µ , (4.16)
where p(i|µ) is the probability of finding i photons in a pulse given average photon number per pulse µ. This allows to adapt the security threshold from Eq. ( 4.3) in the following way:

c > + (1 + η)λ + 1 2 . ( 4.17)
In fact, this security threshold is slightly overestimated, as one could replace with p(1|µ) , since the qubit security proof applies only in cases which involve only one photon in the pulse, which occurs with probability p(1|µ). Using the same Chernoff argument as in the two previous subsections, we may then write the general correctness and security parameters for n pairs as:

c = 1 -e -cn 2 δ 2
and ≤ e -n

3 δ 2 + e -λn 3 η 2 . (4.18)
As long as it is possible to satisfy Eq. (4.17) experimentally, then a quantum credit card scheme with information-theoretic security against all attacks performed on uniformly phase randomized weak coherent states, characterized by correctness and security parameters given in Eq. (4.18), can be implemented. Only the loss-dependent attacks are discarded here.

Loss tolerance for USD

A dishonest client may further boost their cheating probability by exploiting the losses present in a realistic implementation. These are identified by the detection and quantum memory efficiences η d and η m , respectively. In the presence of losses, the client having used USD to copy the card may indeed replace the states that they have successfully identified with states containing a higher average photon number µ at the input of the payment terminal, in order to increase the probability of detection by the vendor, and replace the ones that they failed to identify with vacuum states. Such a strategy will not be detected when a state is measured in the correct basis but it will induce an increase in the number of total clicks on the detectors registered by the card reader when a state is measured in the conjugate basis. Based on [START_REF] Jahma | Unambiguous state discrimination in quantum cryptography with weak coherent states[END_REF], in order for this cheating strategy to be detected and thus for the protocol to be secure, the total efficiency must fulfill the condition:

η m η d > -ln(1 -P D ) µ , (4.19)
where η m is the retrieval efficiency of the quantum memory in the original valid card and η d is the detection efficiency of the card reader. The corresponding security region is plotted in Fig. 5 Then, the light pulses go through a multi-stage polarization controller consisting of an electro-optic modulator, which sets the polarization of each pulse to horizontal, vertical, diagonal or antidiagonal, according to a suitable combination of applied voltages. These polarization states correspond to the qubit states |0〉, |1〉, |+〉 and |-〉, respectively. The voltage sequences applied to the controller are generated such that two successive pulses form a pair whose polarization state is randomly chosen from the set S pair , as required by our protocol.

The value of µ is fixed for each experiment at the output of the polarization controller.

Finally, the pulses are directed to the credit card reader, where the polarization state of each pulse is measured in either the σ z or the σ x basis by the combination of a half-wave 56 state preparation is performed using pulses carved from light emitted by a telecommunication wavelength laser diode using an acousto-optic modulator (AOM). A multi-stage polarization controller (EOSPACE) is then used to select the polarization states according to the protocol by applying suitable voltages. The average photon number of pulse µ is set by a variable optical attenuator (VOA) and is calibrated with a 99/1 beam splitter (BS) and a nano powermeter. The credit card reader is materialized by a standard polarization analysis setup including a half-wave plate (HWP), a polarization beam-splitter (PBS) and two InGaAs single-photon avalanche photodiodes (ID201). The entire setup is synchronized using a multi-channel delay generator and is controlled by software incorporating the random state generation and data acquisition and processing.

plate, set at an angle 0 • or 22.5 • with respect to the horizontal direction, respectively, and a polarization beamsplitter whose outputs are directed to two single-photon detectors labeled D 0/+ and D 1/-. At the end of the experiment, the data sets corresponding to the credit card state generated by the bank, the bases selected by the vendor, and the measurement outcomes obtained for the different challenge questions are analyzed to assess the security of our implementation.

Experimental steps

Regarding pulse chopping, an acousto-optic modulator is used, driven by an RF signal. The driver generates a 200 MHz RF electrical output signal which, thanks to an electro-acoustic transducer, transforms into a periodic acoustic standing wave inside the modulator. Such a wave triggers a periodic variation of the crystal's refractive index due to the alternating compression and dilation phenomena, which in turn serve as a Bragg reflector for the incident laser beam. For a specific incidence angle θ, part of the beam is deflected by first order diffraction, while the rest of the beam follows its original path (zeroth order diffraction). The deflected beam constitutes the output of the modulator. The pulses are then created by using the arbitrary waveform generator's pulsed input as an envelope for the driver's RF signal. When the envelope goes to zero, there is no deflection and so the entire incident beam is blocked. When the envelope peaks, then the deflected beam is at its maximum, and so a pulse will be created.

The overall response time of the modulator is around 70 ns, and there are some insertion losses due to the only partially deflected beam that serves as the output. Such losses, however, do not have to be considered as they are generated in the mint's honest lab.

Regarding the attenuation process, an IDIL variable optical attenuator is used, followed by a 99/1 beam splitter. The 99% arm is coupled to a nano powermeter, while the other arm is coupled to the polarization controller and the detection part of the experiment. Such a setup allows a precise estimation of the power needed to reach the desired value of µ.

Polarization control is performed thanks to an EOspace lithium-niobate crystal containing three stages. A triplet of voltages is applied transversely to each stage (Fig. 4.5) in order to create a polarization rotation via the Pockels effect. Applying a transverse electric field on the crystal triggers a charge reorganization which modifies the birefringence in a proportional manner. The required operating voltages to achieve a δ-wave plate with orientation angle α/2 using a single stage are given by the following :

         V A = 2V 0 δ sin α -V π δ cos α + V A bias V B = 0 V C = 2V 0 δ sin α + V π δ cos α + V C bias (4.20)
where V 0 rotates all power from the horizontal state to the vertical state and V π induces a phase shift of π between the two states. V A bias and V C bias allow zero birefringence between the two modes, and typically V A bias ≈ -V C bias .

Single photon detection is realized with the id 201 avalanche single photon detectors from id Quantique. These are based on a reverse-biased InGaAs pn-junction, to which a voltage much higher than the breakdown voltage is applied. This allows a single photon to create an electronic avalanche in the medium, which will induce a macroscopic current. A TTL single will consequently be output by the detector in order to record a detection event. These detectors are typically gated: the strong voltage is applied only periodically, for an effective gate width duration of 500 ps, which implies that the detector cannot detect any photon outside of this region. Due to the finite, non-zero temperature of the pn-junction, some noisy detections, known as dark counts, may occur. The measured dark count probability for these detectors is about 5 × 10 -5 per gate. These detectors also have a non-unit detection efficiency of 25%.

Data is generated and acquired

Results

The experimental results for the values of c zz , c xx and c, obtained for weak coherent states with different values of µ ≤ 1, are shown in Fig. 4.6 (green symbols). We also display the security thresholds corresponding to Eq. (4.3) for the "single-photon state" protocol (full pink line) and Eqs. (4.11) and (4.17) for the "weak coherent state" protocol, which is plotted for different values of parameter η (dashed red and purple lines respectively). We post-select on events for which at least one of the detectors has clicked.

We have also plotted simulations of the evolution of c with µ (cyan lines) according to a theoretical model that takes into account Poisson statistics of weak coherent states, dark count probability, finite detection efficiency, state purity and post-selection of pulses where at least one detector clicks. The expression for c is derived in Appendix A.3. The best fit of our data points corresponds to a state purity of p = 93%. This reduced purity with respect to the 99.5% purity obtained when all states in a block are, for instance, σ z eigenstates, is due to the large voltage differences that are required as an input to the polarization controller for different consecutive states in a block of random states.

The limited response time of the involved electronics leads to state generation with non-optimal purity. Note that, even though we are using an attenuated laser in the experiment, our data also gives us a good estimation of the performance we would obtain with true single photons emitted with an efficiency µ. For our regime of parameters, the expected value of the correctness parameter c for single-photon states (blue lines in Fig. 4.6) is extremely close to those for weak coherent states. Thus, our experimental data can be analyzed for the various input state and quantum memory configurations considered here.

For the "weak coherent state" protocol, the security threshold of Eq. (4.11), taking into account USD attacks only, reaches 1 for µ 1. Hence, for larger values of µ, the protocol is insecure against USD attacks. Note that for the threshold of Eq. (4.17) which ensures security against any non-loss-dependent attack (for phase-randomized states), it can be seen that µ must not exceed 0.40. The simulations in Fig. 4.6 also show that the protocol is insecure when the state purity p drops below 76%, since the value of c then falls below the USD attack security threshold. However, for 0.01 ≤ µ < 1 and for p ≥ 0.76, there is a wide region of parameters for which the protocol is secure against such attacks. Indeed, for our experimental results with p = 0.93, the protocol is secure against USD attacks for values of µ up to 1. From Fig. 5.6, our experiment with η m = 1 and η d = 0.25 are situated in the secure region for all values of µ ≤ 2.

For the "single-photon state" protocol, the security threshold of Eq. (4.3) is constant and equal to 7/8 = 0.875 for all values of µ. Our experimental data, interpreted as if resulting from single-photon states with a polarization purity p = 0.93 and an efficiency 0.02 ≤ µ ≤ 1, are secure and show a value of c well above the security threshold. We also notice that the protocol can tolerate large attenuations even for relatively low values of purity.

The measured values for c allow us to estimate the number n of qubit pairs required for our prepaid quantum credit card scheme (corresponding to the game G ) to reach a high level of security. In Fig. 4.7, we show values for the correctness and security parameters c and defined in Eq. (4.6) for the "single-photon state" protocol, using the experimental values c = 0.953±0.011 for µ = 1 (full red line), c = 0.966±0.018 for µ = 0.10 (dashed red line) and c = 0.953 ± 0.014 for µ = 0.025 (dotted red line). We see that, as drops quickly with the number of qubit pairs n, a measured credit card state consisting of a number of pairs comprised between 10 4 and 10 5 is sufficient to reach an arbitrarily small cheating probability in this case, for a wide range of efficiencies µ ∈ [0.025; 1]. Note that when estimating c and , we use the lowest value for the experimental value of c taking into account error bars of 5σ. In this way, there is a probability no higher than 10 -6 that the true c value actually lies beneath this point.

In Fig. 4.7, we also display values for the correctness and security parameters c and defined in Eq. (4.12) for the "weak coherent state" protocol, using the experimental values c = 0.953 ± 0.011 for µ = 1 (full blue line), c = 0.965 ± 0.010 for µ = 0.40 (mixed blue line), c = 0.966 ± 0.018 for µ = 0.10 (dashed blue line) and c = 0.953 ± 0.014 for

Independent work

Results outline

Independent work also simultaneously reported a first proof-of-principle implementation of quantum money with classical verification in [START_REF] Guan | Experimental preparation and verification of quantum money[END_REF]. Here, the classical verification is also based on quantum retrieval games and also assumes communication with a trusted payment terminal. Instead of encoding the secret key bits into the standard {|0〉 , |1〉 , |+〉 , |-〉} states, however, the mint encodes each secret n-bit string x = x 1 x 2 x 3 x 4 into the phase degree of freedom of a hidden matching state:

|φ x 〉 = 1 2 4 i=1 (-1) x i |i〉 . (4.21)
In order to perform the verification, the trusted terminal then randomly picks a pair (i, j) from one of the three possible pairwise-disjoint sets of matchings, in order to output the correct phase parity (x i ⊕ x j ) to the bank:

M 1 = {(1, 2), (3, 4)} M 2 = {(1, 3), (2, 4)} M 3 = {(1, 4), (2, 3)} (4.22)
Here, the security of the protocol still arises from conjugate coding (Section 3.1.1) , since a dishonest client willing to duplicate the money does not know which matching will be picked by the terminal for verification: a measurement performed in the basis which outputs the correct phase parity for a chosen matching destroys any information contained in the phase parity of the other matchings.

When it comes to implementation, n-dimensional hidden matching states have never been produced for n > 2, and so this experiment also exploits the existence of a mapping to the coherent state framework. The phase of each component of the hidden matching state is encoded into the phase of a weak coherent state from the following train of pulses:

1 2 4 i=1 (-1) x i |i〉 ⇒ 4 i=1 |(-1) x i α〉 (4.23)
The terminal's random choice of matching is then implemented by using a 1x3 beamsplitter, followed by an unbalanced Mach-Zehnder interferometer in each output arm to measure the phase parity.

Comparison

In this section, we attempt to provide a theoretical and experimental comparison of both proof-of-principle implementations. The major points are summarized in Table 4.1.

Regarding noise tolerance, the encoding used in this thesis allows for 20% (assuming phase-randomization), whereas the implementation from [START_REF] Guan | Experimental preparation and verification of quantum money[END_REF] tolerates 16.6%. It is worth noting, however, that increasing the dimension N of the hidden matching state (that is, generating blocks of N coherent states instead of 4) can bring the noise tolerance arbitrarily close to 25% [START_REF] Amiri | Quantum money with nearly optimal error tolerance[END_REF], although this implies a drastic increase in experimental complexity, as it increases the number of required Mach-Zehnder interferometers to (N -1). Generally, the experimental setup from [START_REF] Bozzio | Experimental investigation of practical unforgeable quantum money[END_REF] is more reproducible and scalable, since it only requires a standard BB84 setup: a polarization controller, a polarization beam-splitter and two single photond detectors. When it comes to the highest average

Conclusion

This chapter reports the first on-the-fly implementation of unforgeable quantum money, assuming non-loss-dependent attacks (except for USD). The demonstration is performed on a practical photonic setup with requirements close to those of standard quantum key distribution systems, which is used for quantum credit card on-the-fly generation and readout. The validation of the quantum money protocol and the chosen experimental conditions anticipate the future use of state-of-the-art quantum storage devices, based on single emitters or atomic ensembles, for real-world realization of credit card states.

We remark that our implementation has minimal channel losses as the transaction is performed locally, while detection losses are processed through the post-selection procedure. As mentioned previously however, deriving conditions for noise and losses separately protects against some loss-dependent attacks only (namely USD attacks).

In Chapter 5, we introduce an optimization framework which treats noise and losses in a unified manner, and makes no assumption on the type of attack. We point out the existence of a practical loss-dependent attack which is specific to quantum money schemes: the 50/50 card split. Furthermore, we extend the practical quantum money framework to allow for malicious payment terminals.

PRACTICAL SECURITY FOR TRUSTED AND UNTRUSTED

PAYMENT TERMINALS

Motivation

Practical security analyses for quantum key distribution (QKD) and quantum money require different figures of merit. In QKD, protocols must be optimized to perform over large distances in order to boost the secret key rate [START_REF] Boaron | Secure quantum key distribution over 421 km of optical fiber[END_REF][START_REF] Diamanti | Practical challenges in quantum key distribution[END_REF]. A noisy and lossy quantum channel will therefore decrease this rate. In quantum credit card schemes, distance is not a concern since the quantum states are measured locally by the payment terminal, and the verification is performed over a classical channel. However, security proofs must take into account attacks which do not occur in QKD schemes. Searching for the optimal strategy involves optimizing over all cloning maps, such that the output of the map is accepted by two spacelike-separated branches of the bank. In this scenario, one extremely powerful attack is the 50/50 card split: when losses are not monitored, an adversary may simply split the original honest credit card state in two, and send the first half to one terminal and the second to the other. Upon verification, both banks will then accept the card with probability 1, and the adversary will effectively extract twice the amount of money associated with the original credit card. This implies that quantum credit card schemes cannot be considered secure in implementations with under 50% transmission efficiency. The conditions will be even more stringent in the presence of a quantum storage device, since the security will become time-dependent. This will mostly be treated in Chapter 6.

In this chapter, we provide a rigorous and unified security proof which considers all subtle trade-offs between noise and losses that an adversary may exploit, as opposed to the separate treatment of these imperfections in Chapter 4. For this reason, we present a semidefinite programming framework in which either noise or losses is incorporated as the objective function, and the other parameter as the constraint. We then use the dual structure of semidefinite programs, presented in Section 2.2.4, to prove that an adversary does not gain any advantage in correlating the n coherent states in the credit card to better cheat.

Note that the pair formalism, used and extended in Chapter 4, provides an elegant framework to derive security bounds for quantum credit card schemes in ideal conditions.

However, when extended to practical scenarios involving coherent states, noise and losses, the security analysis becomes somewhat artificial, and sometimes incomplete. For example, the case where one of the states in the pair is a vacuum state (either due to channel losses or to the intrinsic vacuum component of coherent states) is not explicitly treated, in which case the pair structure becomes less relevant. When most pairs are incomplete, it indeed makes little sense to use this over single coherent states, as the original aim was to allow the terminal to pick a challenge randomly by measuring both states in the pair. In this chapter, we therefore consider the single-state version of the protocol from Chapter 4.

Finally, our security analysis deals with untrusted payment terminals. As emphasized in Section 3.2.3, it is difficult to ensure that the terminal follows the protocol's measurements honestly. When controlled by a malicious party, the terminal may in fact perform any POVM on the original credit card state in order to better clone the card.

In quantum cryptography, semi-device-independent frameworks have been developed in order to limit the needed assumptions to ensure security. While not as stringent as full device independence [START_REF] Acin | Deviceindependent security of quantum cryptography against collective attacks[END_REF], this approach allows for practical security and performance while making fewer assumptions on the implementation than usual security proofs.

This includes assumptions on the detectors [START_REF] Ma | Improved data post-processing in quantum key distribution and application to loss thresholds in device independent qkd[END_REF][START_REF] Branciard | One-sided device-independent quantum key distribution: Security, feasibility, and the connection with steering[END_REF][START_REF] Lo | Measurement-device-independent quantum key distribution[END_REF][START_REF] Braunstein | Side-channel-free quantum key distribution[END_REF], the dimensionality of the quantum states [START_REF] Liang | Semi-device-independent bounds on entanglement[END_REF][START_REF] Pawłowski | Semi-device-independent security of one-way quantum key distribution[END_REF][START_REF] Gittsovich | Key rate for calibration robust entanglement based bb84 quantum key distribution protocol[END_REF] and other parameters [START_REF] Van Himbeeck | Semi-device-independent framework based on natural physical assumptions[END_REF]. For quantum money, semi-device-independence relates to scenarios where one does not trust the terminal, as in this work and [START_REF] Horodecki | Semi-device independent quantum money[END_REF][START_REF] Jiráková | Experimentally attacking quantum money schemes based on quantum retrieval games[END_REF],

along with scenarios where the state preparation [START_REF] Horodecki | Semi-device independent quantum money[END_REF] or the terminal is trusted but imperfectly characterized. Note that the former may also be labelled one-sided device independence.

In this chapter, we incorporate semi-device-independence to deal with both trusted and untrusted payment terminals in the presence of experimental imperfections. We extend the semidefinite programming techniques from [START_REF] Molina | Optimal counterfeiting attacks and generalizations for wiesner's quantum money[END_REF][START_REF] Watrous | Semidefinite Programming[END_REF][START_REF] Vandenberghe | Semidefinite programming[END_REF] to the coherent state framework and use the squashing model from [START_REF] Beaudry | Squashing models for optical measurements in quantum communication[END_REF][START_REF] Gittsovich | Squashing model for detectors and applications to quantum key distribution protocols[END_REF], of which a brief outline is given in Appendix B.1. We remark that recent and concurrent work by Horodecki and Stankiewicz [START_REF] Horodecki | Semi-device independent quantum money[END_REF] also studies semi-device-independent quantum money, in a stronger threat model than here (scenario (iv) of Table 3.1), but without our focus on realistic implementation.

A brief description of this work is provided in Section 5.5.

Protocol and correctness

The protocol here is simplified to a classical verification variant of Wiesner's single state scheme from Section 3.2.2. In this three-party quantum money scheme, the mint generates a random secret classical key k (s) and encodes it according to a secret classical basis key b (s) . The quantum credit card state associated to public serial number s and secret classical keys k (s) and b (s) may then be written as:

|e (k,b) 〉 = n j=1 |ψ (k,b) j 〉 , (5.1)
where |ψ Note that these challenges are simply the single-state version of the qubit pair challenges from Section 4.2. The difference is that the terminal must now actively select a random measurement basis for each state in the credit card, instead of measuring all states in the same basis. The honest terminal measures the qubit in the basis associated with the given challenge, which provides the honest success probability or correctness c = 1. The answers corresponding to the measurement results are sent in the form of a classical bit string to the bank, which compares it with k (s) and b (s) and accepts the credit card only if all the measurement outcomes coincide. Bearing in mind the aim to make the protocol practical and implementable, we now consider the same honest protocol in which qubit states are mapped onto two-mode weak coherent states as:

|0〉 → |α〉 ⊗ |vac〉 |1〉 → |vac〉 ⊗ |-α〉 |+〉 → | α 2 〉 ⊗ | α 2 〉 |-〉 → | α 2 〉 ⊗ |-α 2 〉 |+i〉 → | α 2 〉 ⊗ |i α 2 〉 |-i〉 → | α 2 〉 ⊗ |-i α 2 〉 , (5.2
f h ≈ e -η d µ (5.3)
represents the honest losses assuming a weak coherent light source with average photon number per pulse µ = |α| 2 , unit channel transmission efficiency, and threshold singlephoton detectors with detection efficiency η d . When no detection occurs, the terminal reports a flag, denoted by ∅. For large sample sizes, the n-state challenge is then satisfied only if the total number of no-detection reports is equal to f h n.

The multi-photon component of coherent states may also trigger clicks on both detectors at the same time. An adversary may actually exploit this property to boost their cheating probability. Following the methods used in [START_REF] Beaudry | Squashing models for optical measurements in quantum communication[END_REF], clicks on both detectors are randomly mapped to a single click as either a 0 or 1. This allows to use a squashing model to securely map the infinite-dimensional threshold detection POVMs to a finite dimensional Hilbert space. A brief outline of this model is provided in Appendix B.1.

Security

Principle and proof outline

In Table 5.1, we recall all possible adversarial scenarios for quantum credit card schemes in terms of honest and dishonest parties from Section 3.2.3. A successful forging attack consists in answering two challenges correctly at the same time, corresponding to extracting twice the original amount of money in one's possession. As the last four states 5.3. SECURITY from Eq. (5.2) are identical on the first mode, we may reduce our security analysis to the single state:

|α k 〉 = |i k α 2 〉 (5.4)
with k ∈ {0, 1, 2, 3}, before extending it to n states in Section 5.4.3.

In scenario (ii) from Table 5.1, the mint, the bank and the vendor trust each other.

The only untrusted party is therefore the client, who brings their credit card state to the vendor's terminal for verification. In scenario (iii), only the mint and the bank trust each other, which implies that the quantum measurements and classical data sent by the terminal upon verification cannot be trusted. In other words, the dishonest client and the vendor's terminal may cooperate in attempting to forge the credit card. In this case, a successful attack is materialized by the communication of two classical strings by two untrusted terminals to the bank, which accepts both of them.

In a coherent state implementation, the adversary may modify one or both of the following parameters: losses f d (probability of a projection onto the vacuum state), and error rate e. The bank may detect an attack when f d > f h or when the measured error rate e upon verification is larger than expected. Given average photon number µ, we use SDP techniques from Section 2.2 to first minimize the losses that the adversary must introduce in (ii) or declare in (iii) to succeed with probability (1 -e). We can then identify the range of µ for which f d > f h .

We will use Choi's theorem from Section 2.1.4 to optimize over the best adversarial linear cloning map. For (ii), the figure of merit for the optimization is based on the measurements of the two trusted terminals. For (iii), the figure of merit becomes the acceptance of classical data by the bank. We then show how this single state analysis gives a bound for the n-state proof. We also note the following useful lemma, proven in Appendix B.2:

Lemma 5.1. Given |ψ 1 〉 ∈ H d 1 , |ψ 3 〉 ∈ H d 3 ,
and Choi-Jamiołkowski operator J(Λ) associated to map Λ, we have:

Tr |ψ 3 〉 〈ψ 3 | Λ(|ψ 1 〉 〈ψ 1 |) = Tr |ψ 3 〉 〈ψ 3 | ⊗ |ψ 1 〉 〈ψ 1 | J(Λ) , (5.5)
where the overline denotes complex conjugation.

