Prof Dongmin Keunwoo Lim

Wenqin Son

Shao

Sidharth Sahdev

Gentle Dash

Shabbir Ali

Shovik Ghorai

Niraj Kumar

Praveer Singh

Mainak Jas

Aakanksha Rana

Hiba Yousef

Gabrysia Mozharovskyi

Jan David

Jonathan Mercado

Tanuja Lucie

Pavel Sawant

Mozharovsky

Srijani Kaushik

Sougata Mallik

Sujit Mallick

Panigrahi

Abhishek Jiali

Abhilash Chandra

Sunny Gautam

Jyotiraaditya Singh

Dheer Desai

Kaushal Gianchandani

Chandra Hardik

The last four years in Paris, for my PhD, has been an eventful journey full of meaningful life experiences and adventurous surprises. I especially want to thank Telecom Paris, a great place to work, for providing me with a suitable work environment. I feel privileged and grateful to have the supportive and encouraging people around me at work and outside, who have guided me, inspired me, are fellow associates of my success, and encouraged me and pulled me up when I was down.

I want to express my sincere gratitude towards my thesis supervisor Prof. Romain Allèaume. He is an exceptional researcher and a very kind human being. I am thankful to him for his supportive guidance, patience, and persistence in pushing me to achieve perfection. Learning from his experience has been instrumental in making me a better scientist and person than I had imagined.

I am thankful to Prof. Isabelle Zaquine and Prof Filippo Miatto for their support and encouragement during my PhD. I am also grateful to my colleagues and friends at QIA, Raphaël Aymeric, Ravi Raghunathan, Francesco Mazzoncini, Yuan Yao, Guillaume Ricard, and Antoine Henry, for their support and countless technical, non-technical discussions in and outside the o ce. They all are very bright minds, and I wish them luck for their PhD.

I want to thank Prof. Marco Lucamarini, Prof. Damian Markham, Prof. Marc-Olivier Renou, and Prof. Alain Couvreur for kindly agreeing to be the jury members for my thesis.

I am grateful to the European Innovative Training Network QCALL (project 675662, funded by the Marie Sklodowska Curie Call H2020-MSCA-ITN-2015) for providing me with the funding to work on my PhD, allowing me to attend and present my work at di↵erent scientific schools, workshops and conferences. I am thankful to Prof. Mohsen Razavi, who has helped me to develop the timelimited quantum memory assumption, I visited at the University of Leeds for my secondment. I am grateful to all ESRs at QCALL for meaningful technical discussions and fun-filled times during various QCALL events.

Résumé en français Introduction

Quantum Key Distribution (QKD) permet un accord de clé sécurisé avec une sécurité théorique de l'information. Cela contraste avec les protocoles d'accord de clé classiques, où la sécurité est basée sur des conjectures de dureté de calcul. QKD peut o↵rir en principe un avantage de sécurité distinctif par rapport aux techniques classiques, en particulier dans les contextes où la sécurité à long terme est recherchée.

Évaluer l'utilité de QKD pour servir des cas d'utilisation réels en pratique reste une question complexe et controversée. Elle a conduit à un débat d'autant plus di cile à trancher que des périmètres d'évaluation di↵érents sont souvent envisagés [PPS04, ABB + 14, MCG, oqst]. La di culté de cette comparaison est également liée, dans une certaine mesure, à la diversité des objectifs poursuivis par les chercheurs et ingénieurs QKD. Ces objectifs sont principalement structurés autour de la dualité entre deux dimensions principales : la praticité (comment construire des systèmes QKD e caces et rentables) et la sécurité (comment garantir un gain de sécurité adéquat par rapport aux techniques classiques existantes).

Des e↵orts considérables ont été investis pour faire des progrès sur les deux dimensions [PAB + 20a]. Sur le plan pratique, des systèmes QKD présentant des performances accrues sont développés et déployés sur des réseaux optiques réels [PLL + 09, SFI + 11, DLQY16, ZXC + 18]. Côté sécurité, un corpus de travaux stable et robuste pose les bases de la sécurité théorique de QKD [Ren05, SBPC + 09, TL17]., tandis que la question de la sécurité de mise en oeuvre est abordée avec des e↵orts dédiés [ML, XMZ + 20] , ouvrant la voie à la certification des implémentations cryptographiques quantiques à court terme.

Malgré ces progrès remarquables, de nouvelles avancées décisives sont toutefois entravées. Cela est dû au problème récurrent que les aspects pratiques et de sécurité de QKD sont, dans une large mesure, abordés de manière disjointe, ce qui conduit à un dilemme. L'un des problèmes cruciaux de QKD est d'atteindre de longues distances à des taux raisonnablement élevés. D'une part, les compromis entre performances et coûts devraient guider l'ingénierie du système QKD. D'autre part, la recherche de la "sécurité ultime" contredit une telle approche. Ce constat a déjà été formulé il y a une dizaine d'années par Valerio Scarani et Christian Kurtsiefer dans leur " black paper on quantum cryptography" [START_REF] Scarani | The black paper of quantum cryptography: Real implementation problems[END_REF]. Ce dilemme, cependant, reste en suspens principalement aujourd'hui, entravant les progrès de QKD vers l'adoption et l'industrialisation à grande échelle.

Nous proposons une autre façon de résoudre le dilemme pratique de la cryptographie quantique. Notre approche consiste à concevoir un nouveau modèle de sécurité, le Quantum Computational Timelock (QCT) security model, qui tire parti de la sécurité informatique à court terme et du stockage quantique bruité pour améliorer les performances et la fonctionnalité de l'accord de clé basé sur le quantum. Fait intéressant, bien que notre modèle proposé soit plus faible que la sécurité inconditionnelle, il fournit néanmoins une sécurité éternelle, c'est-à-dire la sécurité de 1 CONTENTS l'établissement de la clé contre un adversaire sans limite de calcul, à condition qu'une communication cryptée éphémère initiale ne puisse pas être interrompue dans un court laps de temps. Comme la sécurité éternelle n'est pas réalisable à l'aide de constructions informatiques, notre approche hybride peut revendiquer un gain de sécurité strict par rapport aux techniques classiques, en plus d'étendre considérablement l'enveloppe de performance concernant la communication quantique sans répéteur, où des limites fondamentales limitent la capacité secrète.

En utilisant le modèle de sécurité QCT, nous proposons un protocole d'accord de clés que nous appelons MUB-Quantum Computational Timelock (MUB-QCT), où un bit est encodé sur l'état quantique de dimension d, en utilisant un ensemble complet de bases non biaisées (MUB) et un ensemble de permutations indépendantes par paires comme bases de codage. La sécurité du protocole est prouvée en calculant la borne sur l'information mutuelle de l'adversaire. Nous prouvons que la borne supérieure sur les échelles d'information d'Eve est O(1/d). Nous montrons les o↵res MUB-QCT : haute résilience aux erreurs (jusqu'à 50 % pour les gros d) avec des exigences matérielles fixes ; Sécurité indépendante de l'appareil de mesure (MDI ), car la sécurité est indépendante de la surveillance des canaux et ne nécessite pas de faire confiance aux appareils de mesure. Nous prouvons également la sécurité du protocole MUB-QCT, avec plusieurs photons par utilisation de canal, contre deux scénarios d'écoute clandestine restreints où Eve mesure chaque copie individuellement en utilisant une mesure optimale fixe ou mesure de manière proactive chaque copie dans un MUB di↵érent suivi d'une post-mesure classique décodage. Nous prouvons que le protocole MUB-QCT permet une distribution sécurisée des clés avec des états d'entrée contenant jusqu'à O(d) photons, ce qui implique une amélioration significative des performances, caractérisée par une multiplication O(d) du taux de clé. Nous a rmons que le protocole que nous considérons ici o↵re : une haute résilience aux erreurs, une garantie de sécurité qui ne nécessite pas de confiance dans la mise en oeuvre du dispositif de mesure, et une haute tolérance à la perte de canal subie sur de longues distances.

Notre travail est en particulier lié au Verrouillage des données quantiques [START_REF] Lupo | Quantum-locked key distribution at nearly the classical capacity rate[END_REF][START_REF] Lupo | Continuous-variable quantum enigma machines for long-distance key distribution[END_REF] où la sécurité contre un adversaire avec une mémoire quantique limitée dans le temps peut être prouvée en majorant les informations accessibles [START_REF] Lupo | Quantum data locking for high-rate private communication[END_REF]. Cependant, les travaux existants sur le verrouillage des données quantiques sont limités au codage à photon unique [START_REF] Lupo | Quantum-locked key distribution at nearly the classical capacity rate[END_REF] et ne peuvent pas étendre la distance ou recourir à des constructions basées sur des arguments de codage aléatoires [START_REF] Lupo | Continuous-variable quantum enigma machines for long-distance key distribution[END_REF] pour lesquels une mise en oeuvre pratique avec une mesure structurée n'est pas possible.

Modèle de sécurité Quantum Computational Timelock :

Comme proposé en 2015 [START_REF] Alléaume | A hybrid security model for quantum cryptography allowing to design practical schemes for long-distance key distribution with everlasting security[END_REF] un nouveau modèle de sécurité que nous avons plus tard inventé comme modèle de sécurité Quantum Computational Timelock (QCT). Il est représenté sur la figure 1 et se compose de deux hypothèses imbriquées :

1. Alice et Bob sont supposés avoir accès à une chaîne classique publique authentifiée et à un schéma de chi↵rement qui est informatiquement sécurisé vis-à-vis de tout attaquant non autorisé Eve pendant un temps au moins t comp après l'échange d'un texte chi↵ré sur le canal classique.

2. La mémoire quantique d-dimensionnelle d'Eve est t coh -décohérante avec t coh << t comp . Considérant la mémoire quantique comme un canal, elle peut être écrite comme une carte positive complète et dépendante du temps N t : ⇢ ! N t (⇢), tel que défini dans l'équation 5.2. Il est intéressant de noter que ces deux catégories d'hypothèses, à savoir la sécurité computationnelle à court terme [START_REF] Unruh | Revocable quantum timed-release encryption[END_REF] et le stockage quantique bruité [START_REF] Konig | Unconditional security from noisy quantum storage[END_REF], ont jusqu'à présent déjà été considérées en cryptographie quantique, mais seulement de manière disjointe. Dans le modèle de sécurité QCT, nous avons besoin d'une authentification initiale entre Alice et Bob, (voir la section 6.2 où le protocole d'établissement de clé basé sur le modèle de sécurité QCT est décrit). Cette authentification initiale peut être basée sur un canal authentifié (ce qui est alors une hypothèse). Une autre alternative nécessite la distribution d'un secret partagé (avec une authentification correcte) pour authentifier les communications sur un canal public. Dans ce dernier cas, l'hypothèse porte alors sur la possibilité de partager un secret initial, avec authentification.

Nous voulons définitivement que le schéma de cryptage soit sécurisé à court terme contre un ordinateur quantique. Cependant, nous n'avons pas précisé le type de schémas de chi↵rement qui peuvent être pris en compte dans les hypothèses du modèle QCT. Nous pouvons a ner cette hypothèse du modèle QCT en considérant que le chi↵rement sécurisé à court terme (qu'il soit basé sur un schéma symétrique ou asymétrique) est quantique sécurisé, c'est-à-dire sécurisé contre un ordinateur quantique. Malheureusement, il n'existe aucune construction connue pour les schémas de chi↵rement à clé publique qui soient sécurisés (même sécurisés à court terme) contre un ordinateur quantique. Alors que les schémas de cryptage à clé secrète et les algorithmes de hachage sont connus pour o↵rir une sécurité contre un ordinateur quantique avec une grande confiance.

Le modèle de sécurité QCT explore un espace d'hypothèses, à savoir un monde dans lequel les schémas de chi↵rement ne seraient pas sécurisés à long terme mais pourraient toujours être utilisés à court terme. Deuxièmement, les mémoires quantiques optiques sont technologiquement liées à la décohérence dans un délai plus court que lorsque le schéma de chi↵rement est sécurisé. L'objectif de ce modèle de sécurité est de construire des protocoles cryptographiques capables d'augmenter les performances de la cryptographie quantique au-delà des limites de performances fondamentales [START_REF] Pirandola | Fundamental limits of repeaterless quantum communications[END_REF][START_REF] Takeoka | Fundamental rate-loss tradeo↵ for optical quantum key distribution[END_REF], qui pourraient être trop restrictives pour une utilisation dans le monde réel CONTENTS [START_REF] Sasaki | Quantum networks: where should we be heading?[END_REF].

Validity: Une limite inférieure pratique sur la valeur de t comp peut être déduite de la sécurité à long terme supposée du schéma de chi↵rement AES256, qui est considéré comme répondant aux exigences de confidentialité à long terme (30 ans) des données Top Secret [START_REF] Hathaway | National policy on the use of the advanced encryption standard (aes) to protect national security systems and national security information[END_REF].

En ce qui concerne le temps de cohérence de la mémoire quantique adressable optiquement, comme examiné dans la section ci-dessus, des démonstrations expérimentales de stockage puis de récupération d'informations quantiques codées optiquement, au niveau du photon unique. Cela indique que la valeur de t coh varie de quelques nanosecondes à microsecondes [SAA + 10].

Étant donné le grand écart entre la borne supérieure sur t coh et la borne inférieure sur t comp , la validité du modèle de sécurité QCT peut être supposée avec une très grande confiance aujourd'hui. Cela laisse également une marge considérable pour sa validité dans le futur. Enfin, il convient de noter que le but ici est de construire un protocole de distribution de clés avec une sécurité éternelle, ce qui signifie en particulier que la validité du modèle de sécurité QCT ne doit être maintenue qu'au moment de l'exécution du protocole pour fournir une sécurité théorique de l'information dans l'avenir. Une comparaison de l'e cacité et du temps de cohérence de di↵érents systèmes de mémoire quantique optique est présentée dans le tableau [5.1]. Ainsi, en supposant, par exemple, t comp = 10 5 s ⇠ 1 day, laisse une marge de sécurité raisonnable par rapport à l'état de l'art des capacités de stockage quantique, comme indiqué dans la Table 1: Comparison of the prepare and measure HD-QKD with the MUB-QCT protocol.

Distribution de la clé MUB-QCT dans le modèle de sécurité QCT :

nous discutons du protocole d'établissement de clé en utilisant le modèle de sécurité QCT. Nous présentons d'abord un cadre générique pour construire un protocole d'établissement de clés à d-dimensions. Nous proposons ensuite un protocole d'accord de clé, que nous appelons MUB-Quantum Computational Timelock(MUB-QCT).

Paramètres : Le protocole de distribution de clé m-MUB-QCT-(b, c) est paramétré par les paramètres suivants • b : nombre de bits encodés sur un état quantique de dimension d.

• c : la capacité classique de l'encodage.

• m : nombre de copies de l'état du qudit envoyées par utilisation du canal.

Ingrédients : Un élément essentiel du protocole MUB-QCT consistera à randomiser l'un des états de base d'un espace de Hilbert à d-dimensions à l'aide d'un ensemble d'unités :

• Un ensemble complet de d + 1 bases mutuellement non biaisées (MUB), dans la dimension d.

• Un ensemble complet de permutations indépendantes par paires.

Di↵érents protocoles : En fonction du nombre de bits encodés sur un état quantique de dimension d et du nombre de copies de l'état qudit envoyées par canal utilisé, nous proposons di↵érentes versions du protocole MUB-QCT.

• Dans la section 6.3.1, nous proposons le protocole 1-MUB-QCT-(log d, log d), où pour une seule copie de l'état quantique envoyé par canal utiliser log d les bits sont encodé sur un qudit, en utilisant un ensemble complet de MUB.

• Dans la section 6.3.2 nous proposons le protocole 1-MUB-QCT-(1, log d), où pour une seule copie d'état quantique envoyée par canal, un bit est encodé sur un qudit, en utilisant un ensemble de MUBS et un ensemble complet de permutations indépendantes par paires.

• Dans la section 6.3.3, nous proposons le protocole MUB-QCT avec plusieurs copies par utilisation de canal, à savoir m-MUB-QCT-(log d, log d) et le protocole m-MUB-QCT-(1, log d).