Trusted terminal

We shall first study the trusted terminal scenario (ii). In the single qubit case, the minimum adversarial error probability is the same as in Wiesner's original quantum verification scheme, namely e = 1/4 [START_REF] Wiesner | Conjugate coding[END_REF][START_REF] Molina | Optimal counterfeiting attacks and generalizations for wiesner's quantum money[END_REF]. We recall that an explicit attack to achieve this probability is provided in Section 3. Let Λ be the optimal adversarial map which produces two copies (living in

H 1 ⊗ H 2 )
of the original quantum credit card state ρ mint , living in H mint :

ρ mint = 1 4 3 k=0 |α k 〉 〈α k | . (5.6)
Note that we may write the infinite-dimensional coherent states

|α k 〉 = |i k α 2 〉 in a
four-dimensional orthonormal basis {|φ j 〉}, with j ∈ {0, 1, 2, 3}, as:

|α k 〉 = 1 4 3 j=0 C j e i jk π 2 |φ j 〉 , (5.7)
where

C 0 = e -|α| 2 4 2 cosh α 2 2 + cos α 2 2 C 1 = e -|α| 2 4 2 sinh α 2 2 + sin α 2 2 C 2 = e -|α| 2 4 2 cosh α 2 2 -cos α 2 2 C 3 = e -|α| 2 4 2 sinh α 2 2 -sin α 2 2 .
In this basis, the probability p 1 (resp. p 2 ) that a trusted terminal declares an incorrect measurement outcome for credit card 1 (resp. 2) is then given by:

p 1 = Tr 3 k=0 1 2 |β ⊥ k 〉 〈β ⊥ k | ⊗ 1 Λ( 1 4 |α k 〉 〈α k |) p 2 = Tr 3 k=0 1 ⊗ 1 2 |β ⊥ k 〉 〈β ⊥ k | Λ( 1 4 |α k 〉 〈α k |) , (5.8)
where Tr E 1 (µ)J(Λ) and Tr E 2 (µ)J(Λ) , where E 1 (µ) and E 2 (µ) are the error operators,

|β
E 1 (µ) = 1 4 3 k=0 1 2 |β ⊥ k 〉 〈β ⊥ k | ⊗ 1 ⊗ |α k 〉 〈α k | E 2 (µ) = 1 4 3 k=0 1 ⊗ 1 2 |β ⊥ k 〉 〈β ⊥ k | ⊗ |α k 〉 〈α k | , (5.9)
and µ = |α| 2 is the average photon number in a pulse. Following a similar method, the probability that terminal 1 (resp. 2) registers a no-detection event on credit card 1 (resp. 2) reads Tr L 1 (µ)J(Λ) (resp. Tr L 2 (µ)J(Λ) ), where L 1 (µ) and L 2 (µ) are the loss operators, which contain the projection onto the state |∅〉:

L 1 (µ) = 1 4 3 k=0 |∅〉 〈∅| ⊗ 1 ⊗ |α k 〉 〈α k | L 2 (µ) = 1 4 3 k=0 1 ⊗ |∅〉 〈∅| ⊗ |α k 〉 〈α k | .
(5.10)

We now search for the optimal cloning map Λ that minimizes the losses that the adversary must introduce on both credit cards for a given error rate e. We cast this problem as the following SDP for a card with a single state:

min Tr L 1 (µ)J(Λ) s.t. Tr H 1 ⊗H 2 (J(Λ)) = 1 H mint Tr E 1 (µ)J(Λ) = e Tr E 1 (µ)J(Λ) Tr E 2 (µ)J(Λ) Tr L 1 (µ)J(Λ) Tr L 2 (µ)J(Λ) J(Λ) 0.
(5.11)

The first constraint imposes that Λ is trace-preserving, the second imposes error e when card 1 is measured by terminal 1, the third and fourth impose that the error and losses on card 1 are at least equal to those on card 2, and the fifth imposes that Λ is completely positive.

In Section 5.4.3, we derive the dual problem associated with problem (5.11), and provide numerical evidence for strong duality (i.e. we show that the optimal value is a global minimum). We also extend the problem to n states and use strong duality to show that the optimal solution does not change in this case: the adversary cannot decrease f d by correlating the n states.

Untrusted terminal

In the untrusted terminal scenario (iii), the adversary aims to provide two classical outcome strings from two different untrusted terminals which are both accepted by the bank. The minimum error in the lossless qubit case yields e = 1/8 [START_REF] Molina | Optimal counterfeiting attacks and generalizations for wiesner's quantum money[END_REF]. For a state encoded in basis b, the corresponding simple strategy reads:

c i =
2 × 1 + 1 2 × 1 2 = 3 4 .
Since the bank will ask each of these challenge combinations with probability 1 2 , then we have a total success probability 7 8 , which yields e = 1 8 . When transitioning to the coherent state framework, we recast (5.11) with newly defined error and loss operators:

E 1 (µ) = 1 16 1 i, j=0 k∈{i,i+2} |a ⊥ ik 〉 〈a ⊥ ik | ⊗ 1 ⊗ |c i , c j , α k 〉 〈c i , c j , α k | E 2 (µ) = 1 16 1 i, j=0 k∈{i,i+2} 1 ⊗ |a ⊥ ik 〉 〈a ⊥ ik | ⊗ |c i , c j , α k 〉 〈c i , c j , α k | L 1 (µ) = 1 16 1 i, j=0 3
k=0 |∅〉 〈∅| ⊗ 1 ⊗ |c i , c j , α k 〉 〈c i , c j , α k | L 2 (µ) = 1 16 1 i, j=0 3
k=0 1 ⊗ |∅〉 〈∅| ⊗ |c i , c j , α k 〉 〈c i , c j , α k | .
(5.12)

We use braket notation to denote the correct classical answer |a ik 〉 to challenge |c i 〉, given state |α k 〉. These vectors are all orthogonal to one another, and live in a 3-dimensional space spanned by classical answers {|a 0 〉 , |a 1 〉 , |∅〉}, where the last vector corresponds to a classical no-detection flag. We label the orthogonal (wrong) answer as |a ⊥ ik 〉.

Optimization results

Single state

Solving (5.11) numerically with CVX software [START_REF] Grant | CVX: Matlab software for disciplined convex programming, version 2.1[END_REF][START_REF] Grant | Graph implementations for nonsmooth convex programs[END_REF] provides the results in Fig. It is also interesting to analyze our results in this phase-randomized setting for finite detection efficiency η d , as we will use these bounds to derive secure experimental parameters in the quantum memory setup from Chapter 6. Fig. 5.3 shows that security may be achieved in the trusted terminal scenario using state-of-the-art single-photon detectors [START_REF] Hadfield | Single-photon detectors for optical quantum information applications[END_REF][START_REF] Lita | Counting near-infrared single-photons with 95% efficiency[END_REF], depending also on the target error rate, while the untrusted scenario puts much more stringent constraints on the required devices.

Alternative SDP formulation

Here, we provide an alternative SDP to (5.11) which allows to minimize error e given a fixed µ and detection efficiency η d . This formulation clearly allows to identify the effects of the 50/50 card split attack, in which the adversary can simply split the card in two and send half of it to each terminal without introducing any error (see Fig. 5.4). The primal problem may be expressed as:

min Tr E 1 (µ)J(Λ) s.t. Tr H 1 ⊗H 2 (J(Λ)) = 1 H mint Tr E 1 (µ)J(Λ) Tr E 2 (µ)J(Λ) Tr L 1 (µ)J(Λ) e -η d µ
Tr L 2 (µ)J(Λ) e -η d µ J(Λ) 0

(5.13)

The first constraint imposes that Λ is trace-preserving, the second imposes that the error on card 1 is greater or equal to that on card 2, the third and fourth impose that the losses on each card are smaller or equal to the honest expected losses f h , and the fifth imposes that Λ is completely positive.

Numerical results are displayed in Fig. 5.4 for fixed-phase coherent states and Fig. 5.5 for phase-randomized states, in a trusted terminal scenario. We will actually use these results as the basis of our full demonstration of a trusted-terminal quantum credit card scheme in Chapter 6. These allow to find the value of µ for which the noise tolerance is highest given detection efficiency η d . Roughly, the optimal average photon number lies around µ = 0.50 with fixed phase and µ = 1 for phase-randomized states. In the phase-randomized setting, the maximal noise tolerance is much higher (around 2.5%) than in the fixed-phase setting (around 0.4%). Finally, we notice that allowing for 50% transmission allows the adversary to win without introducing any error. TERMINALS

Extension to n parallel repetitions

The aim of this section is to extend SDP (5.11) to a credit card containing n states, and to derive its corresponding dual problem. In order to show that the adversary does not gain any advantage in correlating the n states to better succeed, we will first show that a tensor product of n optimal solutions of (5.11) is a feasible solution to this new n-state primal SDP. We then have to show that there also exists a feasible solution for the associated dual problem which yields the same optimal value as that of the primal.

As explained in Section 2.2, such a feature is known as strong duality, and implies that these feasible solutions are both the optimal solutions to the primal and dual problem, respectively.

To generalize the loss and error operators to the n parallel repetition case, we introduce the projector P (n, j, C ) which, given a collection C of n quantum states living in Hilbert space H (n) , projects onto j n elements of C and the orthogonal subspace of the (nj) other elements. More formally, we define this operator as:

P (n, j, C ) = s( j) n-1 i=0 s i ( j)C i + s i ( j)(1 -C i ) , (5.14)
where C i is the i-th quantum state of C and s i ( j) is the i-th element of a binary string s( j) of length n which contains (n-j) zeros. The summation then runs over all n j possible s( j) strings. Considering a new adversarial cloning map Λ (n) from the original n-state credit card living in H (n) mint to a duplicated credit card space H (n) 1 ⊗ H (n) 2 , the new loss operators may then be written as:

L (n) 1 (µ) = 1 4 n n j=1 3 k 1 •••k n =0 j n P n, j, C (∅,n) ⊗ 1 H (n) 2 ⊗ |α k 1 〉 〈α k 1 | ⊗ • • • ⊗ |α k n 〉 〈α k n | L (n) 2 (µ) = 1 4 n n j=1 3
k 1 •••k n =0 1 H (n) 1 ⊗ j n P n, j, C (∅,n) ⊗ |α k 1 〉 〈α k 1 | ⊗ • • • ⊗ |α k n 〉 〈α k n | , (5.15)
where C (∅,n) = {|∅〉 〈∅|} n . The factors j n ensure that the total sum is normalized, as we are dealing with probabilities and not events. The new error operators read:

E (n) 1 (µ) = 1 4 n n j=1 3 k 1 •••k n =0 j n P n, j, C (k 1 ,.,k n ) ⊗ 1 H (n) 2 ⊗ |α k 1 〉 〈α k 1 | ⊗ • • • ⊗ |α k n 〉 〈α k n | E (n) 2 (µ) = 1 4 n n j=1 3 k 1 •••k n =0 1 H (n) 1 ⊗ j n P n, j, C (k 1 ,.,k n ) ⊗ |α k 1 〉 〈α k 1 | ⊗ • • • ⊗ |α k n 〉 〈α k n | , (5.16)
e 10 -6 10 -3 0.01 0.02 0.05 0.10 µ 0.01 0.05 0.10 0.50 1.00 2.00 Table 5.2: Numerical optimal values for dual problem (5.19) were found for all possible combinations of the above e and µ values, using the SDPT3 solver from the CVX software with its default numerical precision (10 -9 ). These solutions obeyed the constraints (5.20) within numerical accuracy and all present a duality gap of order 10 -9 . We note that, when e < 10 -6 , the solver struggles to find an accurate solution for some low values of µ, as it fails to decrease the duality gap to less than 10 -7 . The inaccurate optimal dual solutions are nevertheless close to the accurate primal optimal solutions within 10 -4 .

where

C (k 1 ,...,k n ) = { 1 2 |β ⊥ k 1 〉 〈β ⊥ k 1 | , . . . , 1 2 |β ⊥ k n 〉 〈β ⊥ k n |}.
For a credit card containing n states, problem (5.11) may then be recast as:

min Tr L (n) 1 (µ)J(Λ (n) ) s.t. Tr H (n) 1 ⊗H (n) 2 J(Λ (n) ) = 1 H (n) mint Tr E (n) 1 (µ)J(Λ (n) ) = e Tr E (n) 1 (µ)J(Λ (n) ) Tr E (n) 2 (µ)J(Λ (n) ) Tr L (n) 1 (µ)J(Λ (n) ) Tr L (n) 2 (µ)J(Λ (n) )
J(Λ (n) ) 0

(5.17)

To derive the dual problem associated with (5.17), we first note that we can replace all inequalities by equalities (except the last semidefinite positive constraint) without loss of generality. This is due to the fact that the adversary can always symmetrize the probabilities by increasing the error rate or losses on card 2 to make them equal to those on card 1. The right hand side elements of the constraints from (5.17) may then be gathered in a (4 2n + 3)-dimensional column vector b (n) . The first three elements read (e, e, 0), and correspond to the value of Tr

E (n) 1 (µ)J(Λ (n) ) , Tr E (n) 2 (µ)J(Λ (n) ) and Tr L (n) 1 (µ) -L (n) 2 (µ) J(Λ (n) )
, respectively. The 4 2n other elements, corresponding to the first, trace-preserving constraint of (5.17), may be written as the vector representation of the identity over space H (n) mint . The vector representation vec(O) of an operator O is obtained through the following isomorphism [94] :

d i j=1 O i j |i〉 〈 j| → d i j=1 O i j |i〉 ⊗ | j〉 .
(5.18)

The dual problem then maximizes the overlap of variable d (n) with constraint vector b (n) as:

max b (n)T d (n) = ed (n) 1 + ed (n) 2 + Tr(D (n) ) s.t. d (n) 1 E (n) 1 (µ) + d (n) 2 E (n) 2 (µ) + d (n) 3 L (n) 1 (µ) -L (n) 2 (µ) + 1 H (n) 1 ⊗H (n) 2 ⊗ D (n) -L (n) 1 (µ) 0, (5.19)
where D (n) is a 4 n × 4 n matrix containing the elements d (n) 4 to d (n) 4 2n +3 arranged in order left to right, top to bottom.

We note that a tensor product of optimal solutions J(Λ (n) ) = n j=1 J(Λ) represents a feasible solution to primal problem (5.17), as it satisfies all the constraints. We label the associated primal objective function value as s (n) p , and remark that s (n) p = s (1) p = f d for all n. We then search for a feasible solution d (1) to the dual problem (5.19) which allows to achieve s (1) p = s (1) d , where s (1) d is the dual objective function value. While we were not able to find a generic analytical solution to this problem, we have always found a numerical solution d (1) for a representative set of parameters µ and e (specified in Table 5.2), satisfying:

d (1)
1 , d (1) 2 < 0 D (1) i j = 0 for i = j d (1) 3 = 0.5 Tr(D (1) ) = s (1) p -(d (1) 1 + d (1) 2 )e, (5.20) and presenting a duality gap of order 10 -9 . Furthermore, adding the last condition as constraint to the SDP does not change the optimal value (within 10 -4 error, due to the fact the the value of s (1) p is a numerical primal optimal value which is rounded up when added as a constraint in the dual problem). We now conjecture that these conditions can be enforced for all n. The conditions on d (1) 1 , d (1) 2 , d (1) 3 then allow the following expression of the dual constraint with Tr(D

(n) ) = s (n) p -(d (n) 1 + d (n)
2 )e :

-|d (n) 1 |E (n) 1 (µ) -|d (n) 2 |E (n) 2 (µ) -0.5 L (n) 1 (µ) + L (n) 2 (µ) + 1 H (n) 1 ⊗H (n) 2 ⊗ D (n) 0. (5.21)
Since the error and loss operators are all positive semidefinite, then it follows that the sum of the first four terms in (5.21) is always a negative semidefinite operator.

Numerically, it appears to be possible to satisfy (5.21) by choosing appropriately the diagonal elements of D (n) .

In conclusion, we have found two feasible solutions such that s (1) p = s (1) d , and strong duality seems to hold for problems (5.17) and (5.19), at least up to numerical precision.

The optimal solution to the primal problem for n states can therefore be written as a tensor product of optimal solutions to the primal problem for n = 1 state. This implies that the adversary does not gain any advantage in correlating the states in the card when performing an attack against a trusted terminal without phase randomization. A Figure 5.6: Equalities between optimal values and how they were established.

We have shown numerically that strong duality holds for the 1-state problems: s (1) p = s (n) d . We have shown analytically that the optimal solution of the 1-state primal problem is a feasible solution for the n-state primal problem, which implies s (1) p = s (n) p provided that the conditions from Eq. (5.20) also hold for n states, as conjectured. similar approach works to prove strong duality for the untrusted terminal case, and we conjecture that this method also works for both scenarios with phase-randomized states.

Independent work

Independent work also simultaneously reported a semi-device-independent quantum money security proof in [START_REF] Horodecki | Semi-device independent quantum money[END_REF]. The initial focus, however, differs from ours as it is not targeted towards practical implementation and aims at treating the more extreme scenario of all parties being dishonest but the verification bank: scenario (iv) from Table 5.1. The cost of this stronger threat model is that the quantum states sent by the adversary must be assumed to have bounded dimension (here, 2 dimensions = a qubit), and qubit-by-qubit counterfeiting only is considered. In our case, we do not limit ourselves to such attacks (Section 5.4.3), but part of the proof relies solely on numerical evidence.

The quantum information literature actually initially used the terminology "semidevice-independent" (SDI) from [START_REF] Pawłowski | Semi-device-independent security of one-way quantum key distribution[END_REF] to describe scenarios in which the quantum data has bounded dimension, as in [START_REF] Arora | Quantum weak coin flipping[END_REF]. However, the terminology in our work is used to design other assumptions:

(i) The device is partially uncharacterized. Here, we only make an assumption on the type of device used (threshold detector) in order to reduce our infinite-dimensional security analysis to a 3-dimensional space. This follows the definition from [START_REF] Mironowicz | Experimentally feasible semi-deviceindependent certification of 4 outcome povms[END_REF], in which SDI can apply to cases where some assumptions are made on the device (of which a dimension constraint is one example, but not the only one): «a popular relaxation of this approach is called semi-device-independent (SDI), where some assumptions regarding devices are made. The most common assumption is a constraint on the dimension of quantum systems». Another example is the talk from [START_REF] Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF], in which Pironio defines SDI as simply "based on few assumptions", and gives one-sided quantum cryptography or measurement-device-independence as examples.

(ii) One of the two devices is completely untrusted. This follows the definition from [START_REF] Bavaresco | Semi-device-independent certification of indefinite causal order[END_REF]: «a semi-device-independent certification scenario is one in which at least one party is device-dependent, which is often called trusted, and at least one is device-independent, often called untrusted.»

Conclusion

By establishing an optimization framework in the coherent state setting, we have derived secure regions of operation for quantum credit card schemes in both trusted and untrusted terminal scenarios. With phase-randomized states, we have shown that the former case can be secure using a setup with detection efficiency η d > 80% and noise tolerance around e = 1-2%, while the latter case requires tighter parameters: η d > 95% and noise tolerance lower than e = 1%. The conditions for the trusted terminal are achievable with current nanowire single photon detectors (η d ≈ 85%) and the cold atomic quantum memory setup from [START_REF] Vernaz-Gris | Highly-efficient quantum memory for polarization qubits in a spatially-multiplexed cold atomic ensemble[END_REF], which presents high state fidelity ≈ 99% and has now been improved to allow 85% storage/retrieval efficiency.

Using the duality of semidefinite programs, we have provided numerical evidence that the adversary cannot increase his/her cheating probability by correlating the n states in the credit card. In such a setting, the uncertainty on the tolerated number of incorrect outcomes en and excess losses f d n scales as n .

EXPERIMENTAL DEMONSTRATION OF GENUINE CREDIT

CARD STORAGE

Motivation

This chapter focuses on the experimental demonstration of a trusted terminal quantum credit card scheme including the full quantum storage process. Although the setup is currently being optimized and the results are in progress, we describe the experiment in detail and focus on new practical security issues. Following the remarks and results from Chapters 4 and 5, the contributions in this chapter are two-fold.

On the theory side, we propose an implementation which is secure against all lossdependent attacks, including the previously mentioned USD and 50/50 card splitting attacks, assuming that the quantum storage device only is imperfect. For this purpose, we use the general numerical bounds from Chapter 5 to calculate the range of experimental parameters for which the proposed implementation can be information-theoretically secure. We then closely investigate the physical setup, and state under which assumptions these bounds can be satisfied experimentally. We raise new security questions, including the possibility of phase randomization in the presence of electromagneticallyinduced transparency, and the need for a time-dependent security proof to account for the decoherence of the quantum memory.

On the experimental side, we change two major components with respect to Chapter 4. First, the polarization-encoded weak coherent states are now generated in free space, at 894nm instead of 1550nm, in order to fully match the requirements of the quantum storage device. Second, we add the quantum storage device itself, which consists of a lasercooled, magneto-optically trapped, cloud of cesium atoms, provided by Laboratoire Kastler Brossel [START_REF] Vernaz-Gris | Highly-efficient quantum memory for polarization qubits in a spatially-multiplexed cold atomic ensemble[END_REF]. By generating electromagnetically-induced transparency, introduced in Section 2.3.3, the effective polarization qubit contained in each state can be mapped onto a collective atomic excitation, before being retrieved on demand. Furthermore, the cloud is spatially trapped by two pairs of coils only to achieve an elongated, cigar-type shape [START_REF] Vernaz-Gris | Highly-efficient quantum memory for polarization qubits in a spatially-multiplexed cold atomic ensemble[END_REF]. This spatial configuration allows for high storage and retrieval efficiency, which is required to satisfy the strict security bounds from Chapter 5.

Protocol

In this section, we recall the trusted terminal protocol from Chapter 5, and describe it from a more practical perspective:

1) The mint generates an N-bit secret classical key k (s) , where s is the unique public serial number of the quantum credit card. For each bit, it picks either the horizontal/vertical {H, V } polarization basis or the diagonal/antidiagonal {D, A} polarization basis at random. The information is then encoded onto the following coherent states: 2) The states are stored in the quantum memory, and handed to a client.

|H(α)〉 = |α〉 ⊗ |0〉 |V (α)〉 = |0〉 ⊗ |-α〉 |D(α)〉 = | α 2 〉 ⊗ | α 2 〉 |A(α)〉 = | α 2 〉 ⊗ |-α 2 〉 , ( 6
3) When the client wishes to make a payment, the states are retrieved from the quantum memory by a trusted payment terminal (measurement setup), which measures all N of them in either the {H, V } or the {D, A} basis, picked at random.

4)

The measurement outcomes and their basis, along with the serial number s, are sent to the distant bank in the form of classical data. After randomly assigning an outcome to any double-click, the bank checks that at least (1 -e) of these outcomes coincide with the secret key k (s) , and that the number of no-detection outcomes do not exceed the honest 6.3. EXPERIMENTAL PRINCIPLE calibrated losses. Provided that these conditions are satisfied, the credit card is accepted and the payment can proceed. Otherwise, the protocol aborts.

Experimental principle 6.3.1 Outline

Figure 6.1: The atomic Λ-system in our experiment. The signal field is tuned to the D 1 line of cesium (≈ 894 nm). This transition arises from the fine structure splitting, which occurs from the interaction of the electrons' spin with their orbital angular momentum. The Λ-system appears between the hyperfine levels, which are created by the interaction of the nuclear magnetic dipole moment with the magnetic field generated by the electrons. Our signal field is specifically tuned to the S, F3 → P, F4 transition, while the control field is tuned to the S, F4 → P, F4 transition. Further unwanted Zeeman splitting occurs due to the magnetic fields which are used to trap the atoms. These are responsible for the main decoherence process in the quantum memory.

The original figure may be found in [START_REF] Tiporlini | High sensitivity optically pumped quantum magnetometer[END_REF].

Here, we briefly describe the proposed experimental steps leading to the demonstration of the trusted terminal scheme from Section 6.2:

• State preparation: The mint generates an on-the-fly sequence of coherent states thanks to a continuous laser beam chopped up by an acousto-optic modulator.

Each state's polarization is then encoded in real-time using a voltage-driven phase modulator.

• Quantum storage: The mint maps the two polarization components of each state onto two spatially-multiplexed collective atomic excitations, in a cloud of cold trapped cesium atoms. This is done using the EIT (presented in Section 2.3.3). The three level system used for EIT is created on the hyperfine levels of the cesium D 1 line, as detailed in Fig. 6.1.

• Measurement: The vendor's trusted payment terminal retrieves each state stored in the quantum memory, and performs the measurements dictated by the protocol from Section 6.2, with the help of a half waveplate, a polarization beamsplitter, and two single photon threshold detectors. An additional filtering step is required to eliminate the noise coming from the control pulse used to induce EIT.

• Data processing: The vendor's payment terminal transfers the raw classical measurement outcomes to the bank, which performs the required data analysis and accepts or rejects the credit card.

Setup

We now provide a more detailed description of the experimental setup, organized according to the four steps of Section 6.3.1.

State preparation.

The signal beam is produced by a continuous Toptica DLpro laser at 894 nm, tuned on the cesium D 1 transition pictured in Fig. 6.1. We chop the light into 300ns pulses using an acousto-optic modulator (AOM), whose operation mode is similar to that from Section 4.4.2. The light is attenuated to the desired average photon number per pulse using density filters. We then encode the pulses' polarization with a Pockels cell, essentially acting as a phase modulator: the incident linear polarization must be input at 45 • with respect to the crystal's principal axes, and can then be rotated by changing the refractive index between the two axes through a voltage swing. Note that, unlike the telecom-wavelength implementation from Chapter 4, the shorter wavelength requires a much higher voltage range to rotate the polarization from horizontal to vertical (≈ 0 -700V ). This implies the use of a high-voltage power amplifier which allows such a voltage swing at fairly high repetition rates (≈ 10-100 kHz). We use the PZD350A model from Trek to accomplish this, which preserves the square shape of our voltage steps well enough up to 50 -100 kHz. The sequence of voltage steps, corresponding to the randomly generated states from the protocol, are generated in real-time by the same C++ program and NI acquisition cards similarly to Chapter 4, and fed to the phase modulator.

Quantum storage. We use the phenomenon of electromagnetically-induced transparency (EIT), presented in detail in Section 2.3.3, in a cloud of cold neutral cesium atoms. The exact configuration is a magneto-optical trap (MOT), which involves both laser cooling to around 20µK and spatial atomic trapping with magnetic coils [START_REF] Vernaz-Gris | Highly-efficient quantum memory for polarization qubits in a spatially-multiplexed cold atomic ensemble[END_REF]. The key novelty is the shape of the atomic cloud, which, instead of being spherical, achieves an elongated cigar shape, as depicted in Fig. 6.2. This spatial configuration increases the optical depth of the cloud, which allows to reach high storage/retrieval efficiency, potentially up to 85% [START_REF] Hsiao | Highly efficient coherent optical memory based on electromagnetically induced transparency[END_REF]. The efficiency is currently being optimized to reach such values, which are required to perform our quantum money scheme (refer to Section 6.4.1

for further detail).

The effective qubit (i.e. the polarization of the weak coherent state), is stored within the cloud by spatially multiplexing its two components: the horizontal and vertical components are first separated with a beam-displacer (BD1), before being focused onto the cloud with a lens such that they both intersect in the center with a 0.4 • angular separation. Between the lens and the cloud, a half-wave plate is used to flip the polarization of the vertical mode to horizontal, such that both components have identical polarizations.

These are then changed to right-handed circular polarization with a quarter waveplate, in order to interact optimally with the hyperfine atomic levels from Fig. 6.1.

The setup has to be well synchronized by an FPGA, such that the atoms undergo magneto-optical trapping and are released just before the coherent state arrives. This is required because the strong magnetic trapping fields have to be turned off before performing EIT, in order to avoid additional Zeeman splittings. We note that there inevitably remains Zeeman splittings due to Earth's local magnetic field and the Eddy currents generated by the abrupt switching-off of the trapping fields. This is the main source of decoherence in the quantum memory, as it broadens the spectrum of the hyperfine levels.

This leads to the need for a time-dependent security analyis, as performed in Section 6.5.

In order to limit these splittings, a magnetic field cancellation step must be realized [START_REF] Vernaz-Gris | Highly-efficient quantum memory for polarization qubits in a spatially-multiplexed cold atomic ensemble[END_REF].

A strong control beam, detuned by 9.192 GHz and phase-locked with the signal (Section 6.4.3), is then applied to the cloud to produce EIT. It is applied a second time when the state must be retrieved. We refer the reader to [START_REF] Vernaz-Gris | Highly-efficient quantum memory for polarization qubits in a spatially-multiplexed cold atomic ensemble[END_REF] for a more detailed description of the synchronization process. Once the collective atomic excitation has been mapped back onto a polarization state, the two components exit the cloud and are and focused onto the cloud with a lens (purple disk). Prior to the cloud, the vertical component is flipped to horizontal using a half waveplate (black half-disk). Both horizontal components are then transformed into right-circular using a quarter waveplate (green disk). These are mapped onto a collective atomic excitation, thanks to a control beam which creates EIT. The control beam is re-applied when the polarization states must be retrieved, and the same set of waveplates and beam displacer (BD2) inverts the previous polarization transformation, and recombines the two components. Measurement consists of another half waveplate (black disk) for basis selection and a polarizing beamsplitter (PBS) for projection. Two Fabry-Pérot cavities are used to filter out the control beam.

States are finally detected using two avalanche single photon detectors (APD1 and APD2).

PRACTICAL SECURITY displacer (BD2).

Filtering and measurement. The measurement setup consists of a half waveplate, which selects the measurement basis (oriented at a 0 • or 22.5 • angle with respect to the horizontal mode), followed by a polarizing beamsplitter (PBS), which splits the horizontal and vertical components of the incoming state. Before measuring the states with two 50% detection efficiency avalanche single photon detectors (one for each polarization mode),

we require an extra filtering step, in order to eliminate the control beam contamination. This is realized with two Quantaser FPE001A Fabry-Pérot cavities. The distance between the cavity mirrors can be finely tuned by controlling the temperature inside the cavity.

Since the mirrors are highly reflective, the transmission peak corresponding to the cavity's fundamental mode is very narrow: with fine tuning, we may therefore transmit ≈ 75% of the signal and attenuate the control by 50dB.

Data processing. We register the single photon detectors' TTL signals with the FPGA, allowing precise synchronization with the rest of the setup. A vector of outcomes is then exported as a text file, which, after assigning a random outcome to each doubleclick, helps to compute the loss and error rates.

Practical security

Secure parameter range (reminder)

We briefly review the numerical results from Chapter 5 which are of interest to this implementation. Focusing on the trusted terminal scheme, we recall Fig. 5.4 and remark that the required experimental parameters are too tight for our setup: the highest allowed error rate lies around 0.65% for a setup with 100% total transmission efficiency and average photon number per pulse µ = 0.5. Although the quantum memory achieves high fidelity of around 98% with µ = 0.5 [START_REF] Vernaz-Gris | Highly-efficient quantum memory for polarization qubits in a spatially-multiplexed cold atomic ensemble[END_REF], this will exceed this small allowed error rate.

In order to increase the noise tolerance, we therefore require phase randomization, and recall the corresponding results from Chapter 5, displayed again here in Fig 6 .3. For a reminder of how phase randomization works, and why it increases the noise tolerance, please refer to Section 4.3.4 and Appendix A.2. In this figure, the allowed error rate is increased to almost 3% for 100% total transmission, and to 2% for 85% total transmission with µ ≈ 1. Note that, since the state fidelity of our quantum storage device increases with µ, this new range of parameters can allow us to find the optimal trade-off between STORAGE average photon number and experimental error rate.

Post-selection assumptions

Here, we clearly state the assumptions required to claim a secure demonstration of the quantum money scheme. We start by emphasizing that our single photon detectors exhibit 50% detection efficiency only, which, regardless of the remaining setup losses, is already enough for the 50/50 card split attack to take place. This implies that some form of post-selection must be performed. We therefore argue that, although the demonstration cannot be information-theoretically secure with the current setup, we focus on the novel demonstration of a quantum-cryptographic task that is information-theoretically secure in the presence of an imperfect storage device only.

Effectively, this amounts to assuming an ideal setup with 100% transmission efficiency (regarding state generation, transmission, filtering and detection), to which we add an imperfect and realistic quantum storage device with 85% storage/retrieval efficiency. This assumption can be justified by noting that the key difficulty in quantum money scheme implementations is the quantum memory. Furthermore, the performance of single photon detectors can always be boosted (≈ 85% for superconducting nanowire detectors and 95% for transition-edge sensors [START_REF] Lita | Counting near-infrared single-photons with 95% efficiency[END_REF]), and the channel losses are minimal since the transfer of quantum states is done locally with the payment terminal.

With these assumptions, the detection efficiencies from Fig. 6.3 may now be associated with the storage/retrieval efficiency of the quantum memory, and the secure range of parameters therefore lies along the η d = 85% curve. As long as our quantum memory setup achieves 85% storage/retrieval efficiency and below 2% error rate for values of µ ≈ 1, then we may demonstrate an information-theoretically secure scheme in the presence of a realistic quantum storage device.

Phase locking and randomization

In order to produce successful EIT, the signal and control beams must be locked in phase.

This allows to finely adjust the small detuning of the control with respect to the signal, which must be equal to 9.192 GHz, i.e. the energy difference between the S, F3 and S, F4

hyperfine atomic levels of Fig. 6.1.

Before performing such phase-locking, the signal frequency must first be stabilized and locked on the S, F3 → P, F4 atomic transition. This can be achieved with a warm, room-temperature atomic vapor (as opposed to the cold atomic cloud) through saturated absorption. This technique, which consists of two counter-propagating pump and probe laser beams, allows to finely measure the atomic transition at room-temperature despite the large Doppler broadening which introduces uncertainty on the absorption width.

The first intense pump essentially saturates the atomic medium, i.e. brings 1/2 of the population to the excited state while 1/2 remains in the ground state. The counterpropagating probe beam then triggers stimulated emission in the excited atoms that it encounters, which leads to a dip in the absorption ray. From Fig. 6.1, we note that there are four possible hyperfine transitions on the cesium D 1 line, which leads to four absorption dips. The signal can then be locked onto the desired transition, by tracking and minimizing the error signal using an active feedback loop. This is called PID locking:

the feedback adjusts the laser frequency by acting on the piezo of the laser cavity mirror.

Once the signal is locked onto the right frequency, the relative phase between the signal and control must now be locked to match the precise 9.192 GHz detuning. This is achieved by interfering the two lasers on a 50/50 beamsplitter, and converting the resulting optical inteference into an electric signal. The beating is then compared to a reference microwave signal with frequency equal to 9.192 GHz, and adjusted with an active feedback loop.

As explained in Section 6.4.1, phase randomization is required to increase the noise and loss tolerance to values which can be reached with our current setup. Generally, this may be performed by adding a phase modulator, to which we apply a new random voltage for each state, before the Pockels cell polarization encoding. In usual QKD schemes, or in our proof-of-principle experiment from Chapter 4, it is fair to assume that phase randomization has been performed, or to even perform it practice. However, when the encoded states must be phase-locked with another laser, this raises a new problem:

How can signal and control be locked in phase when the signal's global phase is actively scrambled?

We answer this question by proposing two solutions, which can be mentioned as assumptions in our experimental demonstration. Before the generation and storage of each new credit card state:

• The signal and control beams are both phase-randomized in the same way before phase-locking is realized. This involves applying the same random voltage to two identical phase modulators, in precise synchronization with the signal pulse chopping. The voltage applied changes before each new pulse.

• The signal laser is switched on and off, causing the global phase to be effectively randomized. Signal frequency-locking and phase-locking between the two lasers must then be performed again.

Since both signal frequency locking and signal/control phase-locking are corrected in real-time using active feedback loops, implementing the first solution seems feasible, as the adaptation of the locking after each global phase jump is performed automatically.

The second solution, on the other hand, does not seem practical with our current setup, as this would require an automatic way of controlling the lasers and of performing the initial signal locking by saturated absorption, fast enough such that the process ends by the time a new state is generated.

Time-dependent security

The need for a time-dependent security analysis stems from the decohering nature of our quantum storage device. Generally, a lot of the current experimental effort aims at increasing the storage/retrieval efficiency, storage fidelity, and storage time of optical quantum memories. However, the achieved values reported for a given setup always decrease in time due to decoherence processes, some of which actually preserve quantum information even though they cannot be retrieved by an honest experimentalist.

TIME-DEPENDENT SECURITY

Quantum cryptography usually assumes that the adversary has access to ideal quantum devices, measurements, and setups. In a quantum credit card scheme, they may therefore transfer all states to an ideal quantum memory which does not decohere in time. Upon verification, the bank (who is aware of the imperfect characteristics of the original quantum memory) will increase the noise and loss tolerance over time, in order to account for these time-dependent imperfections. However, the adversary's credit card is not subjected to such imperfections. They may therefore boost their cheating probability in time by hiding the consequences of their attack in the extra noise and losses tolerated by the bank.

In our implementation, the mint hands the stored quantum state to the client at time t = 0. When t > 0, the retrieval efficiency η m (t) starts decreasing with time, thus increasing the losses to e -µη d η m (t) . The initial retrieval efficiency η m (0) of the quantum memory limits the fraction of the N states that a dishonest client can retrieve to 1 -e -µη d η m (0) .

In order to compute such values, we note that our experimental platform presents three major loss mechanisms [START_REF] Vernaz-Gris | Highly-efficient quantum memory for polarization qubits in a spatially-multiplexed cold atomic ensemble[END_REF]:

• Dephasing of the collective atomic excitation due to weak residual magnetic fields (from the trapping process): lifetime τ m ≈ 15µs.

• Motional dephasing due to the angular dependence of EIT: lifetime τ a ≈ 220µs.

• Atomic motion due to finite temperature which decreases the number of atoms in the interaction area: lifetime τ t ≈ 7 ms.

Such values show that the retrieval efficiency of the quantum memory is mainly limited by the first mechanism: dephasing of the collective atomic magnetic excitation due to unwanted Zeeman splitting (Fig. 6.1). We indeed have τ m < τ a << τ t . This can be combined with the expression for the retrieval efficiency's time-dependence, given in [START_REF] Vernaz-Gris | Highly-efficient quantum memory for polarization qubits in a spatially-multiplexed cold atomic ensemble[END_REF]:

η m (t) ≈ η m (0)e -t 2 /τ 2 , ( 6.2)
where we set τ ≈ τ m the lifetime of the dominant loss mechanism, and η m (0) ≈ 85% for our setup. Using this expression, we solve (5.11) with phase-randomized states and derive secure credit card lifetimes of a few µs, as shown in Fig. 6.4 for µ = 0.50 and µ = 1.50.

We now highlight other general security threats which may arise in cold atombased quantum memories. The first one is caused by fluorescence, which preserves the 6.6. CONCLUSION polarization of the incident light. Although it cannot be retrieved by an experimentalist due to the isotropy of the emission, an adversary with unlimited experimental means can collect all the information that is assumed to be "lost". A second example applies to our quantum setup, since it involves atomic motion due to finite temperature, which causes atoms to gradually escape from the interaction area (where the two spatially multiplexed components meet). The photons emitted by such lost atoms cannot be detected by the honest experimentalist, whereas an adversary can collect all the emission.

The security threat posed by such physical processes may be discarded when their lifetime τ is much larger than the lifetime of other dominant decoherence processes, which is the case in our setup. In the opposite case, these have to be taken into account in the security analysis.

Conclusion

We have proposed an experimental platform for the near-future implementation of information-theoretically secure quantum money, assuming an ideal setup with an imperfect quantum storage device. In close collaboration with the Laboratoire Kastler Brossel, we are currently building and optimizing the setup, which involves real-time polarization encoding of credit card states, and genuine on-the-fly quantum storage using EIT in a cloud of cold cesium atoms. This aims to provide the first experimental demonstration of a secure quantum-cryptographic task in the presence of a quantum memory.

Assuming that the storage mechanism only is lossy, the memory must achieve 85% storage/retrieval efficiency and we should obtain less than 2% error rate upon verification, given average photon number µ ≈ 1. This is within experimental reach, as it has already been demonstrated that using the D 1 line of cesium can provide up to 90% storage/retrieval efficiency [START_REF] Hsiao | Highly efficient coherent optical memory based on electromagnetically induced transparency[END_REF]. Furthermore, the error rate coming from state preparation can be lowered by decreasing the repetition rate of the experiment (for the voltage amplifier to perform better), and the quantum memory state fidelity can achieve around 99% for µ 1 [START_REF] Vernaz-Gris | Highly-efficient quantum memory for polarization qubits in a spatially-multiplexed cold atomic ensemble[END_REF].

In the long-term, acquiring superconducting nanowire detectors (which can achieve detection efficiency around 90%), and further optimization of the storage/retrieval efficiency could allow a full demonstration of the trusted-terminal scheme with less postselection. Furthermore, it would be interesting to attempt the parallel storage of two credit card states at once (as a proof-of-principle step beyond on-the-fly storage), by

Motivation

Chapter 1 introduced secure coin flipping as one of the building blocks of classical and quantum communication networks. It is a crucial primitive in multiparty computing [START_REF] Goldreich | How to play any mental game[END_REF], online gaming and more general randomized consensus protocols [START_REF] Alistarh | Communication-efficient randomized consensus[END_REF]. Its importance stems from the fundamentality of the task it accomplishes: generating randomness between two distant parties who do not trust each other. Strong coin flipping (SCF) guarantees that none of the two parties can bias the outcome with probability higher than (1/2 + ), where is the protocol bias. Weak coin flipping (WCF) performs the same task when both parties have a preferred, opposite outcome: it effectively designates a winner and a loser.

In the classical world, coin flipping is only possible using computational assumptions, or under stringent spacetime constraints [START_REF] Berlin | Fair loss-tolerant quantum coin flipping[END_REF]: the two parties must each broadcast a random bit simultaneously. Once the broadcast is over, they may both agree on the flip outcome by performing the sum of the two bits. If each party's bit is revealed at exactly the same time, then none of the parties could have influenced the outcome of the flip before the broadcast, since they have no a priori knowledge of the other party's bit. This assumption is very strong however, as it requires precise clock synchronization between both parties, which in turn poses a security flaw: either one of the two parties must control clock synchronization, or both parties must agree on a trust third party. None of these assumptions are allowed in a secure coin flipping protocol. Using the entanglement property of quantum mechanics allows to bypass this practical issue.

Despite its weak name (due to the fact that two out of four biases remain unconstrained, as shown in Section 7.5), quantum WCF allows to construct optimal quantum SCF schemes: combining an unbalanced quantum WCF with cheating probability (1/2+ ) with a classical coin flip yields the optimal SCF with cheating probability (1 2 + ) [START_REF] Chailloux | Optimal quantum strong coin flipping[END_REF].

WCF schemes also help construct other crucial primitives such as bit commitment [START_REF] Chailloux | Optimal bounds for quantum bit commitment[END_REF].

Unlike quantum SCF for which the lowest possible bias is

= (1/ 2 -1/2) [61],
quantum WCF may achieve biases arbitrarily close to zero [START_REF] Mochon | Quantum weak coin flipping with arbitrarily small bias[END_REF][START_REF] Aharonov | A simpler proof of the existence of quantum weak coin flipping with arbitrarily small bias[END_REF]. In 2002, two explicit protocols were proposed, which both allowed to reach small biases: the work from [START_REF] Kerenidis | Weak coin flipping with small bias[END_REF] achieved ≈ 0.239, while the work from [START_REF] Spekkens | A quantum protocol for cheat-sensitive weak coin flipping[END_REF] achieved = (1/ 2 -1/2) ≈ 0.207 (which is coincidentally the SCF lower bound). Later, it was shown that the scheme from [START_REF] Spekkens | A quantum protocol for cheat-sensitive weak coin flipping[END_REF] in fact belonged to a larger family of WCF protocols, of which 1/6 was the lowest bias allowed [START_REF] Mochon | Quantum weak coin flipping with bias of 0.192[END_REF][START_REF] Mochon | Large family of quantum weak coin-flipping protocols[END_REF]. Very recently, a new explicit family of protocols achieved = 1/10 [START_REF] Arora | Quantum weak coin flipping[END_REF].

While quantum SCF protocols have been experimentally demonstrated [START_REF] Pappa | Experimental plug and play quantum coin flipping[END_REF][START_REF] Berlín | Experimental loss-tolerant quantum coin flipping[END_REF][START_REF] Molina-Terriza | Experimental quantum coin tossing[END_REF], no implementation has ever been proposed for quantum WCF. This may be explained by two reasons. First, it is difficult to find an encoding and implementation which is robust to losses: a dishonest party may always declare an abort when it is not satisfied with the flip's outcome. Second, none of the previously mentioned protocols translate trivially into a simple experimental setup: they all involve performing single-shot POVM measurements [START_REF] Spekkens | A quantum protocol for cheat-sensitive weak coin flipping[END_REF], generating beyond-qubit states [START_REF] Kerenidis | Weak coin flipping with small bias[END_REF] or performing projective measurements on Hilbert spaces which grow with the number of rounds [START_REF] Mochon | Quantum weak coin flipping with bias of 0.192[END_REF].

In this project, we propose a family of quantum WCF protocols, inspired from [START_REF] Spekkens | A quantum protocol for cheat-sensitive weak coin flipping[END_REF],

which allows to reach biases as low as = (1/ 2 -1/2) ≈ 0.207. We replace all POVMs by simple projective measurements, and propose an implementation which involves a single photon and linear-optical circuits only. We encode the information by mixing the photon with vacuum on an unbalanced beam splitter, which generates entanglement. Both parties are then able to agree on a random bit, while the entanglement is simultaneously verified. We derive a practical security proof, considering the extension to infinite Hilbert spaces, and show that the fairness and balance of the protocol are preserved through a few kilometers of lossy optical fiber and non-unit detection efficiency. We emphasize that this encoding is very robust to noise, as the single photon needs not be pure or indistinguishable from other photons in any degree of freedom, save photon number.

Finally, we investigate a simple extension to n rounds in order to achieve lower biases.

Protocol and correctness

In the honest protocol, Alice and Bob wish to toss a fair coin, with a priori knowledge that they each favor opposite outcomes. Fig. 7.1 represents the implementation of the honest protocol, which follows five distinct steps. Defining x ∈ [0, 1 2 ] as a free protocol parameter, these read:

1. Alice mixes a single photon with the vacuum on a beam splitter of reflectivity x.

2. Alice keeps the first half of the state, and sends the second half to Bob.

3. Bob mixes the half he just received with the vacuum on a beam splitter of reflectiv-

ity y = 1 -1 2(1-x) .
4. Bob measures the second register of his state with a threshold detector, and broadcasts the outcome c ∈ {0, 1}.