Ingrédients : Le protocole se compose de deux phases ;

• Setting a computational timelock : Alice et Bob partagent une information secrète s 2 S (une information secrète classique correspondant à l'encodage unitaire) sur un canal de communication classique utilisant t comp -schéma de cryptage sécurisé. Pour le protocole 1-MUB-QCT-(log d, log d), s correspond à l'indice de la base mutuellement non biaisée, tandis que pour le 1-MUB-QCT-(1, log d ), il correspond à l'indice de la base mutuellement non biaisée et à la permutation utilisée pour coder le bit classique sur le qudit.

• Communication quantique : Alice encode un bit x 2 X sur un état quantique de d-dimensions en utilisant s comme

⇢ x = 1 |s| X s ⇢ xs (1)
Alice envoie l'état ⇢ x à Bob via un canal quantique non sécurisé, qui décode le bit en e↵ectuant une mesure projective sur ⇢ x , en utilisant s, et obtient y 2 Y.

Eve est supposée avoir un accès complet à l'entrée des canaux de communication d'Alice et Bob (similaire au verrouillage fort des données quantiques [START_REF] Lupo | Quantum data locking for secure communication against an eavesdropper with time-limited storage[END_REF]). Cependant, Eve ne peut pas casser le chi↵rement timelock avant t comp . De plus, elle ne peut pas stocker l'état ⇢ x plus longtemps que t coh . Eve ne peut utiliser qu'une seule des stratégies suivantes :

⌘

. Pour le protocole 1-MUB-QCT-(1, log d), nous montrons qu'Eve n'a pas de choix préférable pour la mesure immédiate car l'ensemble complet des MUB forme un 2-design [GKR]. En conséquence, nous pouvons prouver que cette deuxième stratégie réduit, pour Eve, à accéder à la sortie d'un fort QC-extractor [START_REF] Berta | Quantum to classical randomness extractors[END_REF] basé sur un ensemble complet de MUBs, et donc que sa probabilité de deviner est Très particulièrement, les informations liées à Eve peuvent être obtenues sous le modèle de sécurité QCT, en ne considérant que l'état d'entrée et non les résultats de la mesure de Bob.

Analyse de sécurité :

À la fin du protocole MUB-QCT, Alice et Bob détiennent des variables aléatoires classiques X et Y , tandis qu'Eve détient une variable aléatoire classique Z et une mémoire quantique décohérée. La formule Csiszár et Körner [CK78a] R I(X; Y ) I(X; Z) peut donc être appliquée pour dériver la clé sécurisée taux. Prouver la sécurité du protocole MUB-QCT nécessite donc de borner les informations mutuelles d'Eve I(X; Z). Étant donné que II est la meilleure stratégie, nous pouvons utiliser la propriété d'extraction forte de [START_REF] Berta | Quantum to classical randomness extractors[END_REF] pour prouver que I(X; Z) ⇠ O(1/d). Très particulièrement, les informations liées à Eve peuvent être obtenues dans le cadre du modèle de sécurité QCT, en ne considérant que l'état d'entrée et non les résultats de la mesure de Bob.

Analyse des performances :

• Tolérance au bruit : Le codage à haute dimension dans le protocole MUB-QCT permet une grande résilience au bruit en o↵rant un taux d'erreur maximal tolérable allant jusqu'à 50 % pour les gros d.

• Resources requises : Le protocole MUB-QCT peut être implémenté avec seulement deux détecteurs, indépendamment de d . Cela assouplit les besoins en ressources par rapport aux schémas HD-QKD [LPD + 13, LBZ + 16a], nécessitant d-détecteurs à photon unique.

• Sécurité MDI : Dans le protocole MUB-QCT, les informations d'Eve ne peuvent être limitées qu'en considérant l'état saisi par Alice. Par conséquent, la mise en oeuvre du dispositif de mesure de Bob n'a pas besoin d'être fiable pour garantir la sécurité.

MUB-QCT avec plusieurs copies d'états quantiques :

Les protocoles précédents traitaient d'une copie de ⇢ x encodée sur un seul photon. Nous explorons également si le protocole MUB-QCT o↵re une tolérance élevée à la perte de canal subie sur de longues distances en transmettant plusieurs photons par utilisation de canal. Alice prépare m copies de l'état qudit, ⇢ x , en utilisant la même base ✓. Nous prouvons la sécurité sous deux stratégies d'attaque restreintes pour Eve ;

1. Attaque individuelle : où Eve est limitée à e↵ectuer la même mesure fixe individuelle sur chacune des m copies. • Tolérance au bruit : Le codage à haute dimension dans le protocole MUB-QCT permet une grande résilience au bruit en o↵rant un taux d'erreur maximal tolérable allant jusqu'à 50 % pour les gros d.

• Resources requises : Le protocole MUB-QCT peut être implémenté avec seulement deux détecteurs, indépendamment de d . Cela assouplit les besoins en ressources par rapport aux schémas HD-QKD [LPD + 13, LBZ + 16a], nécessitant d-détecteurs à photon unique.

CONTENTS

• Sécurité MDI : Dans le protocole MUB-QCT, les informations d'Eve ne peuvent être limitées qu'en considérant l'état saisi par Alice. Par conséquent, la mise en oeuvre du dispositif de mesure de Bob n'a pas besoin d'être fiable pour garantir la sécurité.

La stratégie de mesure proactive du MUB apparaît plus e cace que la mesure fixe à copie unique. Since MUB-QCT can be implemented with 2 detection modes (2-single photon detectors) we also plot 2-modes PLOB bound [START_REF] Pirandola | Fundamental limits of repeaterless quantum communications[END_REF] as a benchmark..

Conclusion :

Nous avons proposé un nouveau modèle de sécurité Quantum Computational Timelock (QCT), où nous supposons qu'un schéma de chi↵rement est informatiquement sécurisé pendant une durée supérieure au temps de décohérence des mémoires quantiques. Nous construisons le protocole de distribution de clés MUB-QCT en utilisant un ensemble complet de bases mutuellement non biaisées (MUB) et prouvons la sécurité en limitant les informations d'Eve sous la forme I(X; Z) ⇠ O(1/d) , pour la stratégie d'attaque d'écoute optimale, qui réduit l'accès à la sortie d'un extracteur QC puissant. De plus, lorsqu'Alice envoie plusieurs copies par canal, les informations d'Eve sous des mesures MUB proactives restrictives sont délimitées par I Pro (X; Z) ⇠ O(m/d) . En conséquence, o↵rant une haute résilience aux erreurs (jusqu'à 50 % pour les gros d) avec des exigences matérielles fixes, une sécurité indépendante de l'appareil de mesure (MDI) qui assouplit certaines contraintes d'ingénierie importantes concernant textitdistribution quantique des clés (QKD), et O(d) multiplication des taux clés. Notre travail est en particulier lié au verrouillage quantique des données [START_REF] Lupo | Quantum-locked key distribution at nearly the classical capacity rate[END_REF][START_REF] Lupo | Continuous-variable quantum enigma machines for long-distance key distribution[END_REF] où la sécurité contre un adversaire avec une mémoire quantique limitée dans le temps peut être prouvée en majorant l'information accessible [START_REF] Lupo | Quantum data locking for secure communication against an eavesdropper with time-limited storage[END_REF]. Cependant, les travaux existants sur le verrouillage des données quantiques sont limités au codage à photon unique [START_REF] Lupo | Quantum-locked key distribution at nearly the classical capacity rate[END_REF] et ne peuvent pas étendre la distance ou recourir à des constructions basées sur des arguments de codage aléatoires [START_REF] Lupo | Continuous-variable quantum enigma machines for long-distance key distribution[END_REF] pour lesquels une mise en oeuvre pratique avec une mesure structurée n'est pas possible. Nos résultats illustrent que les approches hybrides de la cryptographie quantique constituent une voie prometteuse et pratique pour étendre les performances et les fonctionnalités de la cryptographie quantique. En particulier, notre nouveau protocole MUB-QCT permet l'établissement d'une clé de sécurité permanente -non réalisable avec des moyens classiques -avec des performances nettement supérieures à celles de QKD.

Introduction Cryptography

The Internet is the global system of interconnected computer networks consisting of private, public, academic, business, and government local to global scope, linked by a broad array of electronic, wireless, and optical networking technologies. Since the rise of the Internet, people worldwide have found themselves able to communicate with anyone at any time. Any message is transformed into a binary string and sent through di↵erent means of telecommunication (satellite, fibre, etc.) over the internet network.

The World Wide Web ("WWW" or "The Web") is a global information medium that users can access via computers connected to the Internet. Have you ever wondered what is http:// or https:// in front of the "WWW" of any website address? Well, HTTP is the abbreviation for hypertext transfer protocol. This is the primary method by which the data of web pages are transferred over a network. Web pages are stored on servers, then served to the client computer as the user accesses them. The resulting network of these connections creates the world wide web as we know it today. Without HTTP, the world wide web (WWW) as we know it would not exist. However, this powerful technology comes at a price. Whoever would tamper with the communication link would find himself able to read whatever message is passing through it, and if confidential or sensitive information is needed to be transferred, this will imply an impossibility to use such a link. For this reason, each message sent in the network must be encoded so that only the transmitter and receiver of the information will be able to read it.

HTTPS is the abbreviation for hypertext transfer protocol secure or secure hypertext transfer protocol. Unlike HTTP, HTTPS uses a secure certificate to secure a connection and verify that the site is legitimate. For example, when one wants to secure the transmission of credit card data or other sensitive information (such as someone's actual address and physical identity) or when you run a lead generation website that relies on someone's accurate information, in which case you want to use HTTPS to safeguard against malicious attacks on the user's data.

How to secure a message by encrypting it is the topic of interest of Cryptography. The art of hiding a message has been around for millennia. Nowadays, the most common encoding schemes are the so-called public-key schemes, where a service provider broadcasts a public key, and anyone with it could encode a message. However, the only one able to read it is the possessor of the private key. Meaning that the communication can be left secure if the private key is kept secret. These protocols, however, rely on the assumption that the computational power of a possible eavesdropper is limited. In fact, in principle, from the public key, it would be possible to retrieve the private one; the task is, however, computationally challenging, and it is usually set such as no current technology could crack it in a reasonable time. This means that the security of public-key encryption schemes does not rely only on the privacy of the private key but also on the limitation of the technology of a possible adversary.

One Time Pad o↵ers one solution to this problem as it requires only the privacy of a private key in order to be perfectly secure. It works as follows: two honest parties have a secret key k (a binary string of dimension n). One of the two can then encode a message m (of dimension n) just by applying an XOR operation between the two strings and sending the resulting cyphertext c = k + m (modulo 2) through the channel. If k is private, it will be known only by the two honest users and look entirely random for any other communication listener. This fact is also translated for c, meaning that the cyphertext look like a random string to anyone oblivious to the original key. This protocol seems to solve all the problems of the previous public-key encryption scheme. However, there are significant constraints that must be respected for it to work.

•

The key is at least as long as the message or data that must be encrypted.

• The key is truly random (not generated by a simple computer function or such)

• The key is used only once, and both sender and receiver must destroy their key after use.

(from this, the name One Time Pad).

• There should only be two copies of the key: one for the sender and one for the receiver, i.e., the key must own by the two honest parties.

Since each key can be used only once, each communication round must generate a new key. Randomness moreover must be ensured so that no one could foresee which key is produced. However, classical physics is deterministic, meaning that knowing the initial conditions of a system would result in knowing the results of the whole process, which means that we need another theory to guarantee the randomness of the generated key.

On the other hand, the key in the one-time pad should have the same length as the message and be private once generated. This means that the two honest parties must exchange the key beforehand and keep it secret. Nevertheless, how can they share it if they are far from each other? Should they meet and exchange it before? If this were the case, they would as well exchange the message itself! Unfortunately, classical information theory does not help in this regard. We need a new physics in order to do it as in the previous case.

What happens when quantum physics meets cryptography?

The word "quantum" comes from the Latin for "how much" and refers to counter-intuitive properties of subatomic particles discovered beginning in the late 1800's and early 1900's CE. The field arose from the study of electromagnetism, where physicists found that electromagnetic waves such as light beams can be described both as waves and as streams of discrete particles, or "quanta". It turns out that the universe behaves in apparently contradictory ways when studied at the sub-atomic level. The physicist Richard Feynman stated that it is impossible to understand quantum mechanics due to the paradoxical ways the universe behaves at the subatomic level.

While it is challenging to understand quantum mechanics in the "commonsense" way we can understand classical, everyday physics, given the paradoxical results found at the subatomic level, it is still worthwhile to study. However, both for better understanding of the universe and promising applications the field o↵ers for technology. Let us look at a few examples of basic principles of quantum mechanics to get a taste of the paradoxical ways the universe behaves at the quantum level.

1. Superposition: Quantum superposition is a fundamental principle of quantum mechanics.

In classical physics, a wave describing a musical tone can be seen as several waves with di↵erent frequencies added together, superposed. Similarly, a quantum state in superposition can be seen as a linear combination of other distinct quantum states. This quantum state in superposition forms a new valid quantum state. The superposition principle is that a system is in all possible states simultaneously until it is measured. After measurement, it falls to one of the basis states that form the superposition, thus destroying the original configuration. The superposition principle explains the "quantum weirdness" observed with many experiments.

Uncertainty principle:

The uncertainty principle also called the Heisenberg Uncertainty Principle, or Indeterminacy Principle was articulated (1927) by the German physicist Werner Heisenberg. This principle states that a conjugate pair of variables or properties, both values, cannot be precisely defined simultaneously for quantum objects. The most well-known pair is position and momentum (momentum being the mass times the particle's speed). Quantum particles, therefore, cannot have a precisely specified speed and exactly specified position at the same time. Consequently, another feature of quantum mechanics is that a measurement technique interferes with the system, thus changing its state.

No-cloning theorem:

In quantum physics, the no-cloning theorem states that it is impossible to perfectly clone an unknown quantum state (the information content of the state) using unitary evolution. Even if one allows non-unitary cloning devices, the cloning of non-orthogonal pure states remains impossible unless one is willing to tolerate a finite loss of fidelity in the copied states. It is pretty standard that we could make precisely the duplicate copy of something in the classical world. However, in the quantum world, the laws of physics impose a severe restriction on copying: It is impossible to make a perfect copy of an unknown state.

4. Randomness: Quantum mechanics has randomness as a fundamental element of the theory. This is in contrast with classical mechanics models, where, the randomness is seen as the lack of knowledge. The evolution of a quantum mechanical state is not deterministic, and starting from the same conditions, one may end up with di↵erent results. Note that this is not due to the imprecision of the measurement device but rather an intrinsic property of quantum mechanics.

Quantum entanglement:

The most striking and counter-intuitive feature of quantum mechanics is entanglement. This feature has no analogue in classical mechanics. Entanglement refers to the correlations among two or more quantum states, stronger than any possible classical correlations. Experiments and theoretical developments have shown that two subatomic particles can become "entangled" in such a way that, when a given property of one of the particles is observed, the opposite state will then be observed in the second particle regardless of the distance between the two. Quantum entanglement is a natural phenomenon that occurs when two particles originate at the same point in space and time, for example.

We have taken an overview of the preliminary results of quantum mechanics, the branch of physics that studies the universe's properties at the subatomic level. We now see how to use this to develop a cryptographic scheme that is secure against eavesdropping.

Quantum cryptography is one of the emerging topics in the field of the computer industry. It is a science that applies principles of quantum mechanics to data encryption and data transmission so that data cannot be accessed by hackers -even by those malicious actors that have quantum CONTENTS computing of their own. Rather than depending on the complexity of factoring large numbers, quantum cryptography is based on quantum mechanics' fundamental and unchanging principles. Quantum cryptography rests on two pillars of 20th-century quantum mechanics -the Heisenberg Uncertainty principle and the no-cloning theorem. These principles allow two (or more) distant users to exchange a secret message by encoding it in the states of quantum systems and transmitting the systems between each other. Any tampering with the quantum transmission by an eavesdropper would necessarily change the state of the systems and thus be detected. This establishes one of the main di↵erences between classical and quantum cryptography: in the latter, it is physically impossible to build a quantum cloning machine, that is, a machine able to clone the state of a quantum system in two perfect copies.

The broader application of quantum cryptography also includes creating and executing various cryptographic tasks using quantum computers' unique capabilities and power. Theoretically, quantum computers can aid the development of new, more robust, more e cient encryption systems that are impossible using existing, traditional computing and communication architectures.