5. This last step is a verification step, which splits into two cases:

• c = 0: Alice sends her half of the state to Bob, who mixes it with his half on a beam splitter of reflectivity z = 2x. He then measures the two output modes with threshold detectors. If the outcome is (1, 0), Alice is declared winner.

• c = 1: Bob discards his half, and Alice measures her half with threshold detectors. If the outcome is 0, Bob is declared winner.

We now derive the correctness of the protocol: we show that the protocol is fair, i.e. that the probability of winning is 1 2 when both parties are honest. Throughout this chapter, operators with a tilde indicate an action on creation operators (framework from Section 2.3.1), while the operator without the tilde indicates the action in Fock space.

The action of a beam splitter of reflectivity r acting on modes k and l is given by b

† k b † l = H(r) â † k â † l , (7.1)
where a † k , â † l are the creation operators of the input spatial modes k and l, respectively, b † k , b † l are the creation operators of the output spatial modes k and l, respectively, and the beam splitter transformation is given by:

H(r) = r 1 -r 1 -r -r . ( 7.2) (x)
< l a t e x i t s h a 1 _ b a s e 6 4 = " c D l 5 n 9

Q F 4 L 6 h Y K F l i E N W A R B a s v o = " > A A A B 6 n i c d V D L S g N B E O z 1 G e M r 6 t H L Y B D i Z d n d L E m 8 B b 1 4 j G g e k C x h d j J J h s w + m J k V w 5 J P 8 O J B E a 9 + k T f / x t k k g o o W N B R V 3 X R 3 + T F n U l n W h 7 G y u r a + s Z n b y m / v 7 O 7 t F w 4 O W z J K B K F N E v F I d H w s K W c h b S q m O O 3 E g u L A 5 7 T t T y 4 z v 3 1 H h W R R e K u m M f U C P A r Z k B G s t H R T u j / r F 4 q W e V 6 r O G 4 F W a Z l V W 3 H z o h T d c s u s r W S o Q h L N P q F 9 9 4 g I k l A Q 0 U 4 l r J r W 7 H y U i w U I 5 z O 8 r 1 E 0 h i T C R 7 R r q Y h D q j 0 0 v m p M 3 S q l Q E a R k J X q N B c / T 6 R 4 k D K a e D
r z g C r s f z t Z e J f X j d R w 5 q X s j B O F A 3 J Y t E w 4 U h F K P s b D Z i g R P G p J p g I p m 9 F Z I w F J k q n k 9 c h f H 2 K / i c t x 7 T L p n P t F u s X y z h y c A w n U A I b q l C H K 2 h A E w i M 4 A G e 4 N n g x q P x Y r w u W l e M 5 c w R / I D x 9 g k N C o 2 n < / l a t e x i t > (y)

< l a t e x i t s h a 1 _ b a s e 6 4 = " The evolution of the quantum state over the three modes up to Bob's measurement may then be written as:

+ g n i v r h Q F l v v u x R G r P E + x g r y w a s = " > A A A B 6 n i c d V D L S s N A F J 3 U V 6 2 v q k s 3 g 0 W o m 5 C k o a 2 7 o h u X F e 0 D 2 l A m 0 0 k 7 d D I J M x M h h H 6 C G x e K u P W L 3 P k 3 T t o K K n r g w u G c e 7 n 3 H j 9 m V C r L + j A K a + s b m 1 v F 7 d L O 7 t 7 + Q f n w q C u j R G D S w R G L R N 9 H k j D K S U d R x U g / F g S F P i M 9 f 3 a V + 7 1 7 I i S N + J 1 K Y + K F a M J p Q D F S W r q t p u e j c s U y L 5 p 1 x 6 1 D y 7 S s h u 3 Y O X E a b s 2 F t l Z y V M A K 7 V H 5 f T i O c B I S r j B D U g 5 s K 1 Z e h o S i m J F 5 a Z h I E i M 8 Q x M y 0 J S j k E g v W 5 w 6 h 2 d a G c M g E r q 4 g g v 1 + 0 S G Q i n T 0 N e d I V J T + d v L x b + 8 Q a K C p p d R H i e K c L x c F C Q M q g j m f 8 M x F Q Q r l m q C s K D 6 V o i n S C C s d D o l H c L X p / B / 0 n V M u 2 Y 6 N 2 6 l d b m K o w h O w C m o A h s 0 Q A t c
g J W 0 Z X A v v u 8 2 L j F X T 3 N A g = " > A A A B 8 H i c b V B N S 8 N A E J 3 4 W e t X 1 a O X x S J 4 K k k V 9 F j 0 4 r G C / Z A 2 l M 1 2 0 i 7 d b M L u R i i x v 8 K L B 0 W 8 + n O 8 + W / c t j l o 6 4 O B x 3 s z z M w L E s G 1 c d 1 v Z 2 V 1 b X 1 j s 7 B V 3 N 7 Z 3 d s v H R w 2 d Z w q h g 0 W i 1 i 1 A 6 p R c I k N w 4 3 A d q K Q R o H A V j C 6 m f q t R
Y i + q G u W A D J / v O J t 8 E + C n N 5 z 0 G 4 = " > A A A B 8 H i c b V B N S 8 N A E J 3 4 W e t X 1 a O X x S J 4 K k k V 9 F j 0 4 r G C / Z A 2 l M 1 2 0 i 7 d b M L u R i i x v 8 K L B 0 W 8 + n O 8 + W / c t j l o 6 4 O B x 3 s z z M w L E s G 1 c d 1 v Z 2 V 1 b X 1 j s 7 B V 3 N 7 Z 3 d s v H R w 2 d Z w q h g 0 W i 1 i 1 A 6 p R c I k N w 4 3 A d q K Q R o H A V j C 6 m f q t R
|100〉 → (x),12 x |100〉 + 1 -x |010〉 → (y),23 x |100〉 + (1 -x)y |010〉 + (1 -x)(1 -y) |001〉 , (7.3)
where the notation (r), kl indicates the reflectivity of the beam splitter and the corresponding modes. Hence, the probability that Bob obtains the outcome c = 1 when measuring the third register is:

P(1) = (1 -x)(1 -y), (7.4)
and P(0) = 1 -P(1). We have y = 1 -1 2(1-x) to ensure that P(0) = P(1) = 1 2 . When outcome c = 1 is obtained, the state post-measurement then reads: A Q 0 U 4 l r J r W 7 H y U i w U I 5 z O 8 r 1 E 0 h i T C R 7 R r q Y h D q j 0 0 v m p M 3 S q l Q E a R k J X q N B c / T 6 R 4 k D K a e D r z g C r s f z t Z e J f X j d R w 5 q X s j B O F A 3 J Y t E w 4 U h F K P s b D Z i g R P G p J p g I p m 9 F Z I w F J k q n k 9 c h f H 2 K / i c t x 7 T L p n P t F u s X y z h y c A w n U A I b q l C H K 2 h A E w i M 4 A G e 4 N n g x q P x Y r w u W l e M 5 c w R / I D x 9 g k N C o 2 n < / l a t e x i t > |0i < l a t e x i t s h a 1 _ b a s e 6 4 = " m F b y g 4 g J W 0 When outcome c = 0 is obtained, it reads:

Z X A v v u 8 2 L j F X T 3 N A g = " > A A A B 8 H i c b V B N S 8 N A E J 3 4 W e t X 1 a O X x S J 4 K k k V 9 F j 0 4 r G C / Z A 2 l M 1 2 0 i 7 d b M L u R i i x v 8 K L B 0 W 8 + n O 8 + W / c t j l o 6 4 O B x 3 s z z M w L E s G 1 c d 1 v Z 2 V 1 b X 1 j s 7 B V 3 N 7 Z 3 d s v H R w 2 d Z w q h g 0 W i 1 i 1 A 6 p R c I k N w 4 3 A d q K Q R o H A V j C 6 m f q t R
Y i + q G u W A D J / v O J t 8 E + C n N 5 z 0 G 4 = " > A A A B 8 H i c b V B N S 8 N A E J 3 4 W e t X 1 a O X x S J 4 K k k V 9 F j 0 4 r G C / Z A 2 l M 1 2 0 i 7 d b M L u R i i x v 8 K L B 0 W 8 + n O 8 + W / c t j l o 6 4 O B x 3 s z z M w L E s G 1 c d 1 v Z 2 V 1 b X 1 j s 7 B V 3 N 7 Z 3 d s v H R w 2 d Z w q h g 0 W i 1 i 1 A 6 p R c I k N w 4 3 A d q K Q R o H A V j C 6 m f q t R
d d z E + N n V B n O B E 5 L v V R j Q t m Y D r F r q a Q R a j + b H z o l Z 1 Y Z k D B W t q Q h c / X 3 R E Y j r S d R Y D s j a k Z 6 2 Z u J / 3 n d 1 I T X f s Z l k h q U b L E o T A U x M Z l 9 T Q Z c I T N i Y g l l i t t b C R t R R Z m x 2 Z R
2x |10〉 + 1 -2x |01〉 , (7.6)
In the first case, the measurement performed by Alice outputs 0 with probability 1, while in the second case, the measurement performed by Bob outputs (1, 0) with probability 1.

Hence, the probability that Alice (resp. Bob) wins is directly given by P(0) (resp. P( 1)).

This shows that the protocol is fair, since P(0) = P(1) = 1 2 .

Ideal security

We now derive the security of the protocol in the ideal setting, with perfect numberresolving as well as threshold detectors. Namely, we obtain the probabilities of winning when Bob is dishonest and Alice is honest, and when Alice is dishonest and Bob is honest, respectively.

Dishonest Bob

Dishonest Bob should always declare the outcome c = 1 in order to maximize his winning probability. The outcome of the coin flip is then confirmed if Alice obtains the outcome 0 upon verification. Bob thus needs to maximize the probability of outcome 0, applying a general quantum operation Λ B to his half of the state. The reduction of the protocol in this case is given in Fig. 7.2.

However, the probability that the detector clicks is independent of Bob's action. It is given by x, so that Bob's winning probability is upper bounded by (1 -x). This upper

IDEAL SECURITY

We have:

U † |100〉 = (1 ⊗ H (y) )(H (2x) ⊗ 1) |100〉 = (1 ⊗ H (y) )( 2x |100〉 + 1 -2x |010〉) = 2x |100〉 + y(1 -2x) |010〉 + (1 -y)(1 -2x) |001〉 , (7.10)
and therefore:

U † |100〉 〈100|U =2x |100〉 〈100| + y(1 -2x) |010〉 〈010| + (1 -y)(1 -2x) |001〉 〈001| + 2x y(1 -2x) (|100〉 〈010| + |010〉 〈100|) + 2x(1 -y)(1 -2x) (|100〉 〈001| + |001〉 〈100|) + (1 -2x) y(1 -y) (|010〉 〈001| + |001〉 〈010|) . (7.11)
Substituting back into Eq. (7.9) then reduces to:

P d (A) = 〈ψ| 2x |10〉 〈10| + y(1 -2x) |01〉 〈01| + 2x y(1 -2x) (|10〉 〈01| + |01〉 〈10|) |ψ〉 = 〈ψ| 2x |10〉 + y(1 -2x) |01〉 2x 〈10| + y(1 -2x) 〈01| |ψ〉 = 〈ψ| 2x |10〉 + y(1 -2x) |01〉 2 .
(7.12)

Using the Cauchy-Schwarz inequality then allows to upper bound P d (A) as:

P d (A) ψ 2 2x |10〉 + y(1 -2x) |01〉 2 1 2(1 -x) ψ 2 , (7.13)
which is maximized for ψ = 1. Hence we finally get:

P d (A) 1 2(1 -x) . ( 7.14)
In order to find Alice's optimal cheating strategy (i.e. the optimal pure state |ψ〉 that she must send to achieve this bound), we remark that the unnormalized state 2x |10〉 + y(1 -2x) |01〉 maximizes the expression in Eq. (7.13). Normalizing this state then provides Alice's optimal strategy, which is to prepare the state:

|φ x 〉 := 2 x(1 -x) |10〉 + (1 -2x) |01〉 . (7.15)

Dishonest Alice with threshold detectors

Remarkably, the protocol is still secure even if Bob only uses threshold detectors, which is essential to the practicality of the protocol. Moreover, Alice's optimal cheating probability remains the same in both cases: P d (A) = 1 2(1-x) . In particular, for all values of x, we retrieve the property shared by the protocols of [START_REF] Spekkens | A quantum protocol for cheat-sensitive weak coin flipping[END_REF]: P d (A)P d (B) = 1 2 . Unlike the previous case, incorrect outcomes with higher photon number could still pass the test for n ≥ 1, since threshold detectors cannot discriminate between a |100〉 and |n00〉 projection. We show in the following that this doesn't help a dishonest Alice, and that the strategy described previously for the case of number resolving detectors is still optimal in the case of threshold detectors.

With the same notations as in the previous proof, Alice needs to maximize the probability of the overall outcome (1, 0, 0), hence the overlap with the projector ∞ n=1 |n00〉 〈n00| = (1 -|0〉 〈0|) ⊗ |00〉 〈00|. This allows us to write:

P d (A) = T r[U(|ψ〉 〈ψ| ⊗ |0〉 〈0|)U † ((1 -|0〉 〈0|) ⊗ |00〉 〈00|)], (7.16)
since Bob uses threshold detectors, where U = (H (2x) ⊗ 1)(1 ⊗ H (y) ) and y = 1 -1 2(1-x) . Linear optical evolution conserves photon number. Hence if Alice sends the vacuum state, the detectors will never click. Removing the two-mode vacuum component of the state prepared by Alice and renormalizing therefore always increases her winning probability. Since we are looking for the maximum winning probability, we can assume without loss of generality that 〈ψ|00〉 = 0, i.e:

T r[U(|ψ〉 〈ψ| ⊗ |0〉 〈0|)U † |000〉 〈000|] = | 〈ψ|00〉 | 2 , ( 7.17)
So maximizing the winning probability in Eq. (7.16) is equivalent to maximizing

Pd (A) = T r[U(|ψ〉 〈ψ| ⊗ |0〉 〈0|)U † (1 ⊗ |00〉 〈00|)], (7.18)
given the constraint 〈ψ|00〉 = 0. We have:

Pd (A) = T r[U(|ψ〉 〈ψ| ⊗ |0〉 〈0|)U † (1 ⊗ |00〉 〈00|)] = T r[(|ψ〉 〈ψ| ⊗ |0〉 〈0|)U † (1 ⊗ |00〉 〈00|)U]. (7.19)
At this point, we use a simple reduction which allows to replace the interferometer U in the above expression by another interferometer V , which will simplify the calculations. This is formalised by the following lemma, proven in Appendix C.1:

Lemma 7.1. Let U = (H (z) ⊗ 1)(1 ⊗ H (y) ), with z > 0. For any density matrix τ, T r[(τ ⊗ |0〉 〈0|)U † (1 ⊗ |00〉 〈00|)U] = T r[(τ ⊗ |0〉 〈0|)V † (|0〉 〈0| ⊗ 1 ⊗ |0〉 〈0|)V ], (7.20
)

where V = (1 ⊗ H (b) )(H (a) ⊗ 1)(1 ⊗ R(π) ⊗ 1), with a = y(1-z)
y+z-yz and b = y + zyz, and R(π) a phase shift of π acting on mode 2.

|0i

< l a t e x i t s h a 1 _ b a s e 6 4 = " m F b y g 4 g J W 0 Using Lemma 7.1, Eq. (7.19), and recalling that (1 -x)(1 -y) = 1 2 and z = 2x, we may thus write:

Z X A v v u 8 2 L j F X T 3 N A g = " > A A A B 8 H i c b V B N S 8 N A E J 3 4 W e t X 1 a O X x S J 4 K k k V 9 F j 0 4 r G C / Z A 2 l M 1 2 0 i 7 d b M L u R i i x v 8 K L B 0 W 8 + n O 8 + W / c t j l o 6 4 O B x 3 s z z M w L E s G 1 c d 1 v Z 2 V 1 b X 1 j s 7 B V 3 N 7 Z 3 d s v H R w 2 d Z w q h g 0 W i 1 i 1 A 6 p R c I k N w 4 3 A d q K Q R o H A V j C 6 m f q t R
F 6 x E n C / Y g O l Q g F o 2 i l h 1 7 W L 1 f c q j s H W S V e T i q Q o 9 E v f / U G M U s j r p B J a k z X c x P 0 M 6 p R M M m n p V 5 q e E L Z m A 5 5 1 1 J F I 2 7 8 b H 7 p l J x Z Z U D C W N t S S O b q 7 4 m M R s Z M o s B 2 R h R H Z t m b i f 9 5 3 R T D a z 8 T K k m R K 7 Z Y F K a S Y E x m b 5 O B 0 J y h n F h C m R b 2 V s J G V F O G N p y S D c F b f n m V t G p V
O w d Z J V 5 O K p C j 0 S 9 / 9 Q Y x S y O U h g m q d d d z E + N n V B n O B E 5 L v V R j Q t m Y D r F r q a Q R a j + b H z o l Z 1 Y Z k D B W t q Q h c / X 3 R E Y j r S d R Y D s j a k Z 6 2 Z u J / 3 n d 1 I T X f s Z l k h q U b L E o T A U x M Z l 9 T Q Z c I T N i Y g l l i t t b C R t R R Z m x 2 Z R
O w d Z J V 5 O K p C j 0 S 9 / 9 Q Y x S y O U h g m q d d d z E + N n V B n O B E 5 L v V R j Q t m Y D r F r q a Q R a j + b H z o l Z 1 Y Z k D B W t q Q h c / X 3 R E Y j r S d R Y D s j a k Z 6 2 Z u J / 3 n d 1 I T X f s Z l k h q U b L E o T A U x M Z l 9 T Q Z c I T N i Y g l l i t t b C R t R R Z m x 2 Z R s C N 7 y y 6 u k X a t 6 F 9 V a 8 7 J S v 8 n j K M I J n M I 5 e H A F d b i D B r S A A c I z v M K b 8 + i 8 O O / O x 6 K 1 4 O Q z x / A H z u c P e m e M u A = = < / l a t e x i t > | x i < l a t e x i t s h a 1 _ b a s e 6 4 = " O v K G x u 5 X z j v 8 T y v i s 2 / j J r R b H f k = " > A A A B 9 X i c b V B N S 8 N A E J 3 4 W e t X 1 a O X Y B E 8 l a Q K e i x 6 8 V j B f k A T y 2 Y
h E K T T l R q u M 6 i f Y z I j W j H M d F L 1 W Y E D o k f e w Y K k i E y s + m V 4 / t Y 6 P 0 7 D C W p o S 2 p + r v i Y x E S o 2 i w H R G R A / U v D c R / / M 6 q Q 4 v / I y J J N U o 6 G x R m H J b x / Y k A r v H J F L N R 4 Y Q K p m 5 1 a Y D I g n V J q i i C c G d f 3 m R N K s V 9 7 R S v T k r 1 y 7 z O A p w C E d w A i 6 c Q w 2 u o Q 4 N o C D h G V 7 h z X q w X q x 3
E Y S 2 S M Q j 0 f W x p J y F t K W Y 4 r Q b C 4 o D n 9 O O P 7 3 K / M 4 9 F Z J F 4 Z 2 a x d Q L 8 D h k I 0 a w 0 t J t 2 T 8 f F E u W e V G v O m 4 V W a Z l 1 W z H z o h T c y s u s r W S o Q Q r N A f F 9 / 4 w I k l A Q 0 U 4 l r J n W 7 H y U i w U I 5 z O C / 1 E 0 h i T K R 7 T n q Y h D q j 0 0 s W p c 3 S m l S E a R U J X q N B C / T 6 R 4 k D K W e D r z g C r i f z t Z e J f X i 9 R o 7 q X s j B O F A 3 J c t E o 4 U h F K P s b D Z m g R P G Z J p g I p m 9 F Z I I F J k q n U 9 A h f H 2 K / i d t x 7 Q r p n P j l h q X q z j y c A K n U A Y b a t C A a 2 h C C w i M 4 Q G e 4 N n g x q P x Y r w u W 3 P G a u Y Y f s B 4 + w T r j Y 2 R < / l a t e x i t >
Pd (A) = T r[(|ψ〉 〈ψ| ⊗ |0〉 〈0|)V † (|0〉 〈0| ⊗ 1 ⊗ |0〉 〈0|)V ], (7.21)
where

V = (1 ⊗ H (b) )(H (a) ⊗ 1)(1 ⊗ R(π) ⊗ 1), a = (1 -2x) 2 and b = 1 -y = 1 2(1-x) .
Let us now define:

|ψ x 〉 := H (a) (1 ⊗ R(π)) |ψ〉 . ( 7

.22)

The constraints 〈ψ|00〉 = 0 and 〈ψ x |00〉 = 0 are equivalent, because the above transformation leaves the total number of photons invariant. With Eq. (7.21) we obtain

Pd (A) = T r[(|ψ x 〉 〈ψ x | ⊗ |0〉 〈0|)(1 ⊗ H (b) )(|0〉 〈0| ⊗ 1 ⊗ |0〉 〈0|)(1 ⊗ H (b) )], (7.23)
with the constraint 〈ψ x |00〉 = 0. Maximizing this expression thus corresponds to maximizing the probability of the outcome (0, 0) when measuring modes 1 and 3 of the state obtained by mixing the second half of |ψ x 〉 with the vacuum on a beam splitter of reflectivity b = 1 2(1-x) (Fig. 7.4). We now show that an optimal strategy for Alice is to ensure that |ψ x 〉 = |01〉. Let us write:

|ψ x 〉 = p+q>0 ψ pq |pq〉, (7.24)
where we take into account the constraint 〈ψ x |00〉 = 0. Then, with Eq. (7.23) we obtain:

Pd (A) = p+q>0,p +q >0 ψ pq ψ * p q T r[|pq0〉 〈p q 0| (|0〉 〈0| ⊗ H (b) (1 ⊗ |0〉 〈0|)H (b) )] = q>0,q >0 ψ 0q ψ * 0q T r[|q0〉 〈q 0| H (b) (1 ⊗ |0〉 〈0|)H (b) ] = n≥0,q>0,q >0 ψ 0q ψ * 0q T r[|q0〉 〈q 0| H (b) |n0〉 〈n0|)H (b) ] = n>0 |ψ 0n | 2 | 〈n0|H (b) |n0〉 | 2 = n>0 |ψ 0n | 2 b n , (7.25)
where we used in the fourth line the fact that H (b) doesn't change the number of photons.

We have b ∈ [0, 1], which shows that:

Pd (A) b n>0 |ψ 0n | 2 = b, (7.26)
since |ψ x 〉 is normalized, and this bound is reached for

|ψ 01 | 2 = 1, i.e. |ψ x 〉 = |01〉. With
Eq. (7.22), this implies that an optimal strategy for Alice is to prepare the state

|ψ〉 = (1 ⊗ R(π))H (a) |01〉 = 1 -a |10〉 + a |01〉 = 2 x(1 -x) |10〉 + (1 -2x) |01〉 = |φ x 〉 , (7.27)
and her winning probability is then b = 1 -y = 1 2(1-x) . We therefore recover the same result as for number-resolving detectors.

Noise tolerance

The vacuum/single-photon encoding is very robust to noise, in comparison to polarization or phase encoding for instance: the only property which must be generated and preserved through propagation is photon number. This implies that photon indistinguishability and purity are not required in any degree of freedom other than photon number. In this case, Alice may simply produce a heralded single photon via spontaneous parametric down-conversion (SDPC) [START_REF] Couteau | Spontaneous parametric down-conversion[END_REF], which generates a photon pair: one may be used for the flip, while the other may herald the presence of the first one. Given photon-pair-emission probability p, accidentally emitting two pairs at the same time using SPDC occurs with probability p 2 . Since p may be arbitrarily tuned by changing the pump power, p 2 (and therefore the probability of 2 photons being accidentally generated by Alice at once) may then be decreased to negligible values.

We note that, in the case where Alice's single photon source is probabilistic but heralded (as in SPDC), she may always inform Bob of a successful state generation prior to his announcement of c without compromising security. In what follows, we may therefore assume that both parties have agreed on the presence of an initial state, and hence know when the protocol occurs.

Noise will therefore stem from the non-ideal reflectivities of the beam splitters, and the non-zero detector dark count probability p dc . For each party, these may affect the protocol correctness in two ways: an undesired bias of the flip, and an added abort probability during the verification process.

Regarding the flip bias, a change from x to x in the first beam splitter's reflectivity will cause Honest Alice to generate a slightly different initial entangled state, which will change the correctness from P(0) = P(1) = 1/2 to:

P(1) = (1 -x )(1 -y) P(0) = 1 -P(1). (7.28)
Similarly for Bob, a change from y to y will yield

P(1) = (1 -x)(1 -y ) P(0) = 1 -P(1). (7.29)
Regarding the verification process, Alice will call Honest Bob a liar only if she detects a photon. Noisy detectors on Alice's side will therefore cause an unwanted abort with probability p dc , since she always expects the (0, 0) vacuum outcome when Bob is honest.

With nanowire single photon detectors, this probability is typically very low, of the order of p dc < 10 -6 . Hence the probability that Honest Bob is called a liar is simply p dc < 10 -6 .

For modes 1 and 2, outcome (0, 0) is therefore the most problematic case, as it crucially depends on the losses in the setup. We consider this case in Section 7.5.

Loss tolerance 7.5.1 Correctness

We have just shown that any source of noise in the protocol (which flips a |0〉 to |1〉) may be incorporated in the security analysis by simply replacing parameters x, y, and z with x , y , and z . Furthermore, this source of error will most likely be negligible with current technology. We therefore solely focus on the more consequential effects of channel losses, as well as non-unit fiber transmission and detection efficiencies, which will be responsible for any flip from |1〉 to |0〉. We label η t the transmission efficiency of Alice and Bob's quantum channel. We then define η (i) f as the transmission efficiency of party i's fiber delay, while η (i) d denotes the detection efficiency of party i's measurement. We assume that each party introduces a fiber delay whenever they are waiting for the other party's communication. The delay time therefore depends on the distance between the two parties. When both parties are honest, the outcome of the flip may be reduced to the value of the declared outcome c, provided that the quantum verification step yields the awaited outcome: (1, 0) for Alice and 0 for Bob.

The correctness on Bob's side is directly given by his chance of detecting the photon (the photon gets to his detector and doesn't get lost):

P h (B) = η t η (B) d (1 -x)(1 -y). (7.30)
On the other hand, Alice wins if the photon, starting from her first input mode, is detected by Bob in the last step. The evolution of the creation operator of the first mode during the lossy honest protocol is given in Appendix C.2. In particular, the photon reaches Bob's first detector with probability:

P h (A) = xη (A) f η t zη (B) d + (1 -x)η t yη (B) f (1 -z)η (B) d 2 = η t η (B) d xzη (A) f + (1 -x)y(1 -z)η (B) f 2 . (7.31)
Finally, the protocol aborts for all other detection events:

P h (X ) = 1 -P h (A) -P h (B). ( 7

.32)

We may now gather the expressions which give us the correctness and abort probability for the lossy protocol:

P h (A) = η t η (B) d xzη (A) f + (1 -x)y(1 -z)η (B) f 2 P h (B) = η t η (B) d (1 -x)(1 -y) P h (X ) = 1 -P h (A) -P h (B). (7.33)
Therefore, the overall correctness does not depend on Alice's detection efficiency η (A) d . We also emphasize that allowing for abort cases may enable some classical WCF protocols 7.5. LOSS TOLERANCE to perform better than quantum WCF. This is because increasing the abort probability effectively decreases Alice and Bob's cheating probabilities. We say that the protocol allows a quantum advantage when it provides better bounds than any classical coin flipping protocol. In Section 7.6, we derive conditions on the protocol parameters which yield quantum advantage, as well as fairness and balance.

Dishonest Bob

In order to maximize his winning probability, Bob's best strategy in the lossy setting is to perform the same attack as in the lossless case, because he has no control over Alice's half of the subsystem. His winning probability is then upper-bounded by:

P d (B) 1 -xη (A) f η (A) d . (7.34)
However, we emphasize that Bob's best strategy will in fact depend on the rewards and sanctions associated with honest aborts and "getting caught cheating" aborts. In other words, Bob has to minimize his risk-to-reward ratio. Maximizing his winning probability makes him run the risk of getting caught cheating with probability xη (A) f η (A) d .

Dishonest Alice: outline

Dishonest Alice must still generate the state which maximizes the (1, 0, 0) outcome after Bob's honest transformations have been applied. However, the expression for Bob's corresponding projector now changes, as there is a finite probability (1 -η d ) n that the n-photon component is projected onto the vacuum. The 0 outcome on one spatial mode is therefore triggered by the projection ∞ n=0 (1 -η d ) n |n〉 〈n|. The total projector responsible for the (1, 0, 0) outcome then reads:

Π (1,0,0) = 1 - m (1 -η d ) m |m〉 〈m| ⊗ n,p (1 -η d ) n+p |n〉 〈n| ⊗ |p〉 〈p| . (7.35)
The security analysis is two-fold: we first show that Alice's maximum winning probability when Bob is using a delay line of transmission η f < 1 is always lower than when Bob's delay line is perfect (i.e. η f = 1), independently of the efficiency η d of his detectors. We then show that Alice's maximum winning probability reads: .36) In that case, the probability of winning is clearly lower than when the delay line is perfect (Fig. 7.8), because Alice is now restricted to lossy state preparation instead of generic state preparation. This reduction shows that Alice's maximum winning probability when Bob is using a lossy delay line is always lower than when Bob's delay line is perfect, independently of the efficiency η d of his detectors. Moreover, Alice's maximum cheating probability and optimal cheating strategy may be inferred from the case where Bob has a perfect delay line, as we show in what follows.

P d (A) = max l>0 1 -(1 -yη (B) f )(1 -z)η (B) d l -1 -η (B) d l y + z -yz. ( 7
By convexity of the probabilities, Alice's best strategy is to send a pure state |ψ〉 = k,l 0 ψ kl |kl〉. Let us consider the evolution of Alice's state and the vacuum on the third input mode through the interferometer W in Fig. 7.6, including the detection losses. The creation operator for the first mode evolves as:

â † 1 → z â † 1 + 1 -z â † 2 → zη d â † 1 + (1 -z)η d â † 2 = W â † 1 W † , (7.37)
while the creation operator for the second mode evolves as:

â † 2 → y â † 2 + 1 -y â † 3 → yη f â † 2 + 1 -y â † 3 → y(1 -z)η f â † 1 -yzη f â † 2 + 1 -y â † 3 → y(1 -z)η f η d â † 1 -yzη f η d â † 2 + (1 -y)η d â † 3 = W â † 2 W † . (7.38)
Hence, the output state (before the ideal threshold detection) is given by:

W |ψ0〉 = W k,l 0 ψ kl |kl0〉 = W k,l 0 ψ kl k!l! ( â † 1 ) k ( â † 2 ) l |000〉 = k,l 0 ψ kl k!l! (W â † 1 W † ) k (W â † 2 W † ) l |000〉 = k,l 0 ψ kl k!l! zη d â † 1 + (1 -z)η d â † 2 k y(1 -z)η f η d â † 1 -yzη f η d â † 2 + (1 -y)η d â † 3 l |000〉 .
(7.39) Now Alice's maximum cheating probability reads:

P d (A) = T r[W |ψ0〉 〈ψ0|W † (1 -|0〉 〈0|) |00〉 〈00|]. (7.40)
Hence, the state after a successful projection (1 -|0〉 〈0|) |00〉 〈00|, which has norm P d (A), is given by:

k+l>0 ψ kl k!l! (zη k/2 d [y(1 -z)η f η d ] l/2 ( â † 1 ) k+l |000〉 . (7.41)
When Bob has a perfect delay line (η f = 1), this state reads:

k+l>0 ψ kl k!l! (zη k/2 d [y(1 -z)η d ] l/2 ( â † 1 ) k+l |000〉 , (7.42)
and its norm is the winning probability of Alice in that case. Hence,

P d (A)[η f , η d , y, z] = P d (A)[1, η d , yη f , z], (7.43)
i.e. we can obtain Alice's optimal strategy by solving the case with perfect delay line, and replacing the parameter y by yη f . In the following, we thus derive Alice's optimal strategy in that case.

Dishonest Alice with perfect delay

Let σ be the state sent by Alice, and η d . She needs to maximize the probability of the overall outcome (1, 0, 0) at the output of the interferometer depicted in Fig. 7.8, hence the overlap with the projector:

Π η d (1,0,0) = 1 - m (1 -η d ) m |m〉 〈m| ⊗ n,p (1 -η d ) n+p |n〉 〈n| ⊗ |p〉 〈p| . (7.44)
By convexity of the probabilities, we may assume without loss of generality that Alice sends a pure state σ = |ψ〉 〈ψ|. Moreover, the imperfect threshold detectors of quantum efficiency η d can be modelled by mixing the state to be measured with the vacuum on a beam splitter of reflectivity η d followed by an ideal threshold detection [START_REF] Ferraro | Gaussian states in continuous variable quantum information[END_REF]. In that case, this corresponds to losses η d on modes 1, 2, and 3, followed by ideal threshold detections. By Lemma 7.2, commuting the losses back through the interferometer leads to the equivalent picture depicted in Fig. 7.9, where the losses on input mode 3 have been omitted, since the input state is the vacuum.

In that case, Alice's probability of winning is clearly lower than when the threshold detectors are perfect (Fig. 7.3), because she is restricted to lossy state preparation instead and we finally obtain with Eq. (7.48),

P d (A) = T r[|ψ x 〉 〈ψ x | Π η d (0) ⊗ (Π η d (1-b) (0) -Π η d (0) )]. ( 7
P d (A) = k,l≥0 |ψ kl | 2 (1 -η d ) k [(1 -η d (1 -b)) l -(1 -η d ) l ] max k,l 0 (1 -η d ) k [(1 -η d (1 -b)) l -(1 -η d ) l ] k,l 0 |ψ kl | 2 = max k,l 0 (1 -η d ) k [(1 -η d (1 -b)) l -(1 -η d ) l ] = max l 1 [(1 -η d (1 -b)) l -(1 -η d ) l ] = max l 1 [(1 -η d (1 -y)(1 -z)) l -(1 -η d ) l ], (7.52)
where we used b

= y + z -yz. Let l 0 ∈ N * such that max l 1 [(1 -η d (1 -b)) l -(1 -η d ) l ] = (1 -η d (1 -b)) l 0 -(1 -η d ) l 0 .
This last expression is an upperbound for P d (A), which is attained for ψ kl = δ k,0 δ l,l 0 , i.e. |ψ x 〉 = |0l 0 〉. Thus, the best strategy for Alice is to send the state:

|ψ〉 = (1 ⊗ R(π))H (a) |ψ x 〉 = (1 ⊗ R(π))H (a) |0l 0 〉 , (7.53)
where a = y(1-z) y+z-yz , and her winning probability is then:

P d (A) = (1 -η d (1 -y)(1 -z)) l 0 -(1 -η d ) l 0 , ( 7.54)
when Bob has a perfect delay line. Recalling Eq. (7.43), the best strategy for Alice when Bob has a lossy delay line of transmission η f is to send the state:

|ψ〉 = (1 ⊗ R(π))H (a) |ψ x 〉 = (1 ⊗ R(π))H (a) |0l 1 〉 , (7.55)
where

a = y(1-z)η f yη f +z-yzη f , where l 1 ∈ N * maximizes (1 -η d (1 -yη f )(1 -z)) l -(1 -η d ) l ,
and her 7.6. PRACTICAL PROTOCOL PERFORMANCE winning probability is then:

P d (A) = (1 -η d (1 -yη f )(1 -z)) l 1 -(1 -η d ) l 1 = η d [1 -(1 -yη f )(1 -z)] l 1 -1 j=0 (1 -η d ) j (1 -η d (1 -yη f )(1 -z)) l 1 -j-1 η d [1 -(1 -yη f )(1 -z)] l 1 -1 j=0 (1 -η d ) j = η d η d [1 -(1 -yη f )(1 -z)] 1 -(1 -η d ) l 1 1 -(1 -η d ) = [1 -(1 -yη f )(1 -z)](1 -(1 -η d ) l 1 ) 1 -(1 -yη f )(1 -z) y + z -yz, (7.56)
which is the winning probability when there are no losses. Let us finally derive the value of l 1 . For this, we define:

r = 1 -η d (1 -yη f )(1 -z) s = 1 -η d . (7.57)
We then consider a λ 1 ∈ R * + which maximizes (r λs λ ) for λ ∈ R * + . We have that:

d dλ 1 (r λ 1 -s λ 1 ) = 0 ⇔ λ 1 = ln ln s -ln ln r ln r -ln s , ( 7.58)
for strictly non-zero r and s and where ln denotes the complex logarithm function. This allows to deduce:

l 1 =
floor(λ 1 ) if r floor(λ 1 ) -s floor(λ 1 ) r ceil(λ 1 ) -s ceil(λ 1 )

ceil(λ 1 ) if r ceil(λ 1 ) -s ceil(λ 1 ) r floor(λ 1 ) -s floor(λ 1 ) . (7.59)

Note that if l 1 = 0 is obtained, we must take l 1 = 1 instead, since the condition l 1 must be satisfied from Eq. (7.52).

Practical protocol performance 7.6.1 Solving the system

We now analyze the performance of our protocol in a practical setting, by enforcing three conditions on the free parameters: the protocol must be fair, balanced, and it must provide better security bounds than any classical protocol. These conditions may be translated into the follow system of equations:

       (i) P h (A) = P h (B) fairness (ii) P d (A) = P d (B) balance (iii) Q > C quantum advantage (7.60)
Condition (i) enforces a fair protocol and we aim to solve for y as a function of x and z.

From Eq. ( 7.33), we can write:

(i) ⇔ η t η (B) d xzη (A) f + (1 -x)y(1 -z)η (B) f 2 = η t η (B) d (1 -x)(1 -y) (i) ⇔ (1 -x) (1 -z)η (B) f + 1 y + 2 x(1 -x)z(1 -z)η (A) f η (B) f y + xzη (A) f -(1 -x) = 0. (7.61)
We make the substitution Y = y in order to transform Eq. ( 7.61) into a second-order polynomial equation. We then take only the positive solution (since y must be positive) which reads:

Y = xz(1 -z)η (A) f η (B) f -(1 -z)η (B) f + 1 xzη (A) f -(1 -x) -xz(1 -z)η (A) f η (B) f 1 -x (1 -z)η (B) f + 1 . (7.62)
We may finally write:

(i) ⇔ y = f x, z, η (i) f , η d , η t , (7.63)
where:

f x, z, η (i) f , η d , η t = (1 -x) (1 -z)η (B) f + 1 -xzη (A) f -xz(1 -z)η (A) f η (B) f 2 (1 -x) (1 -z)η (B) f + 1 2 . (7.64)
Note that y should be a real number, and hence we require that the expression under the first square root of f x, z, Condition (ii) enforces a balanced protocol. Recalling the cheating probabilities from Eqs.(7.34) and (7.36), this translates into the following expression for x:

η (i) f , η d , η t is positive, i.e: z (1 -x)(1 + η (B) f ) xη (A) f + (1 -x)η (B) f . ( 7
(ii) ⇔ x = g y, z, η (i) f , η (i) d , (7.66)
where

g y, z, η (i) f , η (i) d = 1 η (A) f η (A) d 1 -max l 1 [(1 -η (B) d (1 -yη (B) f )(1 -z)) l -(1 -η (B) d ) l ] . ( 7
(A) = max l>0 1 -(1 -yη (A) f )(1 -z)η (B) d l -1 -η (B) d l and P d (B) = 1 -xη (A) f η (A)
d . Recalling Eq. (3.18), the condition for which quantum protocols achieve strictly better bounds than classical protocols (Q>C), reads:

Q > C ⇐⇒ P (0) A + P (1) A > 1 P (0) B + P (1) A > 1 (7.69)
In our case, this may be written:

Q > C ⇐⇒ P d (A) > 1 -η (B) d 1 + P d (B) > 1 (7.70)
Since we allow x ∈ [0, 1[ and η (A) f η (A) d > 0, the second condition is always satisfied. We must therefore ensure that:

P d (A) > 1 -η (B) d . ( 7
P d (B) > 1 -η (B) d 1 -xη (A) f η (A) d > 1 -η (B) d η (B) d > xη (A) f η (A) d .
(7.72)

When both parties have the same detection efficiency, this condition becomes trivial since we always have that 1 > xη (A) f . Hence (iii) is always satisfied in this case. Overall, the conditions from Eq. (7.60) reduce to: From these conditions, we can numerically obtain a range of parameters for which system (7.73) is satisfied. In particular, when both parties have the same detection efficiency, condition (iii) is always true for x < 1. Fig. 7.11 shows a choice of parameters for which our protocol satisfies fairness, balance, and quantum advantage, up to a distance of d.

Results

         (i) y = f x, z, η (i) f (ii) x = g y, z, η (i) f , η (i)

Extension to lower bias (preliminary results) 7.7.1 Framework

As a brief introduction, we describe the general n-rounded weak coin flipping framework presented in Fig. 7.12, which involves unitaries and projective measurements. Alice and Bob start with a separable state on Hilbert space A ⊗ M ⊗ B, where M is the message space, in which the quantum message which they exchange lives. • If c i = 1, the protocol follows to Step 4. If c i = 0, the protocol follows to round (i + 1).

3. For even i n:

• Bob mixes M and B on a beam splitter of reflectivity x i .

• Bob keeps B and sends M to Alice.

• Alice mixes A with M on a beam splitter of reflectivity y i .

• Alice measures M with a photon-number-resolving detector, and broadcasts the outcome c i ∈ {0, 1}.

• If c i = 0, the protocol follows to

Correctness for 2 rounds

In this section, we derive the correctness for a 2-rounded version of the protocol from The protocol is fair when both parties have equal winning probabilities: outcome (0, 1) after Alice applies the y 2 beam splitter (in order for her to declare c 2 = 1

P h (A) = P h (B) = 1 2 . ( 7
and Bob to pass her verification test). The state before the beamsplitter must therefore be: H (y 2 ) |01〉 〈01| AM H (y 2 ) . The projector associated with winning Bob may therefore be expressed as: Sylvester's criterion states that a symmetric matrix is positive semidefinite if and only if all its principal minors are non-negative. Assuming that Z is diagonal, condition (ii) is then satisfied for Z 00 = 〈0| Z |0〉 1 and Z kk = 〈k| Z |k〉 0, with k 1. Condition (i) is satisfied for Z 00 y 2 , Z 11 (1 -y 2 ), Z 00 -y 2 Z 00 -(1 -y 2 ) y 2 (1 -y 2 ) and Z kk 0, with k 2. Satisfying both conditions then implies the following conditions on diagonal matrix Z: f Z 00 = x 1 (1 -y 2 ) + (1 -x 1 )Z 00 + x 1 y 2 (1 -y 2 ) Z 00 -y 2 .

Π AMC = |0〉 〈0| A ⊗
             (
(7.87)

The minimum of f is reached when f Z 00 = 0, i.e. when:

f Z 00 = 1 -x 1 - x 1 y 2 (1 -y 2 )
Z 00 -y 2 2 = 0, (

which implies: We recall that condition (a) must also be satisfied, which gives:

Z 00 = y 2 + x 1 y 2 (
(a) ⇔ Z 00 1 ⇔ x 1 y 2 (1 -y 2 ) (1 -y 2 ) 1 -x 1

x 1 y 2 (1 -y 2 )(1 -x 1 ) y 2 1 -x 1 .

(7.93)

We may therefore finally upper-bound Bob's cheating probability by:

P d (B) x 1 (1 -y 2 ) + y 2 (1 -x 1 ) 2 , (7.94)
with y 2 1 -x 1 .

Dishonest Alice

Let us consider a 2-rounded version of the protocol from Section 7.7.2. The setup for Dishonest Alice reduces to that in Fig. 7.15. In the security proof, we dismiss Alice's private register living in A since she has complete control over it. Note that all spaces are infinite-dimensional.

Alice wins when outcomes c 1 = c 2 = 0 are declared (first by Bob, and then by herself).

She must also pass Bob's verification test, which consists of a beam splitter of amplitude v, followed by a projection onto state |01〉 AB . The coefficient v must unentangle the incoming registers A and B, and is given by: v = 2(1 -x 1 )x 2 (1 -y 1 ). where the constraints follow from Bob's honest action on systems M and B:

Ω(ρ 1 ) = H (x 2 ) (|0〉 〈0| ⊗ 1) H (y 1 ) ρ 1 H (y 1 ) (|0〉 〈0| ⊗ 1) H (x 2 ) . (7.97)

s.t. 1 M ⊗ Z 1 Ω * (1 M ⊗ Z 2 ) 1 M ⊗ Z 2 Z 3 Z 3 = H (v) MB |01〉 〈01| H (v) MB Z 1 = Z † 1 , Z 2 = Z † 2 .
(7.98)

We shall now derive an analytical upper bound on Alice's cheating probability by finding a feasible solution to problem (7.98). We recall Sylvester's criterion, which states that a symmetric matrix is positive semidefinite if and only if all its principal minors are non-negative. This allows to infer the following conditions from the second and third constraints of (7.98):

             Z 00 2 Z 11 2 -v -Z 01 2 Z 10 2 0 Z 00 2 -(1 -v) Z 11 2 -Z 01 2 Z 10 2 0 Z 11 2 -v Z 00 2 -(1 -v) -v(1 -v) 0
Z kk 0 for k 2.

(7.99)

Note that if these conditions are enforced, then Sylvester's criterion is trivially satisfied for all other principal minors of 1 M ⊗ Z 2 -Z 3 . Given these conditions, we now study the first constraint of problem (7.98). We start by applying the H (y 1 ) transformation to both sides of the inequality:

H (y 1 ) (1 M ⊗ Z 1 ) H (y 1 ) H (y 1 ) H (y 1 ) (|0〉 〈0| ⊗ 1) H (x 2 ) (1 M ⊗ Z 2 ) H (x 2 ) (|0〉 〈0| ⊗ 1) H (y 1 ) H (y 1 )

H (y 1 ) (1 M ⊗ Z 1 ) H (y 1 ) 1 MB (|0〉 〈0| ⊗ 1) H (x 2 ) (1 M ⊗ Z 2 ) H (x 2 ) (|0〉 〈0| ⊗ 1) 1 MB H (y 1 ) (1 M ⊗ Z 1 ) H (y 1 ) (|0〉 〈0| ⊗ 1) H (x 2 ) (1 M ⊗ Z 2 ) H (x 2 ) (|0〉 〈0| ⊗ 1) . (7.100)

We now introduce the following lemma, proven in Appendix C.5: If matrix Z B is diagonal, we have:

Lemma
E (t) (Z B ) = |0〉 〈0| ⊗ ∞ m=0 m l=0 m l Z ll B (1 -t) m-l t l |m〉 〈m| . (7.102)
The rigorous treatment of this calculation is now left for further work. However, as an investigation which might slightly under-estimate Alice's cheating probability, we now apply the projector (|0〉 〈0| ⊗ 1) to both sides of Eq. (7.100). This will only yield a necessary condition regarding positivity, since in order for the equivalence to hold, we should in fact apply projectors onto each two-mode p-photon subspace, given by: Applying such projectors onto the block-diagonal subspaces (instead of (|0〉 〈0| ⊗ 1)) will give a set of conditions (one for each two-mode p-photon subspace), which are equivalent to Eq. (7.100). This will then enable us to calculate Alice's cheating probability rigorously.