Quantum key distribution

Quantum cryptography, or more specifically, quantum key distribution (QKD), promises in principle unconditional security -the Holy Grail of communication security based on the laws of physics only. Unconditional security means security against an Eve who is not limited by computational assumptions but only by physics laws. QKD is a unique solution to long-term security since, in principle, it o↵ers security for eternity. Unlike conventional cryptography, which allows Eve to store a classical transcript of communications, in QKD, there is no classical transcript for Eve to store once a quantum transmission is done.

Suppose Alice would like to send a secret message to Bob through an open communication channel to a receiver. Encryption is needed. If they share a standard string of secret bits, called a key, Alice can use her key to transform a plaintext into a cyphertext, which is unintelligible to Eve. In contrast, Bob, with his key, can decrypt the cyphertext and recover the plain text. In cryptography, the security of a crypto-system should rely solely on the secrecy of the key. The question is: how to distribute a key securely? In conventional cryptography, this is often done by trusted couriers. Unfortunately, in classical physics, couriers may be bribed or compromised without the users noticing it. This motivates the development of quantum key distribution (QKD).

A generic "prepare and measure" QKD protocol can be divided into two main steps: quantum communication followed by classical post-processing. The sender (Alice) encodes random classical variable ↵ into non-orthogonal quantum states during quantum communication. These states are sent over a quantum channel (optical fibre, free-space link) controlled by the eavesdropper (Eve), who tries to steal the encoded information linearity of quantum mechanics forbids to perform perfect cloning that Eve can only get partial information while disturbing the quantum signal. At the output of the communication channel, the receiver (Bob) measures the incoming signals and obtains a random classical variable . After several uses of the channel, Alice and Bob share raw data described by two correlated variables ↵ and .

The remote parties use part of the raw data to estimate the channel's parameters, such as its transmissivity and noise. This parameter estimation stage is essential to evaluate the amount of postprocessing to extract a private shared key from the remaining data. Depending on this information, they perform a stage of error correction, which allows them to detect and eliminate errors, followed by a stage of privacy amplification that reduces Eve's stolen information to a negligible amount.

The final result is the secret key.

Depending on which variable is guessed, we have direct or reverse reconciliation. In direct reconciliation, it is Bob that post-process its outcomes in order to infer Alice's encoding. This procedure is usually assisted by employing forward CC from Alice to Bob. By contrast, in reverse reconciliation, Alice post-processes her encoding variable to infer Bob's outcomes. This procedure is usually assisted by a final round of backward CC from Bob to Alice. Of course, one may more generally consider two-way procedures where the extraction of the key is helped by for and feedback CCs, which may be even interleaved with the various communication rounds of the protocol.

Let us remark that there may also be an additional post-processing routine, called sifting, where the remote parties communicate to agree on instances while discarding others, depending on the measurement bases they have independently chosen. In DV protocols, random switching is between the Z -basis and X -basis, and in CV protocols, the homodyne detection switching between the q and the p quadrature.

Sometimes QKD protocols are formulated entanglement-based representation. This means: that Alice' preparation of the input ensemble of states is replaced by an entangled state AB part of which is measured by Alice. The measurement on part A a↵ects to prepare a state on part B conditionally. The outcome of the measurement one-to-one with the classical variable encoded in the prepared states. This representation is beneficial for the study of QKD protocols so that their prepare and measure formulation is replaced by an entanglement-based formulation for assessing the security and deriving the secret key rate.

Practical challenges in quantum key distribution

Quantum Key Distribution (QKD) enables secure key agreement with information-theoretic security. This is in contrast with classical key agreement protocols, where security is based on computational hardness conjectures. QKD can o↵er in principle a distinctive security advantage over classical techniques, in particular in contexts where long-term security is sought.

Assessing the usefulness of QKD to serve real-world use cases in practice remains a complex and disputed question. It has led to a debate that is all the more di cult to settle that di↵erent assessment perimeter are often considered [PPS04, ABB + 14, MCG, oqst]. The di culty of this comparison is also related, to some extent, to the diversity of the goals pursued by QKD researchers and engineers. These goals are mainly structured around the duality between two main dimensions: practicality (how to build e cient and cost-e↵ective QKD systems) and security (how to guarantee an adequate security gain with respect to existing classical techniques).

Significant e↵orts have been invested in making progress on both dimensions [PAB + 20a]. On the practical side, QKD systems that exhibit increased performances are being developed and deployed over real-world optical networks [PLL + 09, SFI + 11, DLQY16, ZXC + 18]. On the security side, a stable and robust body of work lays the foundations of the theoretical security of QKD [Ren05, SBPC + 09, TL17]., while the question of implementation security is tackled with dedicated e↵orts [ML, XMZ + 20], paving the way towards the certification of quantum cryptographic implementations in the near-term.

Despite this remarkable progress, further decisive advancements are, however, hindered. This is due to the recurring issue that practicality and security aspects of QKD are, to a large extent, tackled disjointly, leading to a dilemma. One of the crucial problems in QKD is to achieve long distances at reasonably high rates. On the one hand, trade-o↵s between performance and cost are expected to drive QKD system engineering. On the other hand, the quest for 'ultimate security" CONTENTS contradicts such an approach. This observation has already been voiced a decade ago by Valerio Scarani and Christian Kurtsiefer in their "black paper on quantum cryptography" [START_REF] Scarani | The black paper of quantum cryptography: Real implementation problems[END_REF]. This dilemma, however, remains unsettled mainly today, hampering QKD progress towards large-scale adoption and industrialization.

Our contribution: Results presented in this Thesis

We propose an alternative way to address the practical quantum cryptography dilemma. Our approach consists in devising a new security model, the Quantum Computational Timelock (QCT) security model, that leverages short-term computational security and noisy quantum storage to boost the performance and functionality of quantum-based key agreement. Interestingly, although our proposed model is weaker than the unconditional security, yet it provides everlasting security, i.e., security of key establishment against a computationally unbounded adversary, provided an initial ephemeral encrypted communication cannot be broken within a short time. As everlasting security is not achievable using computational constructions, our hybrid approach can claim a strict security gain compared to classical techniques, in addition to significantly extending the performance envelope concerning repeaterless quantum communication, where fundamental bounds limit secret capacity.

Using the QCT security model, we propose a key agreement protocol that we call MUB-Quantum Computational Timelock (MUB-QCT), where a bit is encoded on the d dimensional quantum state, using a complete set of mutually unbiased bases (MUBs) and a set of pair-wise independent permutations as encoding bases. The security of the protocol is proved by calculating the bound on the adversary's mutual information. We prove that upper bound on Eve's information scales as O(1/d). We show MUB-QCT o↵ers: high resilience to error (up to 50% for large d) with fixed hardware requirements; Measurement Device Independent (MDI ) security, as security is independent of channel monitoring and does not require to trust measurement devices. We also prove the security of the MUB-QCT protocol, with multiple photons per channel use, against two restricted eavesdropping scenarios where Eve measures each copy individually using a fixed optimal measurement or proactively measures each copy in a di↵erent MUB followed by post-measurement classical decoding. We prove that the MUB-QCT protocol allows secure key distribution with input states containing up to O(d) photons which imply a significant performance boost, characterized by a O(d) multiplication of key rate. We claim that the protocol we consider here o↵ers: high resilience to error, a security guarantee that does not require trust in the measurement device's implementation, and high tolerance to the channel loss incurred at long distances.

Our work is in particular related to Quantum data locking [START_REF] Lupo | Quantum-locked key distribution at nearly the classical capacity rate[END_REF][START_REF] Lupo | Continuous-variable quantum enigma machines for long-distance key distribution[END_REF] where the security against an adversary with time-limited quantum memory can be proved by upper bounding the accessible information [START_REF] Lupo | Quantum data locking for high-rate private communication[END_REF]. However, existing work on quantum data locking is restricted to single-photon encoding [START_REF] Lupo | Quantum-locked key distribution at nearly the classical capacity rate[END_REF] and cannot extend the distance or resort to constructions based on random coding arguments [START_REF] Lupo | Continuous-variable quantum enigma machines for long-distance key distribution[END_REF] for which practical implementation with structured measurement is not possible.

Outline of the thesis

The thesis is divided into two parts. The first part "from quantum information to quantum cryptography" introduces the preliminary concepts such as classical and quantum information theory, classical and quantum cryptography, di↵erent quantum key distribution protocols and some other important concepts that are necessary to understand the quantum cryptography in the quantum computational timelock security model.

The second part of the thesis is "quantum computational hybrid cryptography", which presents the important result of this thesis. We describe our hybrid security model quantum-computational time-lock, construct the key distribution protocol under this security model and present a detailed analysis of the results.

Part I: From Quantum information to quantum cryptography Chapter 1: Quantum information and communication

In this chapter, we briefly describe the main tools of "Quantum Mechanics" and "Quantum Information Theory" that we will use for the study of Quantum Key Distribution. We begin with a brief introduction to Quantum mechanics, followed by basic tools and aspects of classical information theory, and finally, we introduce topics in quantum information theory.

Chapter 2: Cryptography

The objective of this chapter is to highlight the salient features of security definitions in classical cryptography schemes and provide a reasonable basis for comparison with information-theoretic schemes Chapter 3: Quantum cryptography The present chapter aims to provide an overview of the most important and most recent advances in quantum cryptography, both theoretically and experimentally. After a brief introduction of the general notions, we will review the main QKD protocols based on discrete-and continuous-variable systems. We will consider standard QKD, device-independent, and measurement-device independent QKD. We will then discuss the ultimate limits of point-to-point private communications and how quantum repeaters and networks may overcome these restrictions. Finally, we will treat topics beyond QKD, including Twin-Field QKD, Flood Light QKD, and Quantum Data Locking.

Chapter 4: QKD against bounded adversary

In this chapter we review the Bounded Quantum Storage Model (BQSM), where Eve is assumed to be able to store only a limited number of qubits. Second, we consider the e↵ect of Quantum Data Locking (QDL) and its application to QKD and secure communication under the assumption that Eve can store unlimited qubits in quantum memory, however, only for a finite time.

Part II: Quantum Computational Hybrid Cryptography Chapter 5: Quantum Computational Time-lock security model

We introduce a novel Quantum Computational Timelock (QCT) security model, which consists of two nested assumptions:

1. Alice and Bob are assumed to have access to an encryption scheme, computationally secure for a short time t comp , to do private communication against Eve.

CONTENTS

2. Eve's quantum memory is t coh -decohering, i.e., the evolution is described by a complete positive trace-preserving map

N t coh : ⇢ ! N t coh (⇢), such that 1 2 N t coh (⇢ x ) I d d 1 = o ⇣ 1 d

⌘

, and it is assumed that t coh < t comp . These assumptions, in particular, are well motivated by the reality, as the coherence time of a state of the art quantum memory, t coh ⇠ O(1)sec, is much smaller than the computational time, t comp ⇠ 10 9 sec, for which a current classical cryptographic scheme is secure.

Chapter 6: From QCT to a key Establishment Protocol

In this chapter, we discuss key-establishment protocol using the QCT security model. We first present a generic framework to construct a d-dimensional key-establishment protocol. We then propose a key agreement protocol, that we call MUB-Quantum Computational Timelock(MUB-QCT).

Parameters: The m-MUB-QCT-(b, c) key distribution protocol is parametrized by the following parameters

• b : number of bits encoded on a d-dimensional quantum state.

• c : the classical capacity of the encoding.

• m : number of copies of the qudit state sent per channel use.

Ingredients: An essential element of the MUB-QCT protocol will consist in randomizing one of the basis states of a d-dimensional Hilbert space using set of unitaries:

• A complete set of d + 1 mutually unbiased bases (MUB), in dimension d.

• A full set of pair-wise independent permutations. Di↵erent Protocols: Based on the number of bits encoded on a d-dimensional quantum state and the number of copies of the qudit state sent per channel use, we propose di↵erent versions of MUB-QCT protocol.

• In section 6.3.1, we propose 1-MUB-QCT-(log d, log d) protocol, where for a single copy of quantum state sent per channel use log d bits are encoded on a qudit, using a full set of MUBs.

• In section 6.3.2 we propose 1-MUB-QCT-(1, log d) protocol, where for a single copy of quantum state sent per channel use a bit is encoded on a qudit, using a full set of MUBS and a full set of pair-wise independent permutations.

Ingredients:

The protocol consists of two phases;

• Setting a computational timelock: Alice and Bob share a secret information s 2 S (a classical secret information corresponding to the encoding unitary) over a classical communication channel using t comp -secure encryption scheme. For the 1-MUB-QCT-(log d, log d) protocol, s corresponds to the index of the mutually unbiased base, while for the 1-MUB-QCT-(1, log d) protocol, it corresponds to the index of the mutually unbiased base and the permutation used to encode the classical bit on the qudit.

• Quantum communication: Alice encodes a bit x 2 X on a d-dimensional quantum state using

s as ⇢ x = 1 |s| X s ⇢ xs (2)
Alice sends the state ⇢ x to Bob via an insecure quantum channel, who decodes the bit by performing a projective measurement on ⇢ x , using s, and obtains y 2 Y.

Eve is assumed to have full access to the input of Alice and Bob's communication channels (similar to strong quantum data locking [START_REF] Lupo | Quantum data locking for secure communication against an eavesdropper with time-limited storage[END_REF]). However, Eve can not break timelock encryption before t comp . Moreover, she cannot store state ⇢ x for time longer than t coh . Eve can use one only of the following strategies:

• (I) Eve stores the input quantum state ⇢ x in her quantum storage and later performs a measurement at time t comp , knowing the secret s, to obtain z 2 Z.

• (II) Eve performs an immediate measurement on input state ⇢ x and obtains a classical outcome !. At time t comp , she performs post-measurement classical decoding using s and ! to obtain z 2 Z.

Chapter 7: Security of MUB-QCT protocol

In this chapter we present the security of the MUB-QCT protocols. The security of the protocols is proved by demonstrating that under the QCT assumptions, the optimal attack strategy for nonauthorized party Eve consists in an immediate measurement followed by classical post-processing on measurement data i.e., strategy II. This strategy is known as state discrimination with post measurement information as described in [START_REF] Gopal | Using postmeasurement information in state discrimination[END_REF].

For both, the 1-MUB-QCT-(log d, log d) and the 1-MUB-QCT-(1, log d) protocol, we prove that the the optimal eavesdropping strategy is II. For the 1-MUB-QCT-(log d, log d), we prove the the guessing probability for Eve if she perform the strategy II is O

⇣ 1 p d ⌘ .
For the 1-MUB-QCT-(1, log d) protocol, we show that, Eve has no preferable choice for the immediate measurement as the full set of MUBs forms a 2-design [GKR]. As a result, we can prove that this second strategy reduced, for Eve, to access the output of a strong QC-extractor [START_REF] Berta | Quantum to classical randomness extractors[END_REF] based on a full set of MUBs, and therefore that her guessing probability is

1 2 + O ⇣ 1 d ⌘ .
At the end of the MUB-QCT protocol, Alice and Bob hold classical random variables X and Y , while Eve holds a classical random variable Z and a decohered quantum memory. Csiszár and Körner formula [CK78a] R I(X; Y ) I(X; Z) can thus be applied to derive the secure key rate. Proving the security of the MUB-QCT protocol hence requires to bound Eve's mutual information I(X; Z). Given that II is the best strategy, we can use the guessing probability to calculate a bound on eve's mutual information. We prove that for the 1-MUB-QCT-(log d, log d) protocol

I(X; Z) ⇠ O(1/ p d), while for -MUB-QCT-(1, log d) protocol I(X; Z) ⇠ O(1/d).
Very notably, the bound on Eve information can be achieved under QCT security model, by only considering the input state and not Bob measurement's results.

Chapter 8: Security of MUB-QCT with multiple copies per channel use

The previous chapter deals with one copy of ⇢ x encoded on a single photon. In this chapter we explore if the MUB-QCT protocol o↵ers high tolerance to the channel loss incurred at long-distance by transmitting multiple photons per channel use. Alice prepares m copies of the qudit state, ⇢ x , using same basis ✓. We prove security under two restricted attack strategies for Eve; 1. individual attack: where Eve is restricted to perform the same individual fixed measurement on each of the m copies.

2. Proactive MUB measurement: where Eve proactively measures each copy separately in a di↵erent basis, chosen from the full set of MUBs, followed by post-measurement decoding after time t comp .