Π (p) =
For now, we nevertheless apply (|0〉 〈0| ⊗ 1), which, using Lemma 7.3, implies E (y 1 ) (Z 1 ) Combining the results from Sections 7.7.3, 7.7.4 and 7.7.5 leads to the following system:

E (x 2 ) (Z 2 ):
           (i) y 2 x 1 + (1 -y 2 )(1 -x 2 )(1 -y 1 )(1 -x 1 ) 2 + x 2 (1 -y 1 )(1 -x 1 )
= (1 -x 1 )y However, the convergence to 1/6 seems to be very fast, which is certainly due to the under-estimated cheating probability of Dishonest Alice. Our further work will confirm whether this is actually the case.

Conclusion

By noticing a non-trivial connection between the early protocol from [START_REF] Spekkens | A quantum protocol for cheat-sensitive weak coin flipping[END_REF] and linear optical transformations, we answer the question of the implementability of quantum weak coin flipping, and show that it is achievable with current technology over a few kilometers. Both parties require a set of beam splitters and single photon threshold detectors. State generation on Alice's side can be performed with any heralded probabilistic single-photon source, for which photon indistinguishability and state purity do not matter. Only Alice requires an optical switch, which is commercially available. Although short-term quantum storage is needed, a spool of optical fiber with twice the length of the quantum channel suffices, and provides the required storage/retrieval efficiency.

On the fundamental level, our results have raised the question of a potentially deep connection between the large family of protocols from [START_REF] Mochon | Quantum weak coin flipping with arbitrarily small bias[END_REF][START_REF] Mochon | Quantum weak coin flipping with bias of 0.192[END_REF][START_REF] Mochon | Large family of quantum weak coin-flipping protocols[END_REF] (which achieves biases as low as 1/6) and the linear optics formalism. In order to investigate this, we have constructed an extension of the protocol to n rounds, and numerically investigated the bias for n = 2.

This opens interesting perspectives. First, the rigorous derivation for cheating Alice in the 2-rounded protocol must be pursued, since it has potentially been under-estimated.

Solving the set of conditions for a fair and balanced protocol with more than 2 rounds could then help us investigate whether our protocol resembles the 1/6 family, or whether it is fundamentally different and can actually achieve biases below 1/6. Furthermore, unveiling the potential explicit mapping between these two frameworks could allow a deeper understanding of how to lower the bias below 1/6. Finally, our implementation proposal for the 1-rounded protocol opens the door to a near-future experimental demonstration of weak coin flipping.

between unitaries and linear-optical circuits, and constructed a simple protocol which involves a single photon and three beamsplitters only. We have then started to investigate how the bias could be lowered by extending this protocol to n rounds.

These results also open the door to interesting perspectives, both on the theoretical and experimental sides. Theoretically, now that the connection between unitaries and linear optics has been established, the explicit mapping to infinite-dimensional Fock spaces should be derived in order to investigate the true lower bound on the bias which our n-rounded protocol can achieve. Experimentally, our implementation proposal encourages a full demonstration of this milestone primitive with a heralded single photon source, three beamsplitters and a spool of optical fiber.

C.2 Creation operator evolution in the lossy protocol

The evolution of the creation operator on mode 1 is given, in terms of creation operators on modes 2 and 3, by: D

RÉSUMÉ EN FRANÇAIS (FRENCH SUMMARY)

Les lois de la mécanique quantique présentent un fort potentiel d'amélioration pour la sécurité des réseaux de communication, de la distribution de clé secrète au vote électronique, en passant par la banque en ligne. La sécurité d'un grand nombre de ces tâches repose actuellement sur des hypothèses de calcul: la complexité de l'encodage est telle qu'un adversaire utilisant une technologie de pointe ne pourra obtenir la puissance de calcul suffisante pour compromettre la sécurité du protocole (sur une échelle de temps donnée). Cependant, les progrès en algorithmique, ainsi que l'émergence de nouvelles plateformes quantiques permettant une augmentation drastique de la puissance de calcul pour certaines tâches, présentent une menace pour ce type de sécurité. Il est donc naturel de s'intéresser aux avantages que peut nous apporter la théorie quantique afin d'éliminer le recours aux hypothèses de calcul.

Cette thèse porte sur l'analyse de sécurité pratique et la réalisation expérimentale de deux tâches cryptographiques importantes, dont la sécurité est garantie par les lois de la mécanique quantique: la monnaie quantique et le tirage à pile-ou-face faible.

Contrairement à la distribution de clé secrète, où les parties impliquées coopèrent face à un adversaire commun, ces protocoles impliquent des parties n'ayant aucune confiance mutuelle.

La monnaie quantique exploite le théorème de non-clonage quantique pour générer des jetons, billets ou cartes de crédit strictement infalsifiables. Ceci est impossible sans hypothèse de calcul en utilisant des ressources uniquement classiques. Nous réalisons la première démonstration expérimentale de cette fonctionnalité sur une plateforme

  and U. Chabaud.

Figure 2 . 1 :

 21 Figure 2.1: Schematic configuration of the atomic Λ-system. Level |3〉 is considered as the excited state, while levels |1〉 and |2〉 are the two ground states, which are not coupled to one another. A weak signal field with Rabi frequency Ω s drives the |1〉 → |3〉 transition, whilst a stronger control field with Rabi frequency Ω c drives the |2〉 → |3〉 transition.

Figure 3 . 1 :

 31 Figure 3.1: Simple classification of quantum money schemes. The first column indicates which type of key is used, as well as the level of security it achieves. The second column indicates the corresponding type of verification. The third column indicates the analogy which may be drawn with classical payment methods.

3 . 2 ,Figure 3 . 2 :

 3232 Figure 3.2: Illustration of the BB84 protocol steps with polarized photons.

4 PROOF

 4 Quantum credit card schemes provide the most practical candidate for experiment, since they allow classical verification: the central bank can verify the authenticity of the quantum credit card through a distant payment terminal, which performs local quantum operations only and communicates classically. This avoids long-distance transmission of quantum states through noisy and lossy quantum channels, which can lead to the rejection of honest credit cards.

. 1 )

 1 where |0〉, |1〉 and |+〉, |-〉 are the Pauli σ z and σ x basis eigenstates, respectively. Within the secret classical key, b = 0 indicates that the first qubit is encoded in the σ z basis and the second in the σ x basis, while b = 1 indicates that the first qubit is encoded in the σ x Q xx : σ x ⊗σ x ?

Figure 4 . 1 :

 41 Figure 4.1: Practical quantum money protocol.The sequence of interactions between the credit card holder (client), the trusted payment terminal (vendor) and the mint/bank involved in the transaction. In the preparation phase, the mint uses a secret key k (s) , associated to public serial number s, to prepare the quantum state loaded on the credit card, which is then handed to the client. In the transaction phase, the vendor randomly selects one out of two challenge questions Q zz or Q xx , measures the qubits accordingly, and sends the classical outcome to the bank, who can then verify the validity of the credit card or detect a forgery attempt.

4. 3 . 1

 31 Single qubit pairLet us now analyze what happens when a dishonest client tries to produce to copies of the single-qubit-pair quantum credit card fragment. The qubit pair is unknown to the client, since the secret key k (s) is private and known by the bank only. The no-cloning theorem (Section 3.1.2) therefore ensures that a dishonest client cannot pass both challenges Q zz 4.3. SECURITY and Q xx at the same time in two separate branches of the bank. This effective cheating challenge, which we label Q , may be interpreted as the conjunction of both Q zz and Q xx challenges: Q = Provide the two correct bits c 0 and c 1 .

Figure 4 . 2 :

 42 Figure 4.2: Security regions for weak coherent states. B = η tot + ln(1 -P D )/µ is plotted as a function of the average number of photons per pulse µ and the total efficiency η tot = η m η d . The security condition of Eq. (4.19) is fulfilled when B > 0.

  (4.3) and(4.11) in order for the credit card to be validated by the bank. This does not compromise the security of the implementation as it is always possible to symmetrize the data by relabeling the bases such that in practice the two parameters become effectively the same. Once c has been measured, the correctness and security of the full protocol can be estimated for the different scenarios from Eqs. (4.6) and (4.12).The experimental setup is shown in Fig.4.3. The qubit pairs of the credit card state are encoded in the polarization of weak coherent states of light produced with standard optical communication components. The light emitted at 1564 nm by a continuous-wave laser diode is first modulated using an acousto-optic modulator to produce pulses with a duration of 20 µs and a repetition rate of 20 kHz. A variable optical attenuator is used to reduce the intensity of the pulses and set the average photon number per pulse µ.

Figure 4 . 3 :

 43 Figure 4.3: Experimental setup of the quantum money system. The credit card

Figure 4 . 4 :

 44 Figure 4.4: Simplified diagram of the acousto optic modulator's deflection function.

Figure 4 . 5 :

 45 Figure 4.5: Polarization waveguide and electrode configuration of the EOspace polarization controller. For image source, please visit http://www.hanamuraoptics.com.

  using PCI-6115 National Instruments data acquisition cards, driven by DAQ-mx and controlled by a C++ program running on Ubuntu. Generation and acquisition are triggered by the clock produced by the waveform generator.The voltages applied to the first two stages of the polarization controller are held constant, at bias value, thanks to two standard asymmetrical voltage sources. The desired voltage sequence applied to the third stage to generate the paired states in real time is randomly generated by an Octave program. The corresponding V A and V C voltages are then applied through the two NI card output channels, and amplified through a standard op-amp circuit with gain 2.5 (as the NI cards cannot generate over 10V). The photon detection output is a TTL signal, which is acquired by the same card on 4 separate input channels. The results are read as vectors, for which the ith element contains either a 5V input if one or more photons have been detected in the ith pulse and a 0V input for no detection.

Figure 4 . 6 :

 46 Figure 4.6: Experimental results for different values of µ. Measured c zz , c xx , and c values (green symbols) are plotted as a function of the average photon number per pulse µ. Each measured block consists of a number of post-selected pairs ranging from 1.3 × 10 5 for µ = 0.025 to 2.6 × 10 5 for µ = 0.40 and 2.0 × 10 5 for µ = 1. The red lines correspond to the security threshold for the "weak coherent state" protocol encompassing USD attacks for values of η = 0.020 and η = 0.402, while the purple line corresponds to the threshold for general attacks on phase-randomized weak coherent states, for the same values of η. The full pink line corresponds to the security threshold for the "single-photon state" protocol. The cyan curves correspond to theoretical simulations for weak coherent states assuming a dark count probability of 7 × 10 -5 , detection efficiency of 25%, state purity values of p = 0.76, 0.93, 1 and post-selection of pulses with at least one detector clicking (Appendix A.3). The blue curves correspond to the same theoretical simulations, this time for true single-photon states with an emission efficiency µ. The plotted error bars correspond to 5σ.

Figure 4 . 7 :

 47 Figure 4.7: Correctness and security parameters of the full scheme. Numerical calculations for the correctness parameter c (left) and security parameter (right) as a function of the number n of measured qubit pairs in the credit card, with experimental values of c = 0.953 ± 0.011 for µ = 1 (full red and blue lines), c = 0.965 ± 0.010 for µ = 0.40 (mixed blue line), c = 0.966 ± 0.018 for µ = 0.10 (dashed red and blue lines) and c = 0.953 ± 0.014 for µ = 0.025 (dotted red and blue lines). Note that the lowest values of the 5σ error bars are considered for plotting these bounds. Red lines correspond to the "single-photon state" protocol while blue lines correspond to the "weak coherent state" protocol.

1 :

 1 , |+i〉 , |-〉 , |-i〉}. More specifically, bit k (s) j is encoded in the σ x basis when b (s) j = 0, and in the σ y basis when b (s) j = 1. The mint stores |e (k,b) 〉 in a quantum memory and hands it to a client. When a transaction must be performed, the vendor's honest terminal measures each of the n qubits of |e (k,b) 〉 in a basis dictated by a challenge question randomly chosen by the bank. For a single qubit state, the two challenges read: c 0 : Give the correct measurement outcome if the qubit is encoded in the σ x basis, and provide any outcome if the qubit is encoded in the σ y basis. c Give the correct measurement outcome if the qubit is encoded in the σ y basis, and provide any outcome if the qubit is encoded in the σ x basis.

2 . 2 .

 22 When dealing with the coherent states from Eq. (5.2), we use the existence of a squashing model for our threshold detector measurement setup, described in Appendix B.1. By imposing a condition on the terminal's postprocessing, consisting of assigning a random measurement outcome to any double click, this model allows to express the infinite-dimensional measurement operators in a 3-dimensional space spanned by {|0〉 , |1〉 , |∅〉}, which greatly simplifies the security analysis.

  k 〉 is the squashed qubit associated with the original state |α k 〉, i.e. |β 0 〉 = |+〉, |β 1 〉 = |+i〉, |β 2 〉 = |-〉, |β 3 〉 = |-i〉, and |β ⊥ k 〉 is its orthogonal qubit state. Appendix B.1 provides a more detailed explanation of this squashing model. The factor 1/4 indicates that each |α k 〉 is equally likely to occur, while 1/2 accounts for the trusted terminal's random measurement basis choice. Using Lemma 5.1, we may then rewrite these expressions as

  c j : Adopt the honest strategy and duplicate the classical outcome. Success probability: 1 c i = c j : Pick a basis b (or b) at random, measure the state in this basis, and send the classical outcome to answer challenge c b (or c b ). Send a random measurement outcome to the other challenge c b (or c b ). If the correct basis b was picked, then the adversary succeeds with probability 1. If the wrong basis b was picked, thenthe success probability is1 2 . Success probability :1

Figure 5 . 1 :Figure 5 . 2 :Figure 5 . 3 :

 515253 Figure 5.1: Optimal numerical values associated with problem (5.11) for fixedphase states. These are plotted as a function of average photon number µ for different values of error rate e and detection efficiency η d = 100%, for both trusted and untrusted terminals. Solid lines correspond to the honest losses f h = e -η d µ . Points indicate the losses f d that a dishonest party must induce in order to succeed with error e. The protocol is secure in regions where f d > f h . We used the SDPT3 solver [88, 89] of the CVX [90, 91] software.

Figure 5 . 4 :

 54 Figure 5.4: Optimal numerical values of problem (5.13) as a function of average photon number µ for fixed-phase coherent states. Results are plotted for different values of detection efficiency η d in the trusted terminal scenario. Points indicatethe error e that a dishonest party must induce in order to succeed by introducing less than e -η d µ losses. We used the SDPT3 solver[START_REF] Toh | Sdpt3 -a matlab software package for semidefinite programming[END_REF][START_REF] Tütüncü | Solving semidefinite-quadratic-linear programs using sdpt3[END_REF] of the CVX[START_REF] Grant | CVX: Matlab software for disciplined convex programming, version 2.1[END_REF][START_REF] Grant | Graph implementations for nonsmooth convex programs[END_REF] software.

Figure 5 . 5 :

 55 Figure 5.5: Optimal numerical values of problem (5.13) as a function of average photon number µ for phase-randomized coherent states. Results are plotted for different values of detection efficiency η d in the trusted terminal scenario. Points indicate the error e that a dishonest party must induce in order to succeed by introducing less than e -η d µ losses. We used the SDPT3 solver [88, 89] of the CVX [90, 91] software.

. 1 )

 1 where the first and second Fock spaces denote the horizontal and vertical polarization modes, respectively. If the {H, V } basis was picked, bits 0 and 1 are respectively encoded as |H(α)〉 and |V (α)〉. If the {D, A} basis was picked, bits 0 and 1 are respectively encoded as |D(α)〉 and |A(α)〉.

91 CHAPTER 6 .Figure 6 . 2 :

 91662 Figure 6.2: Experimental setup for credit card generation, storage, and measurement.The signal is produced by a continuous, attenuated laser at 894nm, chopped into pulses using an acousto-optic modulator (AOM). Polarization is encoded in real time using a Pockels cell (PC). Components are then separated on a beam displacer (BD1), and focused onto the cloud with a lens (purple disk). Prior to the cloud, the vertical component is flipped to horizontal using a half waveplate (black half-disk). Both horizontal components are then transformed into right-circular using a quarter waveplate (green disk). These are mapped onto a collective atomic excitation, thanks to a control beam which creates EIT. The control beam is re-applied when the polarization states must be retrieved, and the same set of waveplates and beam displacer (BD2) inverts the previous polarization transformation, and recombines the two components. Measurement consists of another half waveplate (black disk) for basis selection and a polarizing beamsplitter (PBS) for projection. Two Fabry-Pérot cavities are used to filter out the control beam. States are finally detected using two avalanche single photon detectors (APD1 and APD2).

Figure 6 . 3 :

 63 Figure 6.3: Noise tolerance as a function of average photon number µ. Points give the allowed error rate e (in %) given a fixed detection efficiency η d and fixed photon number per pulse µ. These are calculated by solving problem (5.13) numerically.

CHAPTER 6 . 100 C

 6100 PHOTON

  g z b o A A w m 4 A E 8 g W e D G Y / G i / G 6 b C 0 Y q 5 l j 8 A P G 2 y c O j 4 2 o < / l a t e x i t > |0i < l a t e x i t s h a 1 _ b a s e 6 4 = " m F b y g 4

  1 S a x / L e j B P 0 I z q Q P O S M G i s 9 P L l d R e V A Y K 9 U d i v u D G S Z e D k p Q 4 5 6 r / T V 7 c c s j V A a J q j W H c 9 N j J 9 R Z T g T O C l 2 U 4 0 J Z S M 6 w I 6 l k k a o / W x 2 8 I S c W q V P w l j Z k o b M 1 N 8 T G Y 2 0 H k e B 7 Y y o G e p F b y r + 5 3 V S E 1 7 5 G Z d J a l C y + a I w F c T E Z P o 9 6 X O F z I i x J Z Q p b m 8 l b E g V Z c Z m V L Q h e I s v L 5 N m t e K d V 6 p 3 F + X a d R 5 H A Y 7 h B M 7 A g 0 u o w S 3 U o Q E M I n i G V 3 h z l P P i v D s f 8 9 Y V J 5 8 5 g j 9 w P n 8 A t n e Q W Q = = < / l a t e x i t > |1i < l a t e x i t s h a 1 _ b a s e 6 4 = " H

1 <Figure 7 . 1 :

 171 Figure 7.1: Representation of the honest protocol. The dashed black lines indicate Alice and Bob's laboratories, respectively, while the dashed red lines represent beam splitters with reflectivity indicated in red. |0〉 and |1〉 are the vacuum and single photon Fock states, respectively. Arrows represent quantum communication. Bob broadcasts the classical outcome c, which controls the optical switch S on Alice's side. The protocol when Bob declares c = 0/1 is represented in orange/green. The final outcomes are the expected outcomes for an honest protocol.

  t e x i t s h a 1 _ b a s e 6 4 = " c D l 5 n 9Q F 4 L 6 h Y K F l i E N W A R B a s v o = " > A A A B 6 n i c d V D L S g N B E O z 1 G e M r 6 t H L Y B D i Z d n d L E m 8 B b 1 4 j G g e k C x h d j J J h s w + m J k V w 5 J P 8 O J B E a 9 + k T f / x t k k g o o W N B R V 3 X R 3 + T F n U l n W h 7 G y u r a + s Z n b y m / v 7 O 7 t F w 4 O W z J K B K F N E v F I d H w s K W c h b S q m O O 3 E g u L A 5 7 T t T y 4 z v 3 1 H h W R R e K u m M f U C P A r Z k B G s t H R T u j / r F 4 q W e V 6 r O G 4 F W a Z l V W 3 H z o h T d cs u s r W S o Q h L N P q F 9 9 4 g I k l

  1 S a x / L e j B P 0 I z q Q P O S M G i s 9P L l d R e V A Y K 9 U d i v u D G S Z e D k p Q 4 5 6 r / T V 7 c c s j V A a J q j W H c 9 N j J 9 R Z T g T O C l 2 U 4 0 J Z S M 6 w I 6 l k k a o / W x 2 8 I S c W q V P w l j Z k o b M 1 N 8 T G Y 2 0 H k e B 7 Y y o G e p F b y r + 5 3 V S E 1 7 5 G Z d J a l C y + a I w F c T E Z P o 9 6 X O F z I i x J Z Q p b m 8 l b E g V Z c Z m V L Q h e I s v L 5 N m t e K d V 6 p 3 F + X a d R 5 H A Y 7 h B M 7 A g 0 u o w S 3 U o Q E M I n i G V 3 hz l P P i v D s f 8 9 Y V J 5 8 5 g j 9 w P n 8 A t n e Q W Q = = < / l a t e x i t > |1i < l a t e x i t s h a 1 _ b a s e 6 4 = " H

  1 S a x / L e j B P 0 I z q Q P O S M G i s 9 P H l d R e V A Y K 9 U d i v u D G S Z e D k p Q 4 5 6 r / T V 7 c c s j V A a J q j W H c 9 N j J 9 R Z T g T O C l 2 U 4 0 J Z S M 6 w I 6 l k k a o / W x 2 8 I S c W q V P w lj Z k o b M 1 N 8 T G Y 2 0 H k e B 7 Y y o G e p F b y r + 5 3 V S E 1 7 5 G Z d J a l C y + a I w F c T E Z P o 9 6 X O F z I i x J Z Q p b m 8 l b E g V Z c Z m V L Q h e I s v L 5 N m t e K d V 6 p 3 F + X a d R 5 H A Y 7 h B M 7 A g 0 u o w S 3 U o Q E M I n i G V 3 h z l P P i v D s f 8 9 Y V J 5 8 5 g j 9 w P n 8 A u A K Q W g = = < / l a t e x i t > ⇤ B < l a t e x i t s h a 1 _ b a s e 6 4 = " S 5 M O 1 8 9 w N u Z h / K F T T P A y h y x 8 a a 8 = " > A A A B 8 H i c b V D L S g M x F L 1 T X 7 W + q i 7 d B I v g q s x U Q Z e l b l y 4 q G A f 0 g 4 l k 8 m 0 o U l m S D J C G f o V b l w o 4 t b P c e f f m L a z 0 N Y D g c M 5 5 5 J 7 T 5 B w p o 3 r f j u F t f W N z a 3 i d m l n d 2 / / o H x 4 1 N Z x q g h t k Z j H q h t g T T m T t G W Y 4 b S b K I p F w G k n G N / M / M 4 T V Z r F 8 s F M E u o L P J Q s Y g Q b K z 3 2 7 2 w 0 x I P G o F x x q + 4 c a J V 4 O a l A j u a g / N U P Y 5 I K K g 3 h W O u e 5 y b G z 7 A y j H A 6 L f V T T R N M x n h I e 5 Z K L K j 2 s / n C U 3 R m l R B F s b J P G j R X f 0 9 k W G g 9 E Y F N C m x G e t m b i f 9 5 v d R E 1 3 7 G Z J I a K s n i o y j l y M R o d j 0 K m a L E 8 I k l m C h m d 0 V k h B U m x n Z U s i V 4 y y e v k n a t 6 l 1 U a / e X l X o j r 6 M I J 3 A K 5 + D B F d T h F p r Q A g I C n u E V 3 h z l v D j v z s c i W n D y m W P 4 A + f z B 1 C B k B Y = < / l a t e x i t > 0 < l a t e x i ts h a 1 _ b a s e 6 4 = " r s P G D o 3 8 d C U r L s A t / f t n o s r C h U A = " > A A A B 6 H i c b V B N S 8 N A E J 3 U r 1 q / q h 6 9 L B b B U 0 m q o M e i F 4 8 t 2 F p o Q 9 l s J + 3 a z S b s b o Q S + g u 8 e F D E q z / J m / / G b Z u D t j 4 Y e L w 3 w 8 y 8 I B F c G 9 f 9 d g p r 6 x u b W 8 X t 0 s 7 u 3 v 5 B + f C o r e N U M W y x W M S q E 1 C N g k t s G W 4 E d h K F N A o E P g T j 2 5 n / 8 I R K 8 1 j e m 0 m C f k S H k o e c U W O l p t s v V 9 y q O w d Z J V 5 O K p C j 0 S 9 / 9 Q Y x S y O U h g m q d

Figure 7 . 2 :

 72 Figure 7.2: Reduction of the protocol for dishonest Bob. His most general cheating consists in always broadcasting c = 1, and applying a general quantum operation Λ B to his subsystem. The outcome indicated correspond to Bob winning.