We prove that for m-MUB-QCT-(1, log d) protocol, the proactive MUB measurement is more e cient than the individual attack strategy. In the case of individual attack strategy Eve's mutual information can be upper bounded as as Chapter 9: Performance analysis of the MUB-QCT protocol MUB-QCT protocol o↵ers following advantages:

I Fix (X; Z) m  O ⇣ p m d ⌘ ,
• Noise tolerance: High dimensional encoding in the MUB-QCT protocol allows high resilience to noise by o↵ering a maximum tolerable error rate of up to 50% for large d.

• Resource requirements: The MUB-QCT protocol can be implemented with only two detectors, irrespectively of d . This relaxes resource requirements compared to HD-QKD schemes [LPD + 13, LBZ + 16a], requiring d-single-photon detectors.

• MDI security: In the MUB-QCT protocol, Eve's information can be upper bounded only by considering the state that Alice inputs. Consequently, the implementation of Bob's measurement device is not required to be trusted to guarantee security.

The proactive MUB measurement strategy appears more e cient than the single copy fixed measurement. It nevertheless allows secure key distribution with input states containing up to O(d) photons, implying a significant performance increase, characterized by a O(d)-multiplication of key rates as shown in Figure 9.3. The possibility of sending multiple copies of the quantum state per channel use moreover can be leveraged to realize multiparty key distribution. In principle, Alice can transmit m copies to up to m authorized Bobs, allowing them to distill the same key.

Chapter 10: Conclusion

In this chapter we briefly review the results presented in the thesis and we compare the results with the other existing works.

Chapter 11: Perspectives

In this final chapter we present some open questions and possible direction for the future work. We first preset the new direction to construct the QCT key distribution protocol using the communication complexity problems. We consider two such communication complexity problems namely Hidden matching problem a[BYJK08, GKRW06, GKK + 07, Gav09] and Khot-Vishnoi game [START_REF] Buhrman | Near-optimal and explicit bell inequality violations[END_REF]. These games have special property that they o↵er exponential separation between the classical and the quantum communication complexity. We show a possible direction for future work on how this exponential separation can be used to send multiple copies per channel use and prove the security of the protocol.

In this chapter we also explains some open question to improve the security of the MUB-QCT protocol, especially with respect the short-term secure computational assumption. We describe two ways to redefine the assumption by considering either the public key or private-key encryption scheme to be short-term secure.

Finally, we explore the possible implementation of the MUB-QCT protocol. We first explain the important experimental challenges for the implementation of the protocol. We then briefly review di↵erent high-dimensional encodings that have been demonstrated experimentally. We then propose a sketch of a possible high dimensional MUB-QCT protocol using spatial modes and finally we discuss the suitability of QCT key distribution protocol with coherent state encoding.

Part I

From Quantum information to Quantum Cryptography Chapter 1

Quantum information and communication

The word 'information' refers to a poly-semantic concept associated with many di↵erent phenomenons, such as communication, knowledge, reference, and meaning. It can be some facts provided or learned about something or someone or can be that, which is conveyed or represented by a particular arrangement or a sequence of things. In an everyday sense, characteristic use of the term 'information' is in phrases of the form: 'information about p', where p might be some object, event, or topic; or in terms of the form: 'information that q'. Concerning information, we can distinguish between possessing information, which is to know; acquiring information, gaining knowledge; and containing information, which is sometimes the same as knowing.

Information is Physical -Rolf Landauer

In physics, information refers to the information of a physical system, generally considered to specify the system's 'true' state. Information is encoded in the state of a physical system. In information theory, it is a mathematical quantity expressing the probability of a particular sequence of symbols, impulses as against that of alternative sequences.

In this chapter, we briefly describe the main tools of "Quantum Mechanics" and "Quantum Information Theory" that we will use for the study of Quantum Key Distribution. We begin with a brief introduction to Quantum mechanics, followed by basic tools and aspects of classical information theory, and finally, we introduce topics in quantum information theory.

Most of this chapter's content is present in Nielsen and Chuang's textbook [START_REF] Nielsen | Cambridge Series on Information and the Natural Sciences[END_REF] and Lecture notes on Quantum Information and Computation by J. Preskill [START_REF] Preskill | Lecture Notes for Physics 229:Quantum Information and Computation[END_REF].

Brief introduction to quantum mechanics

The twentieth century's opening heralded an unprecedented era of turnover and re-evaluation of the classical theory that governed Physics since pre-Newtonian times. Two grand revolutionary ideas changed the face of physics in the early decades of the twentieth century: the Theory of Relativity and the Quantum Mechanics. Einstein's Theory of Relativity called for radical changes in the classical Newtonian concepts of space and time. These two were considered independent entities in the description of the physical world and let to the unified four-dimensional world in which time is regarded as the fourth coordinate, though not quite equivalent to the three space coordinates.

The story of Quantum Theory, on the other hand, is the result of the creative work of several great scientists that went through many evolutionary stages. It gives us today a deep insight into the structure of atoms and atomic nuclei and that of bodies of the sizes familiar to our everyday experience.

On December 14, 1900, Max Plank stated that paradoxes persisting the classical theory of the emission and absorption of light by material bodies could be removed if one assumes that radiant energy can exist only in the form of discreet packages. He called these packages light quanta. Five years later, Albert Einstein successfully applied the idea to explain the empirical law of photoelectric e↵ect; the emission of electron from metallic surfaces when irradiated by light with energy greater than the wave-function of the metallic surface. Later, Arthur Compton experimentally showed X-ray scattering by free electron follow the same law as the collision between two elastic spheres.

In the year 1913, Niels Bohr extended Plank's idea of quantization of radiant energy to the description of mechanical energy of electrons with an atom by introducing specific quantization rules for such mechanical systems. Bohr was able to explain the spectral lines of hydrogen and heavier elements in great detail, a problem that for decades had mystified the spectroscopists. However, successful as Bohr's theory, it was still not a final theory since it could not explain, for example, describe the transition process of an electron from one quantum state to another, and there was no way to calculate the intensities of various lines in optical spectra.

In 1925, a French physicist, Louis de Broglie, gave an entirely unexpected interpretation of the Bohr's theory, where he explained that in a Bohr quantum orbit, the motion of each electron is governed by some mysterious pilot wave, whose propagation and length depends on the velocity of the electron in question. Assuming that these pilot waves are inversely proportional to the electron's velocity, de Broglie showed that various quantum orbits in Bohr's model of a hydrogen atom were those that could accommodate an integral number of pilot wave. This idea was extended by Erwin Schrodinger, whose theory is popularly known as Wave Mechanics. Simultaneously, W. Heisenberg developed the treatment of quantum problem using non-commutative algebra to give the uncertainty principle asserting a fundamental limit to the precision with which the values for specific pairs of physical quantities of a particle, known as complementary variables or canonically conjugate variables such as position x and momentum p, can be predicted from initial conditions.

But with all development, there remained one sharp thorn in the crown of the Quantum Theory, it was painful whenever one tried to quantized the mechanical system, which, because of the very high velocity involved (close to the speed of light), required relativistic treatment. The relief from this pain came in 1929 when P. A. M. Dirac wrote his famous Relativistic Wave Equation. The solution to this equation gave a perfect description of the atomic electron's motion at velocities close to that of light and explained their linear and angular mechanical momenta and magnetic moments. His equation also suggested that along with ordinary negatively charged electrons there must also exist positively charged anti-electron. This brilliant prediction was later verified when anti-electrons were found in cosmic rays.

Thus, by 1930, only three decades after Plank's announcement, the Quantum Theory took the final shape with which we are now familiar.

Description of a quantum physical system

In this section the postulates of quantum mechanics will be stated out and discussed in broad term to bring out the essential features of quantum theory.

Postulate 1: State space; Associated to any isolated physical system is a complex vector space with inner product (that is, a Hilbert space) known as the state space of the system. The system is completely described by its state vector, which is a unit vector in the system's state space.

The first postulate states that a particle is represented by a ket vector i in a Hilbert space H. It has an inner product h | i that maps an ordered pair of vectors to a vector space over the complex numbers C, defined by the properties 1. Positivity:

h | i > 0 for i = 0 2. Linearity: h |(a| 1 i + b| 2 i) = ah | 1 i + bh | 2 i 3. Skew symmetry: h | i = h | i ⇤ The state | i is complete in the norm || || = h | i 1/2
. An alternative description of the postulate is captured by the principle of superposition, which states that if | i and | i represents two possible states of a particle then so does ↵| i

+ | i, such that |↵| 2 + | | 2 = 1.
Postulate 2: Observable; An observable is a property of a physical system that in principle can be measured. In quantum mechanics an observable is a self adjoint operator.

An operator is a linear map taking vectors to vectors A : | i ! A| i. The adjoint of the operator A is defined by

h |A i = hA † | i (1.1)
for all vectors | i, | i. If A and B are self adjoint, then so

(A + B) † = A † + B † , but since (AB) † = B † A † , so AB is self adjoint only if A and B commute.
Postulate 3: Measurement; If the particle is in the state | i, the measurement of the observable A, will yield one of the eigenvalue a of A, with probability P (a) / |ha| i| 2 . The state of the system will change from | i to |ai as a result of the measurement.

The theory makes only probabilistic prediction for the results of a measurement. Further, it assigns (relative) probabilities only for obtaining some eigenvalue a i of A. And as the operator is required to be Hermitian, these eigenvalues are real. Since we told that P (a) / |ha i | i| 2 , the quantity |ha i | i| 2 is only the relative probability. To get the absolute probability, we divide |ha i | i| 2 by the sum of all relative probabilities:

P (a i ) = |ha i | i| 2 P i |ha i | i| 2 (1.2)
Projective measurement versus POVM: A projective measurement is described by an observable, A, a Hermitian operator on the state space of the system being observed. The observable has a spectral decomposition, A = P a aP a , where P a = |aiha| is the projector onto the eigenspace of A with eigenvalue a. The possible outcomes of the measurement corresponding to the eigenvalues, a, of the observable. Upon measuring the state | i, the probability of getting result a is

P (a) / |ha| i| 2 = h |aiha| i = h |P a | i = h |P † a P a | i = ||P a | i|| 2 (1.3)
Projective measurements are restrictive and not always possible. Sometimes we destroy a quantum state in the process of measurement; thus, the repeatability of a projective measurement is violated. For example, a photon may be absorbed by a polarization filter and no longer available for measurements. In such cases where the system is measured only once, the post-measurement state of the system is no longer of interest and the probabilities of the measurement outcomes are the ones that count. A generalized type of measurement, the positive operator-valued measure, or POVM, is concerned only with the measurement statistics. The POVM operators are not necessarily orthogonal or commutative and allow measurement outcomes associated with non-orthogonal states. Recall that measurement operators corresponding to non-orthogonal states do not commute and are therefore not simultaneously observable. The number of POVM operators may di↵er from the dimension of the Hilbert space, while the number of projective operators is precisely equal to the Hilbert space's dimension.

Given the set of measurement operators, {M i }, describing a measurement performed on a quantum system in the state, | i, a POVM has the elements, E i , defined by

E i = M † i M i
, and,

X i E i = I (1.4)
.

The operator E i have several properties, including:

1. They are positively defined, i.e., a positively defined operator has real and positive eigenvalues. This property follows immediately from the definition of E i .

2.

P (i) = h |E i | i.
This follows immediately from the fact that where, H is the Hamiltonian of the system.

P (i) = h |M † i M i | i.
Time evolution of a quantum state is unitary it is generated by a self-adjoint operator called the Hamiltonian of the system. We may express the above equation, to first order in the infinitesimal quantity dt, as

| (t + dt)i = (1 iHdt)| (t)i = U (dt)| (t)i (1.6)
The operator U (dt) is unitary; because H is self-adjoint it satisfies U † U = 1 to linear order in dt.

Since a product of unitary operator is finite, the time evolution over a finite interval is also unitary

| (t)i = U (t)| (0)i (1.7)
In the case, where H is time independent; we may write U = e itH

Density operator

We have formulated quantum mechanics using the language of state vectors. An alternate formulation is possible using a tool known as the density operator or density matrix. This alternate formulation is mathematically equivalent to the state vector approach, but it provides a much more convenient language for thinking about some commonly encountered quantum mechanics scenarios.

The density operator language provides a convenient means for describing quantum systems whose state is not completely known. More precisely, suppose a quantum system is in one of many states | i i, where i is an index, with respective probabilities p i . We shall call {p i , | i i} an ensemble of pure states. Then the state of a quantum mechanical system is represented by a normalized nonnegative operator ⇢, called density operator, on a Hilbert space H, defined as

⇢ = X i p i | i ih i | (1.8)
The normalization is with respect to the trace norm, i.e., ||⇢|| 1 = Tr(⇢) = 1. When measuring a system in the state ⇢ with respect to POVM, i.e., a family {E i }, the probability distribution of the outcome is given by P (i) := Tr(E i ⇢)

Product system and purification

To analyze complex physical systems, it is often convenient to consider partitioning into several subsystems. This is particularly useful if one is interested in studying operations that act on the parts of the system individually. Mathematically, a quantum system's partition into subsystems induces a product structure on the underlying Hilbert space. The state space of a composite physical system is the tensor product of the state spaces of the component physical systems. Moreover, if we have systems numbered 1 through n, and system i is prepared in the state ⇢, then the joint state of the total system is ⇢ 1 ⌦ ⇢ 2 ⌦ . . . ⌦ ⇢ n . For example, consider a bipartite state, if the Hilbert space describes the individual systems H A and H B , the Hilbert space H AB of the hybrid system

⇢ AB = ⇢ A ⌦ ⇢ B is the tensor product of individual systems, H AB = H A ⌦ H B .
The state of one part of a product system is then obtained by taking the corresponding partial trace of the overall state, i.e., ⇢ A = Tr B (⇢ AB ) (1.9)

A density operator ⇢ on H is said to be pure if it has rank one, that is, ⇢ = | ih |, for some | i 2 H. If it is normalized, ⇢ is a projector onto | i. This implies that a pure state contains no classical randomness. That is, it cannot be correlated with any other system. The fact that a pure state cannot be correlated with the environment plays a crucial role in cryptography. It implies, for example, that the randomness obtained from the measurement of a pure state is independent of any other system and thus guaranteed to be secret. More generally, let ⇢ A be an arbitrary operator on H A and let ⇢ AE be a purification of ⇢ A , i.e., ⇢ AE is a pure state on a product system H A ⌦ H E such that tr E (⇢ AE ) = ⇢ A . Then, because ⇢ AE is uncorrelated with any other system, the partial system H E comprises everything that might be correlated with the system H A (including the knowledge of a potential adversary).

Classical information

This section aims to discuss and understand the main concepts in classical information theory before we delve into the analogous quantum information-theoretic ideas. We present a very rapid overview of the topic, and a more detailed presentation can be found for instance in the textbooks "Elements of information theory" by Cover and Thomas [START_REF] Cover | Elements of Information Theory[END_REF] and "Information theory, inference, and learning algorithms" by MacKay [START_REF] Mackay | formation Theory, Inference and Learning Algorithms[END_REF].

CHAPTER 1. QUANTUM INFORMATION AND COMMUNICATION Definition 1.2.1 (Shannon entropy) Let X be a random variable distributed over a finite set X according to the probability distribution P X . Then, a natural measure of the uncertainty of a random variable X is its (Shannon) entropy H(X) defined as follows:

H(X) = X x2X P X (x) log 2 P X (x) (1.10)
This notion can be generalized to n-tuples of random variables X 1 , . . . , X n , with the joint entropy : In a cryptographic setting, the Shannon entropy is not always a desirable measure as it merely captures our uncertainty about X on average. Often, the Rényi entropy allows us to make stronger statements. The Rényi entropy of order ↵ is defined as

H(X 1 , . . . , X n ) = X x 1 2X 1 . . . X xn2Xn P X 1 ,...,
H ↵ (X) = 1 1 ↵ log 2 h⇣ X x2X P X (x) ↵ ⌘ 1 ↵ 1 i (1.12)
Indeed, the Shannon entropy forms a special case of Rényi entropy by taking the limit ↵ ! 1, i.e., H 1 (•) = H(•). Among other values of ↵, ones with particular interests are

1. Max entropy H max (X) = H 0 (X) := log 2 |X | (1.13) 2.
Collision entropy, which plays a role for privacy amplification protocols

H 2 (X) := log 2 X x2X P 2 x (1.14)
3. Min entropy, which is determined by the highest peak in the distribution and most closely captures the notion of "guessing " x.

H min (X) = H 1 (X) = log 2 (max x2X P X (x)) (1.15)
Following which, we have

log 2 |X | H(X) H 2 (X) H 1 (X) (1.16)
i.e.,for a given random variable X, (↵ 7 ! H ↵ (X)) is a decreasing function of ↵. All the Rényi entropy are additive, meaning H ↵ (X, Y ) = H ↵ (X) + H ↵ (Y ) for independent random variables X and Y . Furthermore, we can quantify the uncertainty about X given Y by the means of the conditional entropy

H(X|Y ) = H(X, Y ) H(Y ) (1.17)
A fundamental property of the conditioning is that it reduces the entropy:

H(X|Y )  H(X) (1.18)
with equality if X and Y are independent random variables. To quantify the amount of information X and Y may have in common we usemutual information

I(X, Y ) = H(X) + H(Y ) H(X, Y ) = H(X) H(X|Y ) (1.19)
Intuitively, the mutual information captures the amount of information we gain about X by learning Y . The mutual information between two random variables is a measure of their correlation. In particular, one has I(X; Y ) = 0 for independent variables. In should be noted that Equation (1.18) also holds for conditional entropies

H(X|Y, Z)  H(H|Y ) (1.20)
which is called the strong subadditivity property. This property can equivalently be written:

H(X, Y ) + H(Y, Z) H(X, Y, Z) + H(Y ).
(1.21)

S(⇢) = Tr(⇢ log 2 ⇢) (1.22)
Taking the eigen-decomposition of ⇢ x = P

x x |xihx| we can also write 4. If a composite system AB is pure then S(A) = S(B).

S(⇢) = X x x log x x , (

If ⇢ = P

k P K (k)⇢ k , where P K (k) have support on orthogonal subspaces, then

S(⇢) = H(P K (k)) + X k P K (k)S(⇢ k ).
(1.24)

6. S is subadditive: S(⇢ AB )  S(⇢ A ) + S(⇢ B ), with equality if and only if

⇢ AB = ⇢ A ⌦ ⇢ B
Similar to classical joint and conditional entropies, one can define quantum joint and conditional entropies as well as quantum mutual information for composite system. Let a quantum state of a composite system AB be represented by the density matrix ⇢ AB , one defines the joint entropy of the system AB as

S(A, B) = (T r)(⇢ AB log 2 ⇢ AB ), (1.25)
The quantum conditional entropy of A given B is Corollaries of this results are:

S(A|B) = S(A, B) S(B), (
1. Conditioning reduces entropy: S(A|B, C)  S(A|B).

2. Discarding quantum system never increases mutual information: S(A : B)  S(A : B : C).

3.

Quantum operations never increases mutual information: if the system AB is mapped to A 0 B 0 through a quantum operation, then S(A 0 : B 0 )  S(S : B). Here, a quantum operation refers to a linear completely positive trace non-increasing map.

Encoding quantum information

Recall that a qubit is represented as a vector in a two dimensional Hilbert space, which is drawn by the following basic vectors:

|0i = ✓ 1 0 ◆ , |1i = ✓ 0 1 ◆ (1.29)
Any pure qubit state can thus be expressed as a linear superposition of these basis states,

| i = ↵|0i + |1i = cos(✓/2)|0i + e i sin(✓/2)|1i (1.30)
with ✓ 2 (0, ⇡), 2 (0, 2⇡) and i the imaginary unit. This state can be pictorially represented as a vector in the so-called "Bloch sphere". When ✓ = 0 or ✓ = ⇡, we recover the basis states |0i and |1i , respectively, which are placed at the poles of the sphere. When ✓ = ⇡/2, the qubit pure state is a vector lying on the equator of the sphere. Here we can identify the four vectors aligned along the x and ŷ axes, which are obtained in correspondence of four specific values of , i.e., we have:

= 0 : |+i = 1 p 2 ✓ 1 1 ◆ , = ⇡ : | i = 1 p 2 ✓ 1 1 ◆ (1.31) = ⇡/2 : | + ii = 1 p 2 ✓ 1 i ◆ , = 3⇡/2 : | ii = 1 p 2 ✓ 1 i ◆ , ( 1
8(i, j) 2 [d], ⌦ e ✓ 1 i |e ✓ 2 j ↵ = 1 p d (1.33)
In a d dimension Hilbert space, there exist at most (d + 1) mutually unbiased bases [START_REF] Bandyopadhyay | A new proof for the existence of mutually unbiased bases[END_REF].

Explicit construction of a full set of MUBs is known for prime power dimension and square dimensions [START_REF] Wocjan | New construction of mutually unbiased bases in square dimensions[END_REF].

To give a physical meaning to the representation of a qubit, we can interpret the qubit state in Eq. (1.30) as the polarization state of a photon. In this case, the Bloch sphere is conventionally called the Poincaré sphere, but its meaning is unchanged. The basis vectors on the poles of the Poincaré sphere are usually associated with the linear polarization states |Hi = |0i and |V i = |1i, where H and V refer to the horizontal or vertical direction of oscillation of the electromagnetic field, respectively, with respect to a given reference system. The X basis states are also associated with linear polarization but along diagonal (|Di = |+i) and anti-diagonal (|Ai = | i) directions. Finally, the Y basis states are associated with right-circular (|Ri = | + ii) and left-circular (|Li = | ii) polarization states. Any other state is an elliptical polarization state and can be represented by suitably choosing the parameters ✓ and .

Distance between quantum states

Intuitively, we say that two states of a physical system are similar if any observation of them leads to identical results, except with small probability. For two operators ⇢, 2 P(H) representing the state of a quantum system, this notion of similarity is captured by the L 1 -distance, i.e., the trace distance defined as Definition 1.3.4 (Trace distance.) The trace distance between two states ⇢ and is given by

D(⇢, ) = 1 2 ||⇢ || 1 , (1.34)
where

||A|| 1 = Tr( p A † A) is the trace norm of A.
Alternatively, the trace distance may also be expressed as

D(⇢, ) = max M Tr(M (⇢ )), (1.35)
where the maximization is taken over all M 0. Indeed, D is really a "distance" measure, as it is clearly a metric on the space of density matrices: We have D(⇢, ) = 0 if and only if ⇢ = , and evidently D(⇢, ) = D( , ⇢). Finally, the triangle inequality holds:

D(⇢, ) = max M Tr(M (⇢ )) = max M (Tr(M (⇢ )) + Tr(M ( ⇢)))  D(⇢, ) + D( , ) (1.36)
The trace distance for operators can be seen as the quantum version of the trace distance for probability distributions (or, more generally, nonnegative functions), which is defined by

D(P X (x), Q X (x)) = ||P Q|| 1 := 1 2 X x |P X (x) Q X (x)| (1.37)
between two classical probability distribution P X (x) and Q X (x). Under the action of a quantum operation, the trace distance between two density operators ⇢ and cannot increase. Because any measurement can be seen as a quantum operation, this immediately implies that the distance kP Qk 1 between the distributions P X (x) and Q X (x) obtained from (identical) measurements of two density operators ⇢ and respectively, is bounded by k⇢ k 1 . The following proposition provides a very simple interpretation of the trace distance: If two probability distributions P X (x and Q X (x have trace-distance at most 2", then the two settings described by P X (x) and Q X (x), respectively, cannot di↵er with probability more than ".

Proposition 1.3.1 Let P X (x), Q X (x) be probability distributions. Then there exists a joint distribution P XX 0 (x, x 0

) such that P X (x) and Q X (x) are the marginals of P XX 0 (x, x 0 ) and, for (x, x 0 ) chosen according to P XX 0 ((x, x 0 )

Pr [x 6 = x 0 ]  1 2 kP Qk 1 (1.38)
In particular, if the trace distance between two states is bounded by 2" then they cannot be distinguished with probability more than ".

Distinguishability of quantum states

A consequence of quantum mechanics' linearity is the no cloning theorem, stating that there cannot exist an operation that clones an arbitrary quantum state since the operation | i 7 ! | i| i is not unitary. A corollary to this result is that one cannot distinguish correctly between non-orthogonal quantum states. Now the question arises that how can we distinguish several quantum states? To answer this, we introduce some of the necessary distinguishability measures, such as the Helstrom bound, the quantum Cherno↵ bound, and the quantum fidelity.

Helstrom bound

Let us suppose that a quantum system is described by an un-known quantum state ⇢ which can take two possible forms, ⇢ 0 or ⇢ 1 , with the same probability. For discriminating between ⇢ 0 and ⇢ 1 , we can apply an arbitrary quantum measurement to the system. Without loss of generality, we can consider a dichotomic POVM {⇧ 0 , ⇧ 1 := I ⇧ 0 } whose outcome u = 0, 1 is a logical bit solving the discrimination. This happens up to an error probability

p e = p(u = 0|⇢ = ⇢ 1 ) + p(u = 1|⇢ = ⇢ 0 ) 2 , (1.39)
where p(u|⇢) is the conditional probability of getting the out-come u given the state ⇢. Then we ask: what is the minimum error probability we can achieve by optimizing over the (dichotomic)

POVMs? The answer to this question is provided by the Helstrom bound [START_REF]Quantum Detection and Estimation Theory[END_REF]. Helstrom showed that an optimal POVM is given by ⇧ 1 = P ( + ), which is a projector onto the positive part + of the non-positive operator := ⇢ 0 ⇢ 1 , known as the Helstrom matrix. As a result, the minimum error probability is equal to the Helstrom bound

p e,min = 1 2 [1 D (⇢ 0 , ⇢ 1 )] (1.40)
where,D (⇢ 0 , ⇢ 1 ) is the trace distance between the two quantum states.

Quantum Cherno↵ bound

The quantum Cherno↵ bound [ANSV08, CMnTM + 08, NS09] is an upper bound p e,min  p QC , defined by

p QC := 1 2 ⇣ inf 0s1 C s ⌘ , C s = Tr(⇢ s 0 ⇢ 1 s 1 ) (1.41)
Note that the quantum Cherno↵ bound involves a minimization in s 2 [0, 1]. In particular, we must use an infimum because of possible discontinuities of C s at the border s = 0, 1. By ignoring the minimization and setting s = 1/2, we derive a weaker but easier-to-compute upper bound. This is known as the quantum Bhattacharyya bound [START_REF] Pirandola | Computable bounds for the discrimination of gaussian states[END_REF] p B := 1 2

Tr ⇣ p ⇢ 0 p ⇢ 1 ⌘ .
(1.42)

Quantum fidelity

Further bounds can be constructed using the quantum fidelity. The fidelity F is a commonly used measure to compare the input state to the output state. Given two quantum states, ⇢ 0 and ⇢ 1 , their fidelity is defined by

F (⇢ 0 , ⇢ 1 ) := h Tr ⇣q p ⇢ 0 ⇢ 1 p ⇢ 0 ⌘i 2 , (1.43)
which ranges from zero for orthogonal states to one for identical states.

Multicopy discrimination

Let us assume we have M copies of an unknown quantum state ⇢, which again can take the two possible forms ⇢ 0 or ⇢ 1 , with the same probability. In other words, we have the two equiprobable hypotheses

H 0 : ⇢ ⌦M = ⇢ ⌦M 0 := M z }| { ⇢ 0 ⌦ • • • ⌦ ⇢ 0 (1.44) H 1 : ⇢ ⌦M = ⇢ ⌦M 1 := ⇢ 1 ⌦ • • • ⌦ ⇢ 1 | {z } M (1.45)
The optimal quantum measurement for discriminating the two cases is now a collective measurement involving all the M copies. This is same dichotomic POVM as before, now projecting on the positive part of tge Helstrom matrix = ⇢ ⌦M 0 ⇢ ⌦M 1 . Correspondingly, the Helstrom bound for the M -copy state discrimination takes the form.

p (M ) e,min = 1 2 [1 D(⇢ ⌦M 0 , ⇢ ⌦M 1 )]. (1.46)
Similarly, the M -copy quantum Cherno↵ bound

p (M ) QC := 1 2 ⇣ inf 0s1 C s ⌘ (1.47)
following which, the M -copy quantum Bhattacharyya bound is

p (M ) B = 1 2 h Tr ⇣ p ⇢ 0 p ⇢ 1 ⌘i M .
(1.48)

State discrimination with post-measurement information

This problem was considered by S. Wehner et.al [START_REF] Gopal | Using postmeasurement information in state discrimination[END_REF] and is described in Figure 1 In order to illustrate the problem formally we now present in advance the core of the problem of State discrimination using post-measurement information. As defined, Eve can perform any measurement immediately on the incoming quantum state and store the outcome in her classical storage. In this regard, the best immediate measurement corresponds to a measurement using the POVM ( ⇧ := { ⇧⌦ }), with |X | |B| outcomes, each labeled by the strings ⌦ = (! 0 , . . . , ! |B| ) i.e., { ⇧! 0 ,...,! |B| }. Where, each outcome ⌦ is a string of length |B|, which equip Eve with possible outputs ! i 2 X for each basis i 2 B.

! "

Pick x

Alice Eve

x with P guess Later when Alice reveals the basis ✓, Eve outputs z = ! ✓ . This corresponds to applying the following map f ✓ on the string ⌦, which corresponds to an output z = f ✓ (⌦) = (! ✓ |i = ✓) i.e., the assignment is done by selecting the value ! i corresponding to i = ✓. Finally, Eve guesses the value of x from the output z = ! b .

Now Eve succeeds at discriminating the state ⇢ x✓ using post-measurement information ✓ with probability P guess , if and only P guess is the average success probability, which is calculated as,

P guess = X x✓ P x✓ P (z = x|⇢ x✓ ) (1.49)
Now, for a given ⇢ x✓ the probability to guess x is the product of two events (a) the probability to obtain the measurement outcome ⌦ i.e., P (⌦|⇢ x✓ ), and (b) probability to output x = z = ! ✓ from ⌦, i.e., P (! ✓ = x|⌦), sum over all the possible value of ⌦.

P (z = x|⇢ x✓ ) = X ⌦ P (⌦|⇢ x✓ )P (! ✓ = z = x|⌦) (1.50) Now, P (! ✓ = x|⌦) = P (! ✓ = x|(! 0 , • • • , ! d )) = P (! ✓ = x|! ✓ ) = ! ✓ x .
The success probability is then,

P guess = 1 |X | 1 |B| X x✓ X ⌦ P (⌦|⇢ x✓ ) ! ✓ x = 1 |X | 1 |B| X ✓ X ⌦ P (⌦|⇢ ! ✓ ✓ ) (1.51)
in the above equation P (⌦|⇢ ! ✓ ✓ ) = Tr( ⇧⌦ ⇢ ! ✓ ✓ ) Thus,

P guess = 1 |X | 1 |B| X ⌦ Tr ⇣ ⇧⌦ X ✓ ⇢ ! ✓ ✓ ⌘ (1.52)
Chapter 2

Cryptography

Cryptography is about communication in the presence of an adversary. It encompasses many problems (encryption, authentication, key distribution, to name a few). The field of modern cryptography provides a theoretical foundation based on which we may understand what exactly these problems are, how to evaluate protocols that purport to solve them, and how to build protocols in whose security we can have confidence.

The objective of this chapter is to highlight the salient features of security definitions in classical cryptography schemes and provide a reasonable basis for comparison with information-theoretic schemes. Most of the content in this chapter is repeated and is present in many books [KL14, BR05, GB01]

Secure communication: a short summary

The most ancient and fundamental problem of cryptography is secure communication over an insecure channel. Party A wants to send to party B a secret message over a communication line that an adversary may tap.

The traditional solution to this problem is called private key encryption. In private key encryption, A and B hold a meeting before the remote transmission takes place and agree on a pair of encryption and decryption algorithms Enc and Dec, and an additional piece of information S to be kept secret. We shall refer to S as the shared secret key. The adversary may know the encryption and decryption algorithms Enc and Dec which are being used but does not know S.

After the initial meeting when A wants to send B the cleartext or plaintext message m over the insecure communication line, A encrypts m by computing the cyphertext c = Enc(S, m) and sends c to B. Upon receipt, B decrypts c by computing m = Dec(S, c). The line-tapper (or adversary), who does not know S, should not be able to compute m from c.