  1 S a x / L e j B P 0 I z q Q P O S M G i s 9 P L l d R e V A Y K 9 U d i v u D G S Z e D k p Q 4 5 6 r / T V 7 c c s j V A a J q j W H c 9 N j J 9 R Z T g T O C l 2 U 4 0 J Z S M 6 w I 6 l k k a o / W x 2 8 I S c W q V P w lj Z k o b M 1 N 8 T G Y 2 0 H k e B 7 Y y o G e p F b y r + 5 3 V S E 1 7 5 G Z d J a l C y + a I w F c T E Z P o 9 6 X O F z I i x J Z Q p b m 8 l b E g V Z c Z m V L Q h e I s v L 5 N m t e K d V 6 p 3 F + X a d R 5 H A Y 7 h B M 7 A g 0 u o w S 3 U o Q E M I n i G V 3 hz l P P i v D s f 8 9 Y V J 5 8 5 g j 9 w P n 8 A t n e Q W Q = = < / l a t e x i t > { < l a t e x i t s h a 1 _ b a s e 6 4 = " 7 j F / a x i K Q 5 0 q c k 4 5 3 c B + a S 7 C D O 0 = " > A A A B 6 X i c b V B N S 8 N A E J 3 U r 1 q / q h 6 9 L B b B U 0 m q o M e i F 4 9 V 7 A e 0 o W y 2 m 3 b p Z h N 2 J 0 I J / Q d e P C j i 1 X / k z X / j t s 1 B W x 8 M P N 6 b Y W Z e k E h h 0 H W / n c L a + s b m V n G 7 t L O 7 t 3 9 Q P j x q m T j V j D d Z L G P d C a j h U i j e R I G S d x L N a R R I 3 g 7 G t z O / / c S 1 E b

  7 6 J a u 7 + s 1 G / y O I p w A q d w D h 5 c Q R 3 u o A F N Y B D C M 7 z C m z N 2 X p x 3 5 2 P R W n D y m W P 4 A + f z B 5 z S j W k = < / l a t e x i t > 0 < l a t e x i t s h a 1 _ b a s e 6 4 = " r s P G D o 3 8 d C U r L s A t / f t n o s r C h U A = " > A A A B 6 H i c b V B N S 8 N A E J 3 U r 1 q / q h 6 9 L B b B U 0 m q o M e i F 4 8 t 2 F p o Q 9 l s J + 3 a z S b s b o Q S + g u 8 e F D E q z / J m / / G b Z u D t j 4 Y e L w 3 w 8 y 8 I B F c G 9 f 9 d g p r 6 x u b W 8 X t 0 s 7 u 3 v 5 B + f C o r e N U M W y x W M S q E 1 C N g k t s G W 4 E d h K F N A o E P g T j 2 5 n / 8 I R K 8 1 j e m 0 m C f k S H k o e c U W O l p t s v V 9 y q

  s C N 7 y y 6 u k X a t 6 F 9 V a 8 7 J S v 8 n j K M I J n M I 5 e H A F d b i D B r S A A c I z v M K b 8 + i 8 O O / O x 6 K 1 4 O Q z x / A H z u c P e m e M u A = = < / l a t e x i t > 0 < l a t e x i t s h a 1 _ b a s e 6 4 = " r s P G D o 3 8 d C U r L s A t / f t n o s r C h U A = " > A A A B 6 H i c b V B N S 8 N A E J 3 U r 1 q / q h 6 9 L B b B U 0 m q o M e i F 4 8 t 2 F p o Q 9 l s J + 3 a z S b s b o Q S + g u 8 e F D E q z / J m / / G b Z u D t j 4 Y e L w 3 w 8 y 8 I B F c G 9 f 9 d g p r 6 x u b W 8 X t 0 s 7 u 3 v 5 B + f C o r e N U M W y x W M S q E 1 C N g k t s G W 4 E d h K F N A o E P g T j 2 5 n / 8 I R K 8 1 j e m 0 m C f k S H k o e c U W O l p t s v V 9 y q

  7 a Z d u N m F 3 o 5 b Y / + H F g y J e / S / e / D d u 2 x y 0 9 c H A 4 7 0 Z Z u Y F C W d K O 8 6 3 t b S 8 s r q 2 X t g o b m 5 t 7 + y W 9 v a b K k 4 l x Q a N e S z b A V H I m c C G Z p p j O 5 F I o o B j K x h e T f z W P U r F Y n G r R w n 6 E e k L F j J K t J H u n r x E s e 6 j J 4 n o c + y W y k 7 F m c J e J G 5 O y p C j 3 i 1 9 e b 2 Y p

  6 2 P W u m T l M w f w B 9 b n D w g B k t o = < / l a t e x i t > (b) < l a t e x i t s h a 1 _ b a s e 6 4 = " r Y P W 7 o / Z 3 D i V Z x 4 I p 7 e n t O q B S 8 g = " > A A A B 6 n i c d V D L S g N B E O y N r x h f U Y 9 e B o M Q L 8 v u Z k n i L e j F Y 0 T z g G Q J s 5 N J M m T 2 w c y s E J Z 8 g h c P i n j 1 i 7 z 5 N 8 4 m E V S 0 o K G o 6 q a 7 y 4 8 5 k 8 q y P o z c 2 v r G 5 l Z + u 7 C z u 7 d / U D w 8 a s s o

Figure 7 . 4 :

 74 Figure 7.4: Equivalent picture for dishonest Alice. In the original dishonest setup of Fig. 7.3, Alice aims to maximize the outcome (1, 0, 0). This is equivalent to Alice maximizing outcome 0 on spatial modes 1 and 3, independently of what is detected on mode 2. The outcomes indicated correspond to Alice winning. The reflectivity is b = 1 2(1-x) .

.65) 122 7 . 6 .

 76 PRACTICAL PROTOCOL PERFORMANCE Furthermore, note that, for η(A) f = η (B) f = η f , y should be an increasing function of η f , and therefore a decreasing function of d when η f = 0.95 d . Mathematically speaking, this is to prevent y (d) → ∞ and y(d) > 1. Physically speaking, this condition ensures that, as the probability of transmitting the photon (and of preserving it for verification) gets smaller, Bob should encourage a detection on the third mode, which evens out the honest probabilities of winning.

Figure 7 . 11 :

 711 Figure 7.11: Practical performance for a fair and balanced protocol. x and y are represented by blue and green crosses, respectively, which satisfy Eq. (7.73) as a function of distance d. The abort probability is indicated with red crosses. Over a few km, classical communication time is assumed to be equal to quantum communication time (i.e. ≈ d/c), since it is around two orders of magnitude larger than typical computer processing times (≈ ns) and commercial optical switching times (≈ 100ns). We therefore choose η f = 0.95 2d (i.e. the delay transmission associated with travelling distance d for quantum communication and another d for classical communication). Finally, we picked z = 0.75 and η d = 0.85.

d

  (iii) η (B) d > xη (A) f η (A) d . (7.73) 124 7.7. EXTENSION TO LOWER BIAS (PRELIMINARY RESULTS)

Figure 7 . 12 :

 712 Figure 7.12: Framework for the honest n-rounded protocol. Alice and Bob start with a separable state on A ⊗ M ⊗ B. Before sending the ith odd message, Alice applies a unitary U A,i and projection E A,i on A ⊗ M . Before sending the ith even message, Bob applies a unitary U B,i and projection E B,i on M ⊗ B. At the end, each party measures their private register to obtain the final outcome. This diagram and description were taken from [103].

Step 4 . 4 .

 44 photon on space M and the protocol follows to round (i + 1).

Fig. 7 . 13 . 2 +

 7132 Fig.7.13. The full quantum state evolution up to the beam splitter with amplitude y 2 is provided in Appendix C.4.Alice wins when system M is projected onto |0〉 in the second round, provided that it was also projected onto |0〉 in the first round. From Appendix C.4, her winning probability therefore reads:

Figure 7 . 13 :

 713 Figure 7.13: Linear-optical setup for the n-rounded protocol. Alice and Bob start with a separable state |100〉 on space A ⊗ M ⊗ B. At every odd round i, Alice mixes A and M on a beam splitter of amplitude x i and sends M to Bob. Bob mixes M with B on a beam splitter of amplitude y i , and measures M. If c i = 0, the protocol follows to round (i + 1). If c i = 1, Alice declares Bob the winner provided that he passes the verification test. At every even round i, the protocol behaves symmetrically by simply switching Alice and Bob's roles, as well as the winning outcomes. If c i = 1, Alice generates a new single photon and the protocol follows to round (i + 1). If c i = 0, Bob declares Alice the winner provided that she passes the verification test.

.76) 7 . 7 . 4

 774 Dishonest BobLet us consider a 2-rounded version of the protocol from Section 7.7.2. The setup for Dishonest Bob reduces to that in Fig.7.14. In the security proof, we dismiss Bob's private register living in B since he has complete control over it. We however introduce a new 2dimensional classical register, living in C , which allows to keep track of Bob's declaration of outcome c 1 . Note that all other register spaces are infinite-dimensional.Bob wins when he declares outcome c 1 = 1 and passes Alice's verification test after the first round, or when he declares c 1 = 0, Alice declares c 2 = 1 and he passes Alice's verification test after the second round. When Bob declares c 1 = 1, the state which passes Alice's verification test is |0〉 〈0| A ⊗1 M . When Bob declares c 1 = 0, the state must yield the

Figure 7 . 14 :

 714 Figure 7.14: Reduction of the 2-rounded protocol for Dishonest Bob. Alice mixes a single photon with vacuum on a beam splitter of amplitude x 1 , and sends register M to Bob. Dishonest Bob wins when he declares c 1 = 1 and passes Alice's verification test in the first round, or when he declares c 1 = 0, Alice declares c 2 = 1, and he passes Alice's verification test in the second round. After declaring the first outcome, he may send any infinite-dimensional state on M , as a subsystem of state σ.

-y 2 Z 11 -( 1 -y 2 ) y 2 ( 1 -y 2 ) (d) Z kk 0 for k 2 ( 7 . 82 ) 2 ( 1 -y 2 ) Z 00 -y 2 Z 11 1 -y 2 + y 2 ( 1 -y 2 ) Z 00 -y 2 ZD ( 1 -

 2111221227822122111221221 We now aim to minimize the dual objective function from(7.79):D = Tr (σ 0 Z) = (1 -x 1 )Z 00 + x 1 Z 11 ,(7.83)given the constraints from system (7.82). Since the k 2 diagonal elements of Z do not contribute to the expression of D, we dismiss condition (d). We now rewrite condition (c) as:(c) ⇔ Z 11 -(1 -y 2 ) y 11 (1 -y 2 )Z 00 Z 00 -y 2 , (7.84) 7.7. EXTENSION TO LOWER BIAS (PRELIMINARY RESULTS)and note that the second line of (7.84) implies condition (b), which we therefore also dismiss. We must now minimize D with the following constraints:x 1 )Z 00 + x 1 (1 -y 2 )Z 00 Z 00 -y 2 , (7.86)and rewrite the function on the right-hand side as:

(7. 95 )Tr M ρ 2 =

 952 Following the reduction from Fig.7.15, we can set up the primal problem which maximizes Alice's cheating probability. She may send any two states on register M, which, together with system B, form the optimization variables ρ 1 and ρ 2 . The objective function will maximize the overlap of ρ 2 after undergoing the H (v) transformation with the acceptance projector |01〉 〈01|. We may then write the following primal problem:max Tr H (v) MB ρ 2 H (v) MB |01〉 〈01| MB s.t. Tr M ρ 1 = |0〉 〈0| = ρ 0 Tr M Ω(ρ 1 )

Figure 7 . 15 :

 715 Figure 7.15: Reduction of the 2-rounded protocol for Dishonest Alice. Bob starts with the vacuum state on his private register, and Alice can send any state on M (as a subsystem of ρ 1 ) which will force Bob to declare outcome c 1 = 0. She then declares c 1 = 0, and can send any state on M (as a subsystem of ρ 2 ) to Bob for verification.

  pj)〉 〈p, (pj)| .(7.103)

2 ( 1 -

 21 x 2 ) m-l x l 2 |m〉 〈m| .(7.104)Since the operators on each side of Eq.(7.104) are diagonal, we can simply compare their elements one by one. This allows to derive the following set of conditions:(i) P h (A) = P h (B) fairness (ii) P d (A) = P d (B) balance(7.110)

A 1 ( 1 - 3 )

 113 Proof ofLemma 7.1 The action of U on the creation operators is given by: 2x)(1 -y) = y. Linear interferometers map product coherent states onto product coherent states, and, for all α ∈ C, we have thatU † |α00〉 = |β 1 β 2 β 3 〉, where y(1 -z) α (1 -y)(1 -z) QUANTUM WEAK COIN FLIPPING We have V = (1 ⊗ H (b) )(H (a) ⊗ 1)(1 ⊗ R(π) ⊗ 1), with a, b ∈ [0,[START_REF] Goldreich | How to play any mental game[END_REF], and R(π) a phase shift of π acting on mode 2. The action of V on the creation operators is given by Ṽ For all α ∈ C, V † |0α0〉 = |γ 1 γ 2 γ 3 〉, where and b = y + zyz, we have (β 1 , β 2 ,β 3 ) = (γ 1 , γ 2 , γ 3 ). Then, T r[(τ ⊗ |0〉 〈0|)U † (1 ⊗ |00〉 〈00|)U] = 1 π C d 2 αT r[(τ ⊗ |0〉 〈0|)U † |α00〉 〈α00|U] = 1 π C d 2 αT r[(τ ⊗ |0〉 〈0|)V † |0α0〉 〈0α0| V ] = T r[(τ ⊗ |0〉 〈0|)V † (|0〉 〈0| ⊗ 1 ⊗ |0〉 〈0|)V ], (C.5)where we used the completeness relation of coherent states 1 = 1 π C d 2 α |α〉 〈α|.

  2.1. MATHEMATICAL FRAMEWORKgeneral type of measurement is needed, just like in the transitioning from pure states to mixed states. This applies to cases where the measuring party does not care about the post-measurement state, and is more interested in the statistics of the outcome over several rounds of measurements. These generalized measurements are known as POVMs (Positive Operator-Valued Measurements). Unlike projectors, if E = {E m } is a POVM, then its elements need not satisfy E 2 m = E m , and the number of elements needs not be limited to the dimension of the Hilbert space. Conditions (ii) and (iii) of Eq. (7.73), however, are still satisfied.

  .[START_REF] Chailloux | Optimal quantum strong coin flipping[END_REF] In general, completely positive trace-preserving (CPTP) maps are crucial to describing any physical transformation applied to a quantum state. It is often possible to work with a density-matrix equivalent representation of CPTP maps, as will be required in Chapter 5 for instance. For this purpose, let us consider a tensor product of two d-dimensionalHilbert spaces H = H d 1 ⊗ H d 2 ,and define the (unnormalized) maximally entangled state |Φ + 〉 〈Φ + | on H as:

  r 13 E s e iω s t |1〉 〈3| + r 23 E c e iω c t |2〉 〈3| + cc.

	CHAPTER 2. PRELIMINARIES
	We now recall the general expression for the oscillations' Rabi frequency Ω d in terms of
	the dipole magnitude | D| and the driving electric field amplitude E d :
	Ω =	1	E d | D|.		(2.57)
	We substitute the two Rabi frequencies Ω s and Ω c in Eq. (2.56) and add this contribu-
	tion to the unperturbed Hamiltonian H a to get the following expression for the total
	Hamiltonian:
	H(t) = ω 1 |1〉 〈1| + ω 2 |2〉 〈2| + ω 3 |3〉 〈3| -	Ω s 2	e iφ s e iω s t |1〉 〈3| -	Ω c 2	e iφ c e iω c t |2〉 〈3| + cc. (2.58)
	where φ s and φ c are the phases of the dipoles driven by the signal and control fields,
	respectively. Finally, we attempt to remove all time-dependence by applying a unitary
	U(t) which transforms to the so-called co-rotating basis, which we label {| 1〉 , | 2〉 , | 3〉} .
						(2.56)

  Since |+〉 and |-〉 are eigenstates of the Pauli σ x operator, and σ z and σ x do not commute, then the uncertainty on the eigenvalue obtained upon measurement in either basis obeys the uncertainty principle. In this way, a party willing to conceal a bit may decide to randomly encode bit 0 in either the |0〉 or |+〉 state, and bit 1 in either the |1〉 or |-〉

	where ∆x i is the uncertainty (variance) of observable x i and C is a strictly positive
	constant, whose value depends on the specific uncertainty product considered. This law
	applies to position and momentum, or time and energy in quantum mechanics. It also
	applies to the outcomes of measurements performed in conjugate bases, and this provides
	the first principle of quantum security. Let us consider the pure quantum states |0〉 and
	|1〉, eigenstates of the Pauli σ z operator from Eq. (2.7), as well as the following coherent
	superpositions of |0〉 and |1〉:
	|+〉 = |-〉 =	1 2 2 1	(|0〉 + |1〉) , (|0〉 -|1〉) .	(3.2)
			)

  3.2. QUANTUM MONEYLet us consider a two-system Hilbert spaceH A ⊗H B spanned by {|0〉 A , |1 A 〉 , |0〉 B , |1〉 B }.The pure state |ψ〉 that we wish to copy lives in H A , while a qubit is initialized in the |0〉 B state on H B . Perfect cloning implies that there exists a unitary operator U which transforms this initial state to two identical copies of state |ψ〉:

Table 3 .1: Adversarial scenarios for quantum money with classical verifica- tion.

 3 Each scenario is expressed in terms of honest (H) and dishonest (D) parties. Cases denoted by D/H are indistinguishable to the bank.

  the secret key state shared by Alice and Bob, described by a mixture over N possible classical keys |k〉, is totally uncorrelated from Eve's quantum state, labeled ρ E , • σ ABE : Alice, Bob and Eve share a (partially) correlated state.

  the weak coherent state encoding. State discrimination is not possible for sets of linearly dependent states, since the uncertainty principle and no cloning theorem (Section 3.1.2) then come into play.Using USD, a dishonest client willing to copy the credit card can perform specific POVMs (Section 2.1.3) to unambiguously learn and identify a fraction of the states in the card. The remaining states are left unidentified, since they correspond to the don't know outcome of the USD POVM set. The dishonest client may however replace these with vacuum states in ordered to hide their failed discrimination attempts. If the losses are not monitored, this strategy can lead to unit cheating probability. The security condition for losses with respect to this specific attack is presented in Section 4.3.5. Furthermore, successfully identifying one state in a pair allows the successful cloning of the whole pair, since the adversary knows that the other state is prepared in the conjugate basis.

1: unambiguous state discrimination (USD) attacks. Such attacks are possible only for sets of linearly independent states

[START_REF] Jahma | Unambiguous state discrimination in quantum cryptography with weak coherent states[END_REF][START_REF] Chefles | Unambiguous discrimination between linearly independent states[END_REF][START_REF] Chefles | Optimum unambiguous discrimination between linearly independent symmetric states[END_REF]

, which is the case for the set of states used in our protocol when physically realized with

4 Experimental implementation 4.4.1 Proof-of-principle setup

	In order to test in practice the security conditions from Eqs. (4.3), (4.11) and (4.19) and
	identify suitable operation regimes, we have implemented an on-the-fly version of our
	quantum money protocol in which the qubit pairs of the credit card are sent directly to
	the vendor's payment terminal, without intermediate storage in a quantum memory. In
	our experiment we have not performed phase randomization (this can be implemented
	subsequently in the same manner as [76]), hence the security bound of Eq. (4.17) has
	.6.
	Thus, for the "weak coherent state" protocol, as long as it is possible to satisfy
	Eqs. (4.11) and (4.19) experimentally, then a quantum credit card scheme secure against

USD attacks, characterized by correctness and security parameters given in Eq. (4.12), can be implemented.

4.

not been explicitly considered. The verification test consists in measuring the correctness parameters c zz for the challenge question Q zz and c xx for Q xx on blocks of n qubit pairs, each of which is randomly chosen from the set of Eq. (4.1). This is done by measuring each block in the σ z ⊗ σ z basis or in the σ x ⊗ σ x basis, respectively. As noted earlier, the correctness parameter is calculated as c = (c zz + c xx )/2, and must exceed the thresholds from Eqs.

Table 4 .

 4 4.6. CONCLUSIONphoton number per pulse and the required number of pairs to reach a given security level, both implementations are similar.

		work from this thesis	work from [69]
	theoretical encoding	qubit state	hidden matching state
	experimental encoding polarization of weak	phase parity of pairs of
		coherent states	weak coherent states
	noise tolerance	20.0%	16.6%
	experimental error	≈ 4.5%	3.0%
	rate
	required µ	≈ 0.20	≈ 0.20
	required number of	1.2 × 10 5	8.3 × 10 4
	detections to reach
	security 10 -7
	required optical	polarization controller	Mach-Zender
	components	polarization beamsplitter	interferometers
		2 single photon detectors	phase and amplitude
			modulators
			3 × 1 beamsplitters
			2 single photon detectors
	notable advantage	simple state preparation	noise tolerance may be
		and measurement	increased arbitrarily close
			to 25% by using more
			matchings

1: Comparison of the implementations from this thesis and

[START_REF] Guan | Experimental preparation and verification of quantum money[END_REF]

. Theoretical and experimental aspects of the two independent proof-of-principle quantum money experiments are compared: type of encoding, noise tolerance, average photon number per pulse, required number of states to reach high security, setup simplicity and main advantages.

  )where α is the coherent state amplitude and |vac〉 denotes the vacuum state (see Section 2.3.1). Such a mapping is typically used for polarization or time-bin encoding, where the

|0〉 component is mapped onto the first mode and the |1〉 component is mapped onto the second

[START_REF] Lo | Security of quantum key distribution using weak coherent states with nonrandom phases[END_REF]

. When dealing with polarization, the honest terminal measures each of the n credit card states in the basis which answers either c 0 or c 1 by typically rotating a half or quarter waveplate. It then outputs (1 -f h )n measurement outcomes, where

Table 5 .

 5 In this case, a successful attack is materialized by the creation of two copies of the quantum credit card state, both being accepted by the bank when measured by two separate trusted terminals.

		Mint Client Terminal Bank	Parameter
	(i)	H	H	H	H	correctness c
	(ii)	H	D	H	H	error rate e
	(iii)	H	D/H	D	H	error rate e
	(iv)	D	D/H	D	H	N/A
	(v)	D	D/H	D/H	D	N/A

1: Adversarial scenarios for quantum money with classical verification. Each scenario is expressed in terms of honest (H) and dishonest (D) parties. Cases denoted by D/H are indistinguishable to the bank. The parameters of interest are also given, where c indicates the correctness and e indicates the error rate upon verification.