Let us illustrate this general and informal setup with an example of substitution cipher. In this method A and B meet and agree on some secret permutation f : ⌃ ! ⌃ (where ⌃ is the alphabet of the messages to be sent). To encrypt message m = m 1 . . . m n where m

i 2 ⌃, A computes Enc(f, m) = f (m 1 ) . . . f (m n ) . To decrypt c = c 1 . . . c n where c i 2 ⌃, B computes Dec(f, c) = f 1 (c 1 ) . . . f 1 (c n ) = m 1 . . . m n = m.
In this example the common secret key is the permutation f . The encryption and decryption algorithms Enc and D are as specified, and are known to the adversary. We note that the substitution cipher is easy to break by an adversary who sees a moderate (as a function of the size of the alphabet ⌃ ) number of cyphertexts. A rigorous theory of perfect secrecy based on information theory was developed by Shannon [START_REF] Shannon | Communication theory of secrecy systems[END_REF] in 1943.

The theory assumes that the adversary has unlimited computational resources. Shannon showed that a secure (adequately defined) encryption system can exist if the size of the secret information S that A and B agree on before remote transmission is as large as the number of secret bits ever exchanged remotely using the encryption system.

An example of a private key encryption method which is secure even in presence of a computationally unbounded adversary is the one time pad. A and B agree on a secret bit string pad = b 1 b 2 . . . b n , where b i 2 R {0, 1} (i.e (pad is chosen in {0, 1} n with uniform probability). This is the common secret key. To encrypt a message m = m 1 m 2 . . . m n where m i 2 {0, 1}, A computes Enc(pad, m) = m pad (bitwise exclusive or).

To decrypt cyphertext c 2 {0, 1} n , B computes Dec(pad, c) = pad c = pad (m pad) = m. It is easy to verify that 8m, c the Pr pad [Enc(pad, m) = c] = 1 2 n .
From this, it can be argued that seeing c gives "no information" about what has been sent. (In the sense that the adversary's a posteriori probability of predicting m given c is no better than her a priori probability of predicting m without being given c. )

Now, suppose A wants to send B an additional message m 0 . If A were to send c = Enc (pad, m 0 ), then the sum of the lengths of messages m and m 0 will exceed the length of the secret keypad, and thus by Shannon's theory, the system cannot be secure. Indeed, the adversary can compute Enc(pad, m) Enc (pad, m 0 ) = m m 0 which gives information about m and m 0 (e.g. can tell which bits of m and m 0 are equal and which are di↵erent). To fix this, the length of the agreed pad should be the total length of all messages ever to be exchanged over the insecure communication line.

Modern cryptography abandons the assumption that the adversary has available infinite computing resources. Moreover, it assumes instead that the adversary's computation is resource-bounded in some reasonable way. It is based on a gap between e cient algorithms for encryption for the legitimate users versus the computational infeasibility of decryption for the adversary, it requires that one have available primitives with certain special kinds of computational hardness properties. Of these, perhaps the most basic is a one-way function and trapdoor functions. Informally, a function is one-way if it is easy to compute but hard to invert. We will discuss there two primitives in this chapter. Other primitives include pseudo-random number generators, and pseudorandom function families, please see [KL14, BR05, GB01] for more details on them.

However, a central issue is where these primitives come from. Although one-way functions are widely believed to exist, and several conjectured candidate one-way functions are widely used, we currently do not know how to prove that they exist mathematically.

Preliminaries

To formally describe our assumptions (one-way functions and trapdoor function), we first need to recall some complexity theory definitions.

Complexity classes and standard definitions Complexity class P

A language L is in P if and only if there exists a Turing machine M (x) and a polynomial function Q(y) such that on input string x 1. x 2 L i↵ M accepts x (denoted by M (x) ).

M terminates after at most

Q(|x| ) steps.
The class of languages P is classically considered to be those languages which are 'easily computable'. We will use this term to refer to these languages and the term 'e cient algorithm' to refer to a polynomial time Turing machine.

Complexity class NP

A language L is in NP if and only if there exists a Turing machine M (x, y) and polynomials p and l such that on input string x 1. x 2 L ) 9y with |y|  l(|x|) such that M (x, y) accepts and M terminates after at most p(|x|) steps.

2. x / 2 L ) 8y with |y|  l(|x|), M(x, y) rejects.
Note that this is equivalent to the (perhaps more familiar) definition of L 2 NP if there exists a non-deterministic polynomial time Turing machine M which accepts x if and only if x 2 L. The string y above corresponds to the guess of the non-determinstic Turing machine.

Complexity class BPP

A language L is in BPP (Bounded-error Probabilistic Polynomial) if and only if there exists a Turing machine M (x, y) and polynomials p and l such that on input string x

1. x 2 L ) Pr |y|<l(|x|) [M (x, y) accepts ] 2 3 . 2. x / 2 L ) Pr |y| < l(|x|)[M (x, y) accepts ]  1 3 . 3. M (x,
y) always terminates after at most p(|x| ) steps.

We know that P ✓ NP and P ✓ BPP. We do not know if these containments are strict although it is often conjectured to be the case. It is not known whether BPP is a subset of NP.

Probabilistic algorithms

The class BPP could be alternatively defined using probabilistic Turing machines (probabilistic algorithms). A probabilistic polynomial-time Turing machine M is a Turing machine which can flip coins as an additional primitive step, and on input string x runs for at most a polynomial in |x| steps. We could have defined BPP by saying that a language L is in BPP if there exists a probabilistic polynomial-time Turing machine M (x) such that when x 2 L, the probability (over the coin tosses of the machine) that M (x) accepts is greater than 2 3 and when x / 2 L the probability (over the coin tosses of the machine) that M (x) rejects is greater than 2 3 . The string y in the previous definition corresponds to the sequence of coin flips made by the machine M on input x.

From now on, we will consider probabilistic polynomial-time Turing machines as "e cient algorithms" (extending the term previously used for deterministic polynomial-time Turing machines). We also call the class of languages in BPP "easily computable". Note the di↵erence between a non-deterministic Turing machine and a probabilistic Turing machine. A non-deterministic machine is not something we could implement in practice (as there may be only one good guess y which will make us accept). A probabilistic machine is something we could implement in practice by flipping coins to yield the string y (assuming, of course, that there is a source of coin flips in nature). Some notation is useful when talking about probabilistic Turing machines.

Notation for probabilistic Turing machines

Let M denote a probabilistic Turing machine (PTM). M (x) will denote a probability space of the outcome of M during its run on x. The statement z 2 M (x) indicates that z was output by M when running on input x. Pr[M (x) = z] is the probability of z being the output of M on input x (where the probability is taken over the possible internal coin tosses made by M during its execution). M (x, y) will denote the outcome of M on input x when internal coin tosses are y.

Non-uniform polynomial time

An important concept is that of polynomial-time algorithms, which can behave di↵erently for inputs of di↵erent size, and may even be polynomial in the size of the input (rather than constant as in the traditional definition of a Turing machine).

Definition 2.2.1 A non-uniform algorithm A is an infinite sequence of algorithms {M i } (one for each input size i ) such that on input x, M |x| |(x) is run. We say that A(x) accepts if and only if M |x| (x) accepts. We say that A is a polynomial time non-uniform algorithm if there exist polynomials P and Q such that M |x| (x) terminates within P (|x|) steps and the size of the description of M i (according to some standard encoding of all algorithms ) is bounded by Q(|i| ) . Definition 2.2.2 We say that a language L is in P/ poly if 9 a polynomial time non-uniform algorithm

A = {M i } such that x 2 L i↵ M |x| (x) accepts.
There are several relationships known about P/ poly. It is clear that P ⇢ P/ poly and it has been shown by Adleman that BPP ⇢ P/ poly.

We will use the term 'e cient non-uniform algorithm' to refer to a non-uniform polynomialtime algorithm and the term "e ciently non-uniform computable" to refer to languages in the class P/poly.

Models of adversary

We will model the computational power of the adversary in two ways. The first is the (uniform) adversary. A uniform adversary is any polynomial-time probabilistic algorithm. A non-uniform adversary is any non-uniform polynomial-time algorithm. Thus, the adversary can use di↵erent algorithms for di↵erent sized inputs. The non-uniform adversary is stronger than the uniform one. Thus, proving that "something" is "secure" even in the presence of a non-uniform adversary is a better result than only proving it is secure in the presence of a uniform adversary.

The weakest assumption that must be made for cryptography in the presence of a uniform adversary is that P 6 = NP. Namely, 9L 2 NP such that L / 2 P. Unfortunately, this is not enough as we assumed that our adversaries could use probabilistic polynomial-time algorithms. So we further assume that BPP 6 = NP. Is that su cient? We need that it be hard for an adversary to crack our systems most of the time. It is not su cient that our adversary can not crack the system once in a while. Assuming that BPP 6 = NP only means that there exists a language in L 2 NP such that every uniform adversary makes (with high probability) the wrong decision about infinitely many inputs x when deciding whether x 2 L. Although infinite in number, these wrong decisions may occur very infrequently (such as once for each input size).

We thus need yet a stronger assumption that will guarantee the following. There exists a language L 2 NP such that for every su ciently large input size n, every uniform adversary makes (with high probability) the wrong decision on many inputs x of length n when deciding whether x is in L. Moreover, we want it to be possible, for every input size n, to generate input x of length n such that with high probability every uniform adversary will make the wrong decision on x.

The assumption that will guarantee the above is the existence of (uniform) one-way functions (2.5). The assumption that would guarantee the above in the presence of non-uniform adversary is the existence of non-uniform one way functions.

Perfect secrecy and its limitation 2.3.1 Perfect secrecy

Intuitively, we imagine an adversary who knows the probability distribution over M; that is, the adversary knows the likelihood that di↵erent messages will be sent (as in the example given above). Then the adversary observes some cyphertext being sent by one party to the other. Ideally, observing this ciphertext should have no e↵ect on the knowledge of the adversary; in other words, the posteriori likelihood that some message m was sent (even given the cyphertext that was seen) should be no di↵erent from the a priori probability that m would be sent. This should hold for any m 2 M. Furthermore, this should hold even if the adversary has unbounded computational power. This means that a cyphertext reveals nothing about the underlying plaintext, and thus an adversary who intercepts a cyphertext learns absolutely nothing about the plaintext that was encrypted. Definition 2.3.1 (perfect secrecy) An encryption scheme (Gen, Enc, Dec) over a message space M is perfectly secret if for every probability distribution over M, every message m 2 M, and every cyphertext c 2 C for which Pr[C = c] > 0:

Pr[M = m|C = c] = Pr[M = m]
(2.1) (The requirement that Pr[C = c] > 0 is a technical one needed to prevent conditioning on a zeroprobability event.) Another way of interpreting Definition is that a scheme is perfectly secret if the distributions over messages and cyphertexts are independent.

One-time pad (Vernam's cipher)

In 1917, Vernam patented a cipher that obtains perfect secrecy. There was no proof of this fact at the time (there was not yet a notion of what perfect secrecy was). Instead, approximately 25 years later, Shannon [START_REF] Shannon | Communication theory of secrecy systems[END_REF] introduced the notion of perfect secrecy and demonstrated that the one-time pad (sometimes known as Vernam's cipher) achieves this level of security. Let a b denote the bitwise exclusive-or (XOR) of two binary strings a and b (i.e., if a = a 1 , . . . , a l and b = b 1 , . . . , b l then a b = a 1 b 1 , . . . , a l b l ). The one-time pad encryption scheme is defined as follows:

1. Fix an integer l > 0. Then the message space M, key space K, and cyphertext space C are all equal to {0, 1} l (i.e., the set of all binary strings of length l).

3. Encryption Enc works as follows: given a key k 2 {0, 1} l and a message m 2 {0, 1} l , outputs c := k m.

4. Decryption Dec works as follows: given a key k 2 {0, 1} l and a cyphertext c 2 {0, 1} l , outputs m := k c.

Before discussing the security of the one-time pad, we note that for every k and every m it holds that Dec k (Enc k (m)) = k k m = m and so the one-time pad constitutes a legal encryption scheme.

Theorem 2.3.2 The one-time pad is a perfectly-secret encryption scheme.

Proof: We work directly with the definition of perfect secrecy (Definition 2.3.1), though with our convention that all messages occur with non-zero probability. (For the one-time pad, this implies that all cyphertexts occur with non-zero probability.) Fix some distribution over M and arbitrary m 0 2 M and c 2 C. The key observation is that, for every m 2 M,

Pr[C = c|M = m] = Pr[M K = c|M = m] (2.2) = Pr[m K = c] = Pr[K = m c] = 2 l (2.3)
A simple calculation (using Bayes' theorem for the first equality) then gives

Pr[M = m 0 |C = c 0 ] = Pr[M = m 0 ^C = c 0 ] Pr[C = c] (2.4) = Pr[C = c 0 |M = m 0 ] • Pr[M = m 0 ] P m Pr[C = c|M = m] • Pr[M = m] (2.5) = 2 l • Pr[M = m 0 ] P m 2 l • Pr[M = m] (2.6) = Pr[M = m 0 ] P m Pr[M = m] = P r[M = m 0 ] (2.7)
as required by Definition 2.3.1. ⇤

Limitations of perfect secrecy

In the above section, we conclude that perfect secrecy is attainable with a one-time pad. However, the scheme has several drawbacks. Most prominent is that the key is required to be as long as the message. This limits the applicability of the scheme if we want to send very long messages (as it may be di cult to store a very long key securely) or if we don't know in advance an upper bound on how long the message will be (since we can't share a key of unbounded length). Moreover, as the name indicates, the one-time pad scheme is only "secure" if used once (with the same key).

Theorem 2.3.3 Let (Gen; Enc; Dec) be a perfectly-secret encryption scheme over a message space M, and let K be the key space as determined by Gen. Then |K| |M|.

Proof: We show that if |K| < |M| then the scheme is not perfectly secret. Assume |K| < |M|. Take the uniform distribution over M and let m 2 M be arbitrary. Let c be a cyphertext that corresponds to a possible encryption of m; i.e., there exists a

k 2 K such that Enc k (m) = c. (If
Enc is randomized, this means there is some non-zero probability that Enc k (m) outputs c.) By correctness, we know that Dec k (c) = m.

Consider the set M(c) of all possible message that corresponds to c; that is

M(c) = { m| m = Dec k(c) for some k 2 K} (2.8)
We know that m 2 M(c). Furthermore, |M(c)|  |K| since for each message m 2 M(c) we can identify at least one key k 2 K for which m = Dec k(c). This means there is some

m 0 2 M with m 0 6 = m such that m 0 / 2 M(c). But then Pr[M = m 0 |C = c] = 0 6 = Pr[M = m 0 ] (2.9) ⇤

A computational approach to cryptography

In previous sections, we presented cryptographic schemes that can be mathematically proven secure, even when the adversary has unlimited computational power. Such schemes are called informationtheoretically secure, or perfectly secure, because their security is because the adversary does not have enough "information" to succeed in its attack, regardless of the adversary's computational power. In particular, as we have discussed, the cyphertext in a perfectly-secret encryption scheme does not contain any information about the plaintext (assuming the key is unknown). Information-theoretic security stands in stark contrast to computational security that is the aim of most modern cryptographic constructions. Modern encryption schemes have the property that they can be broken given enough time and computation, and so they do not satisfy Definition 2.3.1. Nevertheless, under certain assumptions, the amount of computation needed to break these encryption schemes would take over many lifetimes to carry out even using the fastest available supercomputers. For all practical purposes, this level of security su ces.

Computational security is weaker than information-theoretic security. It also currently relies on assumptions (P 6 = NP) whereas no assumptions are needed to achieve the latter (as we have seen in the case of encryption). Even granting the fact that computational security su ces for all practical purposes, why do we give up on the idea of achieving perfect secrecy? The limitations of perfect secrecy give one reason why modern cryptography has taken this route. Thus, despite its mathematical appeal, it is necessary to compromise on perfect secrecy to obtain practical cryptographic schemes.

The basic idea behind computational security is to show that "a cipher must be practical, if not mathematically, indecipherable. It is su cient to use a scheme that cannot be broken in "reasonable time" with any reasonable probability of success. In Kerckho↵'s language, a scheme that is "practically indecipherable". Thus a computational approach incorporates two relaxations of the notion of perfect secrecy:

1. Security is only preserved against adversaries running an "e cient algorithm" in probabilistic polynomial time. We equate the notion of e cient algorithms" with (probabilistic) algorithms running in time polynomial in n, meaning that for some constants a, c the algorithm runs in time a • n c on security parameter n. We require that honest parties run in polynomial time and only be concerned with achieving security against polynomial-time adversaries. We stress that the adversary must run in polynomial time, maybe much more powerful (and run much longer) than the honest parties.

2. Adversaries can potentially succeed with some very small probability. We equate the notion of "small probability of success" with success probabilities smaller than any inverse-polynomial in n, meaning that for every constant c, the adversary's success probability is smaller than n c for large enough values of n (see Definition 2.4.1). A function that grows slower than any inverse polynomial is called negligible.

Definition 2.4.1 (Negligible function) A function f is negligible if for every polynomial p(•) there exist an N such that for all integers n > N it holds that f (n) < 1 p(n) . The above definition considers the success probability of an algorithm negligible if, as a function of the input length, the success probability is bounded by any polynomial fraction. It follows that repeating the algorithm polynomially (in the input length) often yields a new algorithm that also has a negligible success probability. In other words, events that occur with negligible (in n ) probability remain negligible even if the experiment is repeated or polynomially (in k ) many times. Hence, defining negligible success as "occurring with a probability smaller than any polynomial fraction" is naturally coupled with defining feasible as "computed within polynomial time."

We can now define computational security:

Definition 2.4.2 (Computational security) Let (Enc, Dec) be an encryption scheme that uses n-bit keys k to encrypt l(n)-length message. Then, (Enc, Dec) is computationally secure if for every probabilistic polynomial time algorithm

A : {0, 1} ⇤ ! {0, 1}, polynomially bounded ✏ : {0, 1} ⇤ ! [0, 1], n, and m 0 , m 1 2 {0, 1} l(n) , | Pr[A(Enc k (m 0 ) = 1) Pr[A(Enc k (m 1 ) = 1)]| < ✏(n) (2.10)

One-way and trapdoor functions

As modern cryptography is based on a gap between e cient algorithms for encryption for the legitimate users versus the computational in-feasibility of decryption for the adversary, it requires that one have available primitives with certain special kinds of computational hardness properties. Of these, perhaps the most basic is a one-way function.

One-way functions

One Way functions, namely functions that are "easy" to compute and "hard" to invert, are an extremely important cryptographic primitive. Probably the best known and simplest use of one-way functions is for passwords. Namely, in a time-shared computer system, instead of storing a table of login passwords, one can store, for each password w, the value f (w). Passwords can easily be checked for correctness at login, but even the system administrator can not deduce any user's password by examining the stored table.

Definition 2.5.1 (One-way function) A function f : {0, 1} ⇤ ! {0, 1} ⇤ is one-way if:

1. there exists a probabilistic polynomial time (PPT) that on input x outputs f (x);

2. For every PPT algorithm A there is a negligible function ⌫ A such that for su ciently large k,

Pr h f (z) = y : x $ {0, 1} k ; y f (x); z A 1 k , y i  ⌫ A (k) (2.11)
Few remarks on the definition:

1. The definition suggests that an adversary is not unable to invert the function, but has a low probability of doing so, where the probability distribution is taken over the input x to the oneway function where x if of length k, and the possible coin tosses of the adversary. Namely, x is chosen at random and y is set to f (x).

2. The adversary is not asked to find x; that would be pretty near impossible. It is asked to find some inverse of y. Naturally, if the function is 1-1 then the only inverse is x.

3. Note that the adversary algorithm takes as input f (x) and the security parameter 1 k (expressed in unary notation) which corresponds to the binary length of x. This represents the fact that the adversary can work in time polynomial in |x|, even if f (x) happens to be much shorter. This rules out the possibility that a function is considered one-way merely because the inverting algorithm does not have enough time to print the output. Consider for example the function defined as f (x) = y where y is the log k least significant bits of x where |x| = k. since the |f (x)| = log |x| no algorithm can invert f in time polynomial in |f (x)|, yet there exists an obvious algorithm which finds an inverse of f (x) in time polynomial in |x|. Note that in the special case of length preserving functions f (i.e., |f (x)| = |x| for all x 's), the auxiliary input is redundant.

Trapdoor functions

Informally, a trapdoor function f is a one-way function with an extra property. There also exists a secret inverse function (the trapdoor) that allows its possessor to e ciently invert f at any point in the domain of his choosing. It should be easy to compute f on any point but infeasible to invert f on any point without knowledge of the inverse function. Moreover, it should be easy to generate matched pairs of f 's and corresponding trapdoor. Once a matched pair is generated, the publication of f should not reveal how to compute its inverse on any point.

Definition 2.5.2 (Trapdoor one-way function) A trapdoor function is a one-way function f : {0, 1} ⇤ ! {0, 1} ⇤ such that there exists a polynomial p and a probabilistic polynomial time algorithm I such the for every k there exists an

t k 2 {0, 1} ⇤ such that |t k |  p(k) and for all x 2 {0, 1}, I (f (x), t k ) = y such that f (y) = f (x).
An example of a function which may be trapdoor if factoring integers is hard was proposed by Rabin [170]. Let f (x, n) = x 2 mod n where n = pq a product of two primes and x 2 Z ⇤ n . Rabin[170] has shown that inverting f is easy i↵ factoring composite numbers product of two primes is easy.

The most famous candidate trapdoor function is the RSA[176] function. Let N = pq be a product of two primes. It is believed that such an N is hard to factor. The function is f (x) = x e mod N where e is relatively prime to (p 1)(q 1). The trapdoor is the primes p, q, knowledge, which allows one to invert f e ciently. The function f seems to be one-way. To date, the best attack is to try to factor N, which seems computationally infeasible.

Block ciphers

Block ciphers are the central tool in designing protocols for shared-key cryptography (aka. symmetric) cryptography. They are the leading available "technology" we have at our disposal.

A block cipher is a function E : {0, 1} k ⇥ {0, 1} n ! {0, 1} n . This notation means that E takes two inputs: a k-bit string and the other an n-bit string, and returns an n-bit string. The first input is the key. The second might be called the plaintext, and the output might be called a cyphertext. The key-length k and the block-length n are parameters associated with the block cipher. They vary from block cipher to block cipher, as of course does the design of the algorithm itself.

For each key K 2 {0, 1} k we let E K : {0, 1} n ! {0, 1} n be the function defined by E K (M ) = E(K; M ). For any block cipher, and any key K, it is required that the function E K be a permutation on {0, 1} n . This means that it is a bijection (ie., a one-to-one and onto function) of {0,

1} n to {0, 1} n . (For every C 2 {0, 1} n there is exactly one M 2 {0, 1} n such that E K (M ) = C.)
Accordingly E K has an inverse, and we denote it E 1 K . This function also maps {0, 1} n ! {0, 1} n , and of course we have

E 1 K (E K (M )) = M and E K (E 1 K (C)) = C for all M, C 2 {0, 1} n . We let E 1 : {0, 1} k ⇥ {0, 1} n ! {0, 1} n be defined by E 1 (K, C) = E 1 K (C)
. This is the inverse block cipher to E.

The block cipher E is a public and fully specified algorithm. Both the cipher E and its inverse E 1 should be easily computable, meaning given K, M we can readily compute E(K, M ), and given K, C we can readily compute E 1 (K, C). By "readily compute," we mean that there are public and relatively e cient programs available for these tasks.

A random key K is chosen in typical usage and kept secret between a pair of users. The function E K is then used by the two parties to process data in some way before they send it to each other. Typically, we will assume the adversary will be able to obtain some input-output examples for E K , meaning pairs of the form (M, C) where C = E K (M ). However, ordinarily, the adversary will not be shown the key K. Security relies on the key's secrecy. So, as a first cut, one might think of the adversary's goal as recovering the key K given some input-output examples of E K . The block cipher should be designed to make this task computationally tricky. ( A more refined view is that the adversary's goal is key-recovery, seeing that security against key-recovery is a necessary but not su cient condition for the security of a block cipher.)

Data encryption standards

The Data Encryption Standard, or DES, is one of the most important examples of a Feistel cryptosystem. DES was the result of a contest set by the U.S. National Bureau of Standards (now called the NIST) in 1973 and adopted as a standard for unclassified applications in 1977. The winning standard was developed at IBM as a modification of the previous system called LUCIFER. The DES is widely used for the encryption of PINs, bank transactions, and the like. DES is also specified as an Australian banking standard. The DES is an example of a Feistel cipher, which operates on blocks of 64 bits at a time, with an input key of 64 bits. Every 8th bit in the input key is a parity check bit, which means that the key size is e↵ectively reduced to 56 bits.

Product ciphers and Feistel ciphers

As a precursor to the description of DES, we make the following definitions, which describe various aspects of the constructions, specific properties, and design components of DES.

A product cipher is a composite of two or more elementary ciphers to produce a more secure cipher than any individual components. A substitution-permutation network is a product cipher composed of stages, each involving substitutions and permutations, in which the blocks can be partitioned into smaller blocks for substitutions and recombined with permutations. An iterated block cipher is a block cipher involving the repetition of an internal round function, which may involve a key as input. Each of the sequential steps is termed a "round."

We now describe in more detail an example of an iterated block cipher, called a Feistel cipher. In a Feistel the input block is of even length 2t, of the form L 0 R 0 , and outputs cyphertext of the form R r L r . For each i such that 1  i  r, the round map takes

L i 1 R i 1 to L i R i , where L i = R i 1 and R i = L i 1 f K i (R i 1 )
, where f Ki is a cipher which depends only on an input subkey K i , which is derived from the cipher key K.

The flow of the Feistel cipher therefore looks something like: We can eliminate the L i by defining R 1 = L 0 , so that the input is R 1 R 0 , and the round operations are of the form

R i = R i 2 f K i (R i 1
), in which case the flow diagram looks like: The final output of the Feistel cipher is the inverted pair R r L r = R r R r 1 , which allows the Feistel cipher to be inverted by running through the same algorithm with the key sequence reversed.

The DES is a 16-round Feistel cipher, preceded and followed by an initial permutation IP and its inverse IP 1 . That is, we start with a message M , and take L 0 R 0 = IP (M ) as input to the Feistel cipher, with output IP 1 (R 16 L 16 ). The 64-bits of the key are used to generate 16 internal keys, each of 48 bits. The round function's steps f K is given by the following sequence, taking on 32-bit strings, expanding them to 48-bit strings, and applying a 48-bit block function.

Apply a fixed expansion permutation E -this function is a permutation of 32 bits with repetition

to generate a 48-block E(R i ).

2. Compute the bit sum of E(R i ) with the 48-bit key K i , and write this as 8 blocks B 1 , . . . , B 8 of 6 bits each. The Rijndael cryptosystem operates on 128-bit blocks, arranged as 4 ⇥ 4 matrices with 8-bit entries. The algorithm consists of multiple iterations of a round cipher, each of which is the composition of the following four basic steps:

1. ByteSub transformation. This step is a nonlinear substitution, given by a S-box (Figure 2.1), designed to resist linear and di↵erential cryptanalysis.

2. ShiftRow transformation. Provides a linear mixing for di↵usion of plaintext bits.

3. MixColumn transformation. Provides a similar as in the ShiftRow step.

4. AddRoundKey transformation. Bitwise XOR with the round key.

The Advanced Encryption Standards allows Rhijndael key lengths 128, 192, or 256 bits. The eight-bit byte blocks which form the matrix entries are interpreted as elements of the finite field 2 8 = 256 elements. The finite field is represented by the quotient ring

F 2 8 = F 2 [X]/(X 8 + X 4 + X 3 + X + 1), (2.12)
whose elements are polynomials c 7 X 7

+ c 6 X 6 + c 5 X 5 + c 4 X 4 + c 3 X 3 + c 2 X 2 + c 1 X + c 0 .

Limitations of computational security

The computational model for security is based on unproven intractability results. Thus it is not possible to state unconditional security results for the most ciphers used in our days. Computers and algorithms improve over time and so does the ability of an adversary to break cryptographic complexity assumptions and protocols. It may be feasible to make a good estimate as to which computational problems are hard today, and which encryption schemes unbroken. But it is very di cult to make more than an educated guess as to which cryptographic schemes will be secure, say, ten years from now. Key length recommendations can only be made based on the assumption that progress continues at a similar rate as today; unexpected algorithmic progress and future technologies like quantum computers can render even the most paranoid choices for the key length obsolete. This situation is very problematic if we wish to run cryptographic protocols on highly sensitive data such as medical or financial data or government secrets. Such data often has to stay confidential for many decades. But an adversary might intercept messages from a protocol that is secure today, store them, and some decades later, when the underlying cryptosystems have been broken, decrypt them. For highly sensitive data, this would not be an acceptable risk.

Shor's algorithm, exploring the power of quantum computing, enables theoretically to factor integers in a reasonable time that is proportional to their logarithm. It is thus a factorization in a linear time as a function of the number of key bits. This could be detrimental to all public keybased cryptography. In 2019, Google researchers published an algorithm allowing to quickly break an RSA key (of 2048 bits) and with "only" 20 million qubits having an error rate of 0.1% and in a calculation carried out in 8 hours.

Shor's algorithm applied to RSA public key breaking could however have quite a negative impact on most Internet use cases. It is indeed integrated in the TLS and SSL protocols that protect websites and file transfers via HTTPS and FTP, in the IPSEC protocol that protects IP V4 in the IKE sub-protocol, in the SSH protocol for machines remote access and in the PGP protocol that is sometimes used to encrypt emails. RSA and derivatives are also used in many HSM (Hardware Security Modules) such as in cars ECU (Electronic Central Units).

The threat also concerns software electronic signatures and therefore their automatic updates, VPNs used for remote access to protected corporate networks, email security with S/MIME, various online payment systems, DSA (Digital Signature Algorithm, an electronic signature protocol), Di e-Hellman codes (used for sending symmetrical keys) as well as ECDH, ECDSA and 3-DES elliptic curve cryptography. The Signal protocol used in Whatsapp would also be in the spotlight. So a lot of Internet security is more or less in the line of sight.

Information-theoretic security

One way out from the limitation of computational security is to use protocols with unconditional (information-theoretical) security. Information-theoretic provides a proper definition of security because nothing is assumed on the computational capacity of the eavesdropper. It also allows for precise security results to be stated. This section presented an overview of Information-Theoretic Security, stating some of the most famous results related to this subject.

Shannon's model for perfect secrecy

I(M ; C) = 0 (2.13)
i.e., Eve gains no knowledge about M by knowing C. Notice that in this definition of a secure cipher system, no assumption about the enemy's computational power is made, making the informationtheoretic security more desirable in cryptography than computational security.

Wiretap Channel

One of the features in Shannon's model that leads to his pessimistic result is the fact that he assumes that the enemy Eve has perfect access to the cryptogram C, i.e., it is assumed that the channel from Alice to Eve has the same capacity as the channel from Alice to Bob. Therefore, the key to guaranteeing perfect secrecy is to modify Shannon's model such that the enemy has not the same information as the legitimate receiver. Wyner [START_REF] Wyner | The wire-tap channel[END_REF] and later Csisźar and Körner [START_REF] Csiszár | Broadcast channels with confidential messages[END_REF] proposed a new model, called the wiretap channel.

In this model, the legitimate users communicate over the main channel, and an eavesdropper has access to the messages received by the legitimate receiver over a wiretap channel. The general setup for this model is shown in Figure 2.3.

Using public discussion to establish a perfect secret key

More recently, Maurer [START_REF] Maurer | Secret key agreement by public discussion from common information[END_REF] made a breakthrough by developing a new model and proving that, for wiretap channel model, a strictly positive secrecy capacity is possible, even if Eve's channel is stronger than the legitimate users' channel. Maurer's model's main feature is that an insecure public channel (yet authenticated) is used to generate a secret key.

First, we define the model without the public channel and state Maurer's definition for secrecy capacity. An illustration of this model is in Figure 2.4. Definition 2.6.1 The broadcast channel of interest in the following is defined as:

• the source is the sequence {S i } 1 i=1 , where S i is a binary random variable, 8i; • the main channel has a finite input alphabet X and a finite output alphabet Y;

• the wiretap channel has the same input as the main channel, and a finite output alphabet Z;

• the channel behavior is completely specified by the conditional probability distribution P (Y = y, Z = z|X = x), which we refer to as P Y Z|X ;

• the encoder is a (possibly probabilistic) function e : {0, 1} k ! X n , where R is the rate and

k = [nR]; the decoder is a function d : Y n ! {0, 1} k .
Definition 2.6.2 The secrecy capacity of a broadcast channel specified by P Y Z|X is the maximum rate R for which, for every ✏ > 0, for all su ciently large n, there exists an encoder-decoder such that for S uniformly distributed over {0, 1} k the following two conditions are satisfied:

• P(d(Y ) 6 = S) < ✏, where X = e(S); Maurer also noticed that, in the previous definition, it would be equivalent the two conditions to hold for all probability distributions. Now, consider a broadcast channel for which both the main and the wiretap channel are independent binary symmetric channels, i.e.