  .51) Let us write |ψ x 〉 = +∞ k,l≥0 ψ kl |kl〉. With the expression of the POVM in Eq. (7.44) the last equation rewrites:

  1 M ⊗ |1〉 〈1| C + HBob's optimal strategy involves optimizing over all states on M ⊗C , such that the overlap of the total state σ AMC with Π AMC is maximized. This may be recast as the following primal optimization problem:max Tr (σ AMC Π AMC ) s.t. Tr M ⊗C (σ AMC ) = x 1 |1〉 〈1| + (1 -x 1 ) |0〉 〈0| = σ 0The constraint enforces that the state on Alice's private register is the state dictated by the honest protocol. Following the method from Section 2.2.3, we may express the associated dual problem, optimizing over dual variable Z, as: min Tr (σ 0 Z)s.t. Z ⊗ 1 MC Π AMC Z = Z † . (7.79)We shall now derive an analytical upper bound on Bob's cheating probability by finding a feasible solution to problem(7.79). Rewriting the constraint with 1 C = |0〉 〈0| C + |1〉 〈1| C and applying the projectors 1 AM ⊗ |0〉 〈0| C and 1 AM ⊗ |1〉 〈1| C separately on both sides of the inequality provides us with two inequalities:AM ⊗ |0〉 〈0| C , (ii) Z ⊗ 1 M ⊗ |1〉 〈1| C |0〉 〈0| A ⊗ 1 M ⊗ |1〉 〈1| C . Z ⊗ 1 M |0〉 〈0| A ⊗ 1 M .

	(i)	Z ⊗ 1 M ⊗ |0〉 〈0| C	H	(y 2 ) AM |01〉 〈01| H	(y 2 )	(7.80)
	These conditions are true if and only if:
		(i) (ii) (7.81) Z ⊗ 1 M H (y 2 ) AM |01〉 〈01| H (y 2 ) AM ,
			(y 2 ) AM |01〉 〈01| H	(y 2 ) AM ⊗ |0〉 〈0| C .	(7.77)
							(7.78)
	σ AMC 0.

  Substituting this expression back into Eq. (7.87) finally gives:f Z 00 = x 1 (1 -y 2 ) + (1 -x 1 )y 2 + x 1 y 2 (1 -x 1 )(1 -y 2 ) + x 1 y 2 (1 -x 1 )(1 -y 2 ) = x 1 (1 -y 2 ) + (1 -x 1 )y 2 + 2 x 1 y 2 (1 -x 1 )(1 -y 2 ) = x 1 (1 -y 2 ) + y 2 (1 -x 1 ) -y 2 ) + y 2 (1 -x 1 )

			1 -y 2 ) (1 -x 1 )	.		(7.89)
							(7.90)
		2
		,
	from which we conclude:
	D	x 1 (1 2	.	(7.91)
	This bound is attained for:
	Z 00 = y 2 +	x 1 y 2 (1 -y 2 ) (1 -x 1 )	, Z 11 =	(1 -y 2 )Z 00 Z 00 -y 2	.	(7.92)

  7.3. Let H(t) represent a beam splitter transformation of amplitude t on M ⊗ B, Z B a Hermitian matrix living on B, and:E (t) (Z B ) = (|0〉 〈0| ⊗ 1) H (t) (1 M ⊗ Z B ) H (t) (|0〉 〈0| ⊗ 1) . (7.101)

Table 7 .1: Numerical solutions for system (7.111).

 7 1 + (1 -y 2 )x 1 -y 2 (1 -x 2 )(1 -y 1 )(1 -x 1 ) 2 (ii) 1 -2(1 -x 1 )x 2 (1 -y 1 ) = x 1 (1 -y 2 ) + y 2 (1 -x 1 )We solve this system numerically with Matlab software, by scanning all possible values of the tuple {x 1 , y 1 , x 2 , y 2 } contained in [0, 1] with an increment of 10 -3 . We enforce the equalities for (i) and (ii) such that:(i) |P h (A) -P h (B)| 10 -6 (ii) |P d (A) -P d (B)| 10 -6 . (7.112)Although a multitude of tuples {x 1 , y 1 , x 2 , y 2 } satisfy system (7.111) within desired accuracy, we are interested in the tuple which provides the lowest cheating probability P d (A) = P d (B), such that y 2 (1 -x 1 ). The numerical results for such a tuple are summarized in Table7.1: The numerical error on all parameters is of order 10 -4 , while we have enforced |P h (A) -P h (B)| 10 -6 and |P d (A) -P d (B)| 10 -6 .We conclude this chapter by noticing that our 2-rounded protocol extension might allow to lower the numerical bias to a value very close to 1/6:

	(7.111)
	2
	.

1.2. THESIS RESULTSThe results in this thesis have also been presented as contributed talks in international conferences such as QCrypt 2017, AQIS 2018, CEWQO 2018, EQTC 2019, and disseminated in newspapers and scientific magazines including Le Monde, Science et Vie and La Recherche.

3.2. QUANTUM MONEY

µ = 0.025 (dotted blue line). The parameter η has an opposite effect in the two terms in the expression of and we find that these two terms must be roughly balanced. Values for η have therefore been chosen accordingly, and we see that the optimal values strongly depend on µ : they must be increased as µ decreases. We also notice that, in general, states with large values of µ require a higher number of detected pairs than states with small values of µ in order to reach the same security level. However, as long as µ is not too big, the minimal number of pairs remains of the order of 10 5 , and this effect is counter-balanced by the fact that a higher value of µ increases the number of useful detected pulses and hence the number n of detected pairs. Thus, despite this trade-off, in order to optimize the performance of the setup, it is in general preferable to keep µ as high as possible in order to maximize the number of detected pairs. We may therefore conclude that our proof-of-principle experiment for the "weak coherent state" protocol

{ < l a t e x i t s h a 1 _ b a s e 6 4 = " 7 j F / a x i K Q 5 0 q c k 4 5 3 c B + a S 7 C D O 0 = " > A A A B 6 X i c b V B N S 8 N A E J 3 U r 1 q / q h 6 9 L B b B U 0 m q o M e i F 4 9 V 7 A e 0 o W y 2 m 3 b p Z h N 2 J 0 I J / Q d e P C j i 1 X / k z X / j t s 1 B W x 8 M P N 6 b Y W Z e k E h h 0 H W / n c L a + s b m V n G 7 t L O 7 t 3 9 Q P j x q m T j V j D d Z L G P d C a j h U i j e R I G S d x L N a R R I 3 g 7 G t z O / / c S 1 E b F 6 x E n C / Y g O l Q g F o 2 i l h 1 7 W L 1 f c q j s H W S V e T i q Q o 9 E v f / U G M U s j r p B J a k z X c x P 0 M 6 p R M M m n p V 5 q e E L Z m A 5 [START_REF] Wiesner | Conjugate coding[END_REF] bound is reached if Bob discards his half of the state and always broadcasts c = 1. Bob's optimal cheating probability is then simply given by:

(7.7)

Dishonest Alice with number-resolving detectors

Dishonest Alice wins when Bob declares the outcome c = 0 and the outcome of his quantum measurement is [START_REF] Goldreich | How to play any mental game[END_REF]0). The reduced protocol is shown in Fig. 7.3. When using number-resolving single-photon detectors, any projection onto the n > 1 photon subspace leads to Alice getting chaught cheating. Alice must therefore maximize the overlap with the projective measurement |100〉 〈100| only, as indicated in the honest protocol.

Let σ be the state sent by Alice. Let U = (H (2x) ⊗ 1)(1 ⊗ H (y) ), with y = 1 -1 2(1-x) . Alice needs to maximize the probability of the overall outcome (1, 0, 0), which is given by

since Bob uses number-resolving detectors. By convexity of the probabilities, we may assume without loss of generality that Alice sends a pure state σ = |ψ〉 〈ψ|, which allows us to write:

(7.9)

The upper bound in Eq.(7.36) is Alice's cheating probability in the lossless case. This

shows that Alice cannot take advantage of Bob's imperfect detectors nor lossy delay line in order to increase her cheating probability.

(y)

< l a t e x i t s h a 1 _ b a s e 6 4 = " In this picture, the losses of the detectors have been commuted back to Alice's state preparation.

We now give a sketch of the security proof for the following sections: since passive linear optical elements act linearly on creation operators, equal losses on different modes may be commuted through the interferometer of the protocol. This allows to upper bound Alice's maximum winning probability by her winning probability in an equivalent picture in which the losses happen just after her state preparation, then followed by a lossless protocol. In that case, the picture is equivalent to Dishonest Alice cheating in the lossless protocol (Fig. 7.3), while being restricted to lossy state preparation, instead of generic state preparation (Fig. 7.5).

The losses correspond to a probability (1-η) of losing a photon. These can be modelled as a mixing with the vacuum on a beam splitter of reflectivity η. We first recall a useful simple property, which will be extensively used in the following analysis. The result was proven in [START_REF] Berry | Linear-optical processing cannot increase photon efficiency[END_REF], but a quick proof is provided in Appendix C.3 for completeness: Lemma 7.2. Equal losses can be commuted through passive linear optical elements.

Dishonest Alice with lossy delay

We first show that Alice's maximum winning probability when Bob is using a delay line of transmission η f < 1 is always lower than when Bob's delay line is perfect, i.e. η f = 1, independently of the efficiency η d of his detectors. The lossy delay line of transmission η f may be modelled as a mixing with the vacuum on a beam splitter of reflectivity η f . Alice prepares a state σ, which goes through the interferometer depicted in Fig. 7.6, and wins if the measurement outcome obtained by Bob is (1, 0, 0).

In particular, note that the outcome 0 must be obtained for the third mode. Hence Alice's winning probability is always lower than if the third mode was mixed with the vacuum on a beam splitter of reflectivity η f just before the detection, since this increases the probability of the outcome 0 for this mode. Let us assume that this is the case. Then, by Lemma 7.2, the losses η f on output modes 2 and 3 may be commuted back through the beam splitter of reflectivity y, acting on modes 2 and 3. Since the input state on mode 3 is the vacuum, the losses on this mode may then be removed (Fig. 7.7).

(y)

< l a t e x i t s h a 1 _ b a s e 6 4 = "

A G e 4 N n g x q P x Y r w u W l e M 5 c w R / I D x 9 g k Q F I 2 p < / l a t e x i t > Alice's winning probability may then be written:

where U = (H (z) ⊗ 1)(1 ⊗ H (y) ) is the unitary corresponding to the general interferometer of the lossless protocol. By Lemma 7.1, we have for any density matrix τ, where

y+z-yz and b = y + zyz, and R(π) a phase shift of π acting on mode 2. Hence,

where we used U † |000〉 = |000〉 for the second term. Setting | ψx 〉 = (H (a) ⊗ 1)(1 ⊗ R(π)) | ψ〉 yields:

where we used |00〉 = (1 ⊗ R(π))H (a) |00〉 for the second term P 2 .

Let us consider the first term P 1 . Since | ψ〉 is the state obtained by applying losses η d on both modes of the state |ψ〉, we obtain the equivalent picture in Fig. 7.10, where we have added losses η d also on mode 3, since the input state is the vacuum.

With Lemma 7.2, commuting the losses η d to the output of the interferometer in Fig. 7.10, and combining the losses on mode 2 and 3 yields:

],

where Π η (0) is the POVM element corresponding to no click for a threshold detector of quantum efficiency η (recall that this is the same as an ideal detector preceded by a mixing with the vacuum on a beam splitter of reflectivity η). The same reasoning for the second term P 2 gives:

Alice first applies an entangling unitary U A,1 on A ⊗ M , followed by a projection E A,1 . She sends the quantum message register to Bob, in order for him to apply a unitary U B,2 and projection E B,2 on M ⊗ B. The two parties exchange messages likewise for n rounds, and measure their private registers A and B after the nth round to conclude on the flip outcome.

We recall that our protocol is the linear-optical equivalent of the protocol from [START_REF] Spekkens | A quantum protocol for cheat-sensitive weak coin flipping[END_REF].

The latter may in fact be interpreted as a 1-rounded version of the larger family of weak coin flipping protocols studied by Mochon in [START_REF] Mochon | Large family of quantum weak coin-flipping protocols[END_REF], which follows the structure from Fig. 7.12. By constructing a protocol in which the number of rounds tends to infinity, Mochon

showed that the bias converges to 1/6 [START_REF] Mochon | Large family of quantum weak coin-flipping protocols[END_REF].

In Section 7.7.2, we propose a construction for the n-rounded linear optical version of our protocol, in order to study whether the bias can be lowered in a similar manner.

We note that the structure and framework will differ from that in Fig. 7.12, since our n-rounded protocol may stop and designate a winner before the n rounds are over. We also emphasize that this section involves preliminary results only, and investigates the extension to lower bias. Although the question of convergence to 1/6 for our family

of protocols remains open, we show in Section 7.7.6 that the 2-rounded version of our proposed n-rounded protocol indeed achieves a bias 1/6 < < (1/ 2 -1/2) within numerical error. This, however, is reached by probably under-estimating Alice's cheating probability, as underlined in Section 7.7.5.

Protocol with n rounds

In Fig. 7.13, we describe the n-rounded version of our original protocol. We label the spaces in the same way as Fig. 7.12, but note that they are now infinite-dimensional, as we are dealing with Fock spaces. We label by A, M and B the systems living in spaces A , M and B, respectively. Throughout this section, we assume that n is even for simplicity.

1. Prior to the first round, Alice and Bob share a separable state |100〉 AMB .

For odd i n:

• Alice mixes A and M on a beam splitter of reflectivity x i .

• Alice keeps A and sends M to Bob.

• Bob mixes M with B on a beam splitter of reflectivity y i .

• Bob measures M with a photon-number-resolving detector, and broadcasts the outcome c i ∈ {0, 1}.

Looking back at the conditions from Eq. (7.99), and assuming that Z 2 is diagonal, we may set:

where n 0 ∈ N * . We may then saturate the bounds for all m conditions of Eq.( 7.105) to obtain the following recursive relation between Z mm 1 , the free parameter Z mm 2 , and the previous set of Z ll 2 with l < m:

This we may re-write as:

where F {Z ll 2 } l<m is a linear function of all previously fixed Z ll 2 . For a given m, we note that we can always tune Z mm 2 such that the condition is enforced, provided that Z mm 2 0 from Eq.( 7.105).

We may then finally choose n 0 → ∞ and, in this limit, upper-bound Alice's cheating probability by:

where we recall v = 2(1 -x 1 )x 2 (1 -y 1 ). We emphasize once again that this bound may be under-estimated, as we have derived it from a necessary condition only. Nevertheless, we choose to consider it for the following section as the start of an investigation to whether the bias can indeed be lowered to 1/6.

Numerical results

We now aim to solve a system of equations which enforces the fairness and balance of the 2-rounded version of the protocol from Section 7.7.2:

Quantum cryptography is a promising candidate for improving the security of today's communication networks, as it provides a quantitative advantage for many tasks and primitives. However, in order to succeed in implementing large-scale quantum networks, the gap between theory and experiment must be bridged on several levels. Technical skills must be shared across fields which appear very different at first sight, such as fundamental computer science and experimental physics. Furthermore, a common and simple dissemination language should be established to facilitate communication between fields. This is the aim and direction offered by the quantum protocol zoo [START_REF]Quantum protocol zoo[END_REF].

This thesis aimed to follow this direction by providing a smooth transition from abstract theoretical protocols to secure experimental implementations, regarding two pillars of quantum communication: quantum money, which offers a new informationtheoretically secure form of unforgeability, and quantum weak coin flipping, which is a crucial building block for many cryptographic tasks. Three experimental platforms and encodings have been considered, each of which opened new security loopholes and required different techniques to solve them. These are summarized in Although this is left for future work, we point out that the implementation will first remain proof-of-principle, as the detectors we use have a quantum efficiency which is still too low to implement a strictly secure version of the protocol from Chapter 5.

However, the demonstration of information-theoretic security in the presence of an imperfect storage device only is definitely within reach. In the near-future, acquiring superconducting nanowire single photon detectors with higher detection efficiency, as well as optimizing the storage/retrieval efficiency of the quantum memory, will hopefully give us the opportunity to implement an information-theoretically secure quantum money scheme with less assumptions. In the long-term, we hope that further technological breakthroughs could also potentially allow to implement the untrusted terminal scheme, which would be highly beneficial to quantum communication networks. Equating this to ( + δ) provides the value of δ for the "single-photon state" protocol:

For the "weak coherent state" protocol, taking into account the Poissonian nature of these states, we have that the extra probability (1 + η)P D of successful USD per pulse goes straight to the adversary. Equation (A.1) may then be rewritten as

A.2 Phase randomization

The adversary receives a coherent state with average photon number µ, whose global phase φ is picked uniformly at random from [0, 2π]. From their point of view, the state's density matrix can be expressed:

We know that we will be integrating between 0 and 2π, so the integral will be zero for all values of the integer (nm) apart from when n = m, for which the integral reduces to:

The adversary sees a Poisson-distributed classical mixture of Fock states.

A.3 Simulation of the evolution of c as a function of µ

The correctness parameter and its evolution with µ can be simulated with a simple theoretical model taking into account experimental parameters. This model was used to In both cases, the state correctness, post-selected on events with at least one click, can be expressed as: Regardless of the dimensionality of the incoming states, threshold detectors cannot distinguish between exactly 1 photon and more than 1 photon. As was pointed out in Chapter 4, some practical attacks may exploit this by sending coherent states with very high photon number. Assuming that the bank measures the incoming state in its correct preparation basis, this will lead to double clicks (i.e. a simultaneous click on both detectors) when the incoming state is incorrect, and to an accepted single click when the incoming state is correct. If the bank discards double clicks (as it cannot conclude on whether the correct detector clicked), this effectively allows the dishonest client to always succeed: the bank will always accept a state when it is correct, and simply ignore a state that is incorrect.

This means that, in all generality, the security analysis and the bank's measurement operators F M must be expressed in an infinite dimensional Fock-space, which is inconvenient. In [START_REF] Beaudry | Squashing models for optical measurements in quantum communication[END_REF] however, it was shown that, by enforcing a specific form of classical In our case, this post-processing involves assigning a random measurement outcome to any double-click. The squashed measurement (below) has the same general optical input ρ in , which is then squashed by a map Λ to a smaller Hilbert space, followed by a fixed physical measurement F Q . It is required that both of these measurements produce the same output statistics for all ρ in . This diagram and part of its description were taken from [START_REF] Beaudry | Squashing models for optical measurements in quantum communication[END_REF].

processing on the outcomes of the detectors, there exists a CPTP map, called a squashing map, which maps these full measurement operators onto some finite-dimensional mea-

where we have defined the scalar ψ 1,i j := 〈i|ψ 1 〉 〈ψ 1 | j〉.

B.3 Explicit expression for phase-randomized states

We may express the four states in our protocol as:

with global phase φ = 0 and relative phase θ ∈ {0, π 2 , 2π, 3π 2 }. This implies that an adversary must access θ to unveil the information encoded in the states. Phase randomization scrambles the global phase reference by allowing φ to take values from [0, 2π] uniformly at random instead of a single value. By considering the state |e iφ α〉 and integrating over all possible values of φ, the adversary sees a classical mixture of Fock states given by [START_REF] Lo | Phase randomization improves the security of quantum key distribution[END_REF]:

where µ = |α| 2 is the average photon number, and |n〉 are the photon number states. As the coherent superpositions of number states vanish, the security proof may simply proceed according to the result of quantum non demolition (QND) photon number measurements.

If there is no photon in the state, then there is no information. If there is 1 photon, then the qubit security proof may be applied. If there are more than 2 photons in the pulse, perfect cheating is possible, since one photon can be sent to a terminal 1 and another to terminal 2. For our protocol, this allows us to express the phase randomized states

|v〉 is the vacuum state, |q 0 〉 and |q 1 〉 span a qubit space, and |m i 〉 constitute the four orthogonal outcomes which materialize the four perfectly distinguishable states in the multiphoton subspace. Our four phase-randomized coherent states may then be written as the following density matrices :

where |+〉,|+i〉, |-〉, |-i〉 are the usual σ x and σ y eigenstates in the qubit space spanned by |q i 〉 and the Poisson distribution coefficients are given by

C.3 Proof of Lemma 7.2

One way to prove this statement is to use the fact that any interferometer may be decomposed as beam splitters and phase shifters [START_REF] Reck | Experimental realization of any discrete unitary operator[END_REF]. Then, losses trivially commute with phase shifters, and are easily shown to commute with beam splitters. Indeed, consider a beam splitter of reflectivity r acting on modes 1 and 2. Its action on the creation operators of the modes is given by â

while equal losses 1 -η on both modes act as:

Hence, the action of the beam splitter followed by losses is given by: â

while losses followed by the beam splitter act as:

which is equal to the previous evolution.

C.4 State evolution in the 2-rounded protocol

Here, we derive the quantum state evolution for the 2-rounded version of the protocol from Fig. 7.13.

|100〉 →

(x 1 ),AM

From the last line, which describes the unnormalized state right before Alice's measurement in the second round, we may easily calculate the two parties' winning probabilities.

Alice wins when system M is projected onto |0〉 in the second round, provided that it was also projected onto |0〉 in the first round (third line of Eq. (C.11)). Her winning probability therefore reads:

Bob wins when system M is projected onto |1〉 in the first round, which, according to Eq. (7.3) from the 1-rounded protocol, occurs with probability (1 -x 1 )y 1 . He also whens when M is projected onto |1〉 in the second round, provided that it was projected onto |0〉 in the first round (third line of Eq. (C.11)). His winning probability therefore reads: Let:

assuming a diagonal matrix Z B and a beam splitter of amplitude t. We start by expanding

(1 M ⊗ Z B ) in terms of Fock states, followed by creation operators: Recalling Section 2.3.2, we now apply the H (t) transformation to the creation and annihilation operators: Applying the (|0〉 〈0| ⊗ 1) projector on Eq.(C.16) then allows to dismiss all terms which raise the photon number on space M : We now perform the substitution m = k + l and notice some binomial coefficients: Keywords : quantum cryptography, quantum optics, quantum networks, quantum memory Abstract : Harnessing the laws of quantum theory can drastically boost the security of modern communication networks, from public key encryption to electronic voting and online banking. In this thesis, we bridge the gap between theory and experiment regarding two quantum-cryptographic tasks : quantum money and quantum weak coin flipping. Quantum money exploits the no-cloning property of quantum physics to generate unforgeable tokens, banknotes, and credit cards. We provide the first proof-of-principle implementation of this task, using photonic systems at telecom wavelengths. We then develop a practical security proof for quantum credit card schemes, in which the bank can remotely verify a card even in the presence of a malicious payment terminal. We finally propose a setup for secure quantum storage of the credit card, using electromagnetically-induced transparency in a cloud of cold cesium atoms. Quantum weak coin flipping is a fundamental cryptographic primitive, which helps construct more complex tasks such as bit commitment and multiparty computation. It allows two distant parties to flip a coin when they both desire opposite outcomes. Using quantum entanglement then prevents any party from biasing the outcome of the flip beyond a certain probability. We propose the first implementation for quantum weak coin flipping, which requires a single photon and linear optics only. We provide the complete security analysis in the presence of noise and losses, and show that the protocol is implementable on the scale of a small city with current technology. We finally propose a linear-optical extension of the protocol to lower the coin bias.

Universit é Paris-Saclay

Espace Technologique / Immeuble Discovery Route de l'Orme aux Merisiers RD 128 / 91190 Saint-Aubin, France