• 1 k H(S|Z n ) > 1 ✏.
P Y Z|X = P Y |X P Z|X (2.14) P Y |X (y|x) = ( 1 ✏, if x = y ✏, if x 6 = y (2.15)
and

P Z|X (z|x) = ( 1 , if x = z , if x 6 = z (2.16)
Without loss of generality, consider the case ✏  1/2,  1/2. Denote this channel by D(✏, ).

The next result characterizes the secrecy capacity for this channel. It shows that, as expected, the secrecy capacity for this channel is only strictly positive if the legitimate user's channel is better than Eve's channel.

Lemma 2.6.1 The secrecy capacity of the binary broadcast channel D(✏, ) is given by:

C S (D(✏, )) = ( h( ) h(✏), if > ✏ 0, otherwise , (2.17)
where, h(p) is the binary entropy function, i.e., h(p) = p log(p) (1 p) log(1 p).

To overcome the need for legitimate users over the eavesdropper, Maurer introduced a public channel, insecure but with unconditional secure authentication. Moreover, it is assumed that Eve can listen to the communication over the public channel but cannot perform an identity spoofing attack. For an illustration of this model, see Figure 2.5 Definition 2.6.3 The secrecy capacity with public discussion denoted Ĉ(P Y Z|Z ), is the secrecy capacity of the broadcast channel defined in Definition 2.6.1, with the additional feature that Alice and Bob can communicate over an insecure (yet authenticated) public channel. The next theorem characterizes the secrecy capacity with public discussion, showing that even if the eavesdropper has a better channel than the legitimate users, perfect secure communication can still be performed.

Theorem 2.6.4 The secrecy capacity with public discussion of a broadcast channel is given by

Ĉ(D(✏, )) = h(✏ + 2✏ ) h(✏) (2.18)
Moreover, Ĉ(D(✏, )) is stricly positive unless ✏ = 0.5, = 0 or = 1, i.e. unless X and Y are statistically independent or Z uniquely determines X Proof: To sketch the proof of the above theorem , the idea is to construct a conceptual broadcast channel similar to the broadcast channel of Wyner [START_REF] Wyner | The wire-tap channel[END_REF], such that the conceptual main channel is equivalent to the real main channel between Alice and Bob, and the conceptual wiretap channel is a cascade of the real main channel and the real wiretap channel. Alice sends a random bit X over the real broadcast channel, with P(X = 0) = P(X = 1) = 1/2. Let E and D denote the (independent) error bits of the main and of Eve's channel, respectively, i.e. let Y = X + E and Z = X + D where P(E = 1) = ✏ and P(D = 1) = . Bob chooses a bit V and sends W = Y + V over the public channel. Alice computes

W + X = V + E,
thus Alice receives V with error probability ✏. Eve knows Z = X + D and W = X + E + V , and can compute

Z + W = V + E + D.
In fact, it is easy to prove that

H(V |ZW ) = H(V |Z + W ),
thus Eve can indeed compute Z + W and discard Z and W . Now, it is easy to prove that the conceptual broadcast channel can be seen as D(✏, ✏ + 2✏ ). ⇤

Key establishment from correlated classical data

In this section we study the broadcast channel's use with a public channel to develop unconditional secure secret key agreement protocols. Throughout this thesis, we are interested in the setting where, at the end of any key establishment protocol, interactive parties hold only correlated classical data, i.e., a setting where secret keys can be established from correlated classical information.

The problem of generating a shared secret key using correlated classical data over a public discussion was considered in [Mau93a, [START_REF] Maurer | Information-theoretic key agreement: From weak to strong secrecy for free[END_REF][START_REF] Maurer | Unconditionally secure key agreement and the intrinsic conditional information[END_REF], where two authorized and trusted parties Alice (sender) and Bob (receiver), interact over an insecure communication channel to exchange secret keys S, about which an unauthorized party Eve does not gain any useful information.

General setting

We briefly describe the general setting as considered in [START_REF] Maurer | Secret key agreement by public discussion from common information[END_REF]. The setting assumes Alice, Bob, and Eve know random variables X 2 X , Y 2 Y, and Z 2 Z, respectively, distributed according to the joint probability distribution P XY Z , and that Eve has no information about X and Y other than through her knowledge of Z. Alice and Bob share no secret key initially (other than possibly a short key required for authenticating the public classical channel) but are assumed to know P XY Z or at least an upper bound on the quality of Eve's channel.

The protocol and the codes used by Alice and Bob are known to Eve. Every message communicated between Alice and Bob can be intercepted by Eve, i.e., Eve's tapping channel is assumed to have full access to the input of Alice and Bob's main channel, but it is assumed that Eve cannot insert fraudulent messages nor modify messages on this public channel without being detected.

Alice and Bob use a protocol in which at each odd step Alice sends a message {C 1 , C 3 , . . . , C n 1 } to Bob depending on X and at each even step Bob sends a message {C 2 , C 4 , . . . , C n } depending on Y . After n steps in the protocol Alice computes a secret key S A as a function of X and C n = [C 1 , . . . , C n ] Bob computes a secret key S B as a function of Y and C n . Their goal is to maximize the H(S) under the conditions that S A and S B agree with very high probability and that Eve has very little information about either S A or S B .

The goal of an adversary Eve is to gain as much information as possible on the output keys of Alice and Bob without being detected using the classical random variable Z n and C n .

Security definition

Definition 2.6.5 A secret key agreement protocol as described above is (✏, )-secure if, for some specified (small) ✏ and , the following conditions hold:

1. For odd i, H(C i |C i 1 X) = 0; 2. For even i, H(C i |C i 1 Y ) = 0; 3. H(S|C t X) = 0; 4. H(S 0 |C t Y ) = 0; 5. P(S 6 = S 0 )  ✏; 6. I(S; C t Z)  .
Conditions 1-4 guarantee that Alice and Bob have no uncertainty regarding the protocol procedures. Condition 5 guarantees that Alice and Bob agree on the same key with probability 1 ✏. Finally, condition 6 guarantees that, given that Eve knows all the messages exchanged between Alice and Bob over the public channel during the protocol and the output of her channel, the key that Eve has is upper bounded by .

The next theorem provides an upper bound on the key's size that Alice and Bob agree via a (✏, )-secure key agreement protocol. Theorem 2.6.6 For every (✏, )-secure key agreement protocol, we have that

H(S)  min[I(X; Y ), I(X; Y |Z)] + |h(✏) + ✏ log(|S| 1) (2.19)
To be able to provide a lower bound on the key size we need to make further assumptions. Consider the case when Alice, Bob and Eve receive

X N = [X 1 , . . . , X N ], Y N = [Y 1 , . . . , Y N ] and Z N = [Z 1 , . . . , Z N ], where P X N Y N Z N = ⇧ n i=1 P X i Y i Z i .
Next, we define the secret key rate, a quantity of interest in the rest of this section.

Definition 2.6.7 The secret key rate of X and Y with respect to Z, denoted S(X; Y ||Z), is the maximum rate R such that, for every ✏ > 0, there exists a protocol, for su ciently large n, satisfying conditions 1-5 in Definition 2.6.5 (with X and Y replaced by X n and Y n , respectively) and also the two following conditions: The upper bound for the secret key rate in the previous theorem shows that if Eve has less information about Y than Alice or less information about X than Bob, then such a di↵erence of information can be exploited.

• 1 n I(S; C t Z n )  ✏ • 1 n H(S)
The next theorem provides bounds on the secrecy capacity with public discussion of a general broadcast channel.

Theorem 2.6.9 The secret capacity with public discussion, ĈS (P Y Z|X ), of a broadcast channel specified by P Y Z|X verifies

ĈS (P Y Z|X )  min[max P X I(X; Y ), max P X I(X; Y |Z)]
(2.20)

The lower bounds on the secret key rate for key establishment using classical correlated data, in the asymptotic limit (n ! 1) is defined by Csiszár and Körner [START_REF] Csiszár | Broadcast channels with confidential messages[END_REF] as Chapter 3

R I(X; Y ) I(X; Z) (2.21) Which, from the relation I(X; Y ) = H(X) H(X|Y ), I(X; Z) = H(X) H(X|Z), and
H(•) H min (•) is, R H min (X|Z) H(X|Y ) (2.22)

Quantum Cryptography

The present chapter aims to provide an overview of the most important and most recent advances in quantum cryptography, both theoretically and experimentally. After a brief introduction of the general notions, we will review the main QKD protocols based on discrete-and continuous-variable systems. We will consider standard QKD, device-independent, and measurement-device independent QKD. We will then discuss the ultimate limits of point-to-point private communications and how quantum repeaters and networks may overcome these restrictions. Finally, we will treat topics beyond QKD, including Twin-Field QKD, Flood Light QKD, and Quantum Data Locking. There a number of reviews and books on QKD (e.g., see Refs.[NCC00, Hol12, BZ07, Hay16, Wat18, WPGP + 12, PAB + 20b] ). Some of the concepts are repeated in this review, but we generally assume basic knowledge of these systems.

Generic aspects of a QKD protocol

Any QKD protocol, be it based on discrete or continuous variables, can be divided into two-step: quantum communication followed by classical post-processing. During quantum communication, the sender (Alice) encodes a random classical variable X into non-orthogonal quantum states. These states are sent over a quantum channel (optical fiber, free-space link) controlled by the eavesdropper (Eve), trying to steal the encoded information. Leveraging on the fundamentals like uncertainty principle [START_REF] Nielsen | Cambridge Series on Information and the Natural Sciences[END_REF] and no-cloning theorem [START_REF] Wootters | A single quantum cannot be cloned[END_REF], quantum mechanics forbids perfect cloning Eve can only get partial information while disturbing the quantum signals. At the communication channel's output, the receiver (Bob) measures the incoming signals and obtains a random classical variable Y . After several channels, Alice and Bob share raw data described by two correlated variables X and Y .

The raw data generated at the end of the quantum communication step is then post-processed to transform into a pair of the secret key. First, the remote parties use part of the raw data to estimate the parameters of the channel, such as its transmissivity and noise. This stage of parameter estimation is essential to evaluate the amount of post-processing to extract a private shared key from the remaining data. Depending on this information, they perform a stage of error correction, which allows them to detect and eliminate errors, followed by a privacy amplification stage that allows them to reduce Eve's stolen information to a negligible amount. The final result is the secret key.

Sometimes QKD protocols are formulated in entanglement-based representation. This means that Alice' preparation of the input ensemble of states is replaced by an entangled state AB part 59 of which is measured by Alice. The measurement on part A a↵ects to prepare a state on part B conditionally. The outcome of the measurement is one-to-one with the classical variable encoded in the prepared states. This representation is beneficial for the study of QKD protocols so that their prepare and measure formulation is replaced by an entanglement-based formulation for assessing the security and deriving the secret key rate.

3.2 Overview of DV-QKD protocol 3.2.1 BB84 Figure 3.1: Schematic implementation of BB84 using polarization states. Alice's side comprises a photon source (Source) and a polarization modulator (PM), although she could combine the output of four di↵erent sources, each with a di↵erent polarization. As the photon enters Bob's station, it goes first inside a waveplate (WP), which corrects polarization changes due to the fiber. The beam splitter (BS) passively branches the photon to one of the two possible measurement bases. One of the outputs goes inside a half waveplate (HWP) to rotate the polarization by 45 . The polarizing beam splitters (PBS) select the photons based on their polarization state. The photon detectors (SPD) are associated with either the value "0" or with the value "1".

In BB84 protocol [START_REF] Bennett | Quantum cryptography: Public key distribution and coin tossing[END_REF] Alice (the transmitter) prepares the qubits, i.e., two-level quantum system, by encoding a classical variable with respect to one of two di↵erent orthogonal bases, called the rectilinear (|0i, |1i: Z Basis) and the diagonal basis (|+i, | i: X Basis). These two bases are mutually unbiased; that is, a measurement in one of the bases reveals no information on a bit encoded with respect to the other basis. The states prepared by Alice are sent to Bob (the receiver) using the quantum channel, who measures them in one of the two bases Z or X, selected at random. They repeat this procedure over n quantum channel use and obtain a pair of classical bit strings X = (X 1 , . . . , X n ) at Alice's end, and Y = (Y 1 , . . . , Y n ) at Bob's.

The remaining part of the protocol is purely classical (in particular, Alice and Bob only communicate classically). First, Alice and Bob apply a sifting step, where they announce their choices of bases used for the encoding and the measurement, respectively. They discard all bits of their raw key for which the encoding and measurement bases are not compatible. Then Alice and Bob proceed with a parameter estimation step. They compare some (small) randomly chosen set of bits of their raw key in order to get a guess for the error rate, i.e., the fraction of positions i in which X i and Y i disagree. If the errors detected are above some threshold, this indicates an eavesdropper on the quantum channel, resulting in the abortion of the protocol.

Let X 0 and Y 0 be the remaining parts of the raw keys (i.e., the bits of X and Y that have neither been discarded in the sifting step nor used for parameter estimation). These strings are now used for the actual computation of the final key. In an information reconciliation step, Alice sends certain error-correcting information on X 0 to Bob. This, together with Y 0 , allows him to compute a guess for X 0 . In the final step of the protocol, called privacy amplification, Alice and Bob use two-universal hashing to turn the (generally only partially secret) string X 0 into a shorter but secure key.

The security of the BB84 protocol is based on the fact that an adversary, ignorant of the actual encoding bases used by Alice, cannot gain information about the encoded bits without disturbing the qubits sent over the quantum channel. If the disturbance is too large, Alice and Bob will observe a high error rate and abort the parameter estimation step protocol. On the other hand, if the disturbance is below a certain threshold, then the strings X 0 and Y 0 held by Alice and Bob are su ciently correlated and secret in order to distill a secret key.

In order to prove security, one thus needs to quantify the amount of information that an adversary has on the raw key, given the disturbance measured by Alice and Bob. A general attack strategy an eavesdropper can consider is to attach an ancilla, |Ei (a quantum system possibly higher dimension than a qubit) to Alice's qubit and let them interact in the hope of deriving some information. This interaction can be written as

U |ai|Ei = p F a |ai|E aa i + p D a |a ? i|E aa ? i (3.1)
Where |ai 2 {|0i, |1i, |+i, | i and ha|a ? i = 0, with |E ij i being Eve's possible ancillary states after the interaction. This equation mean that when Alice sends a state |ai, Bob has a probability F a of getting the right result when measuring in the correct basis and D a otherwise. Unitarity of U ensures

hE aa |E aa i = F a (3.2) hE aa ? |E aa ? i = D a (3.3) hE aa |E aa ? i = 0 (3.4)
implying the bit error rate

e b = D a = 1 cos x 2 cos x + cos y (3.5)
with x and y real numbers. This is the essence of a symmetric attack [86] which can be seen as a contraction of the Bloch sphere by F a D a .

Assume that Eve keeps her ancillary system in a quantum memory and waits for Alice and Bob to end all the classical communication related with the reconciliation of the bases (sifting). In this way she can distinguish between her ancillary states given by |E aa i and |E a ? a ? i. Then assume that she can also perform a joint measurement on her entire quantum memory, a scenario known as 'collective attack'. In such a case, Eve's amount of information is upper bounded by the Holevo information

= S(⇢ E ) S[⇢ E (a)] + S[⇢ E (a ?
)] 2

(3.6)
where, S(•) is the von Neumann entropy, and ⇢ E (a)(⇢ E (a ?

)) is Eve's state for Alice's |ai(|a ? i). In the presence of the symmetric collective attack, it can be shown that the key rate is then given by,

K BB84 = 1 S(⇢ E ) = 1 2H 2 (e b ) (3.7)
where the binary Shannon entropy H 2 is computed over bit error rate e b . As a result, a key can be extracted for an error rate with a value no greater than approximately 11%. This security threshold value of 11% is exactly the same as the one that is found by assuming the most general 'coherent attack' against the protocol, where all the signal states undergo a joint unitary interaction together with Eve's ancillae, and the latter are jointly measured at the end of protocol.

Six state protocol

The BB84 protocol has also been extended to use six states on three bases to enhance the key generation rate, and the tolerance to noise [START_REF] Bruß | Optimal eavesdropping in quantum cryptography with six states[END_REF]. 6-state BB84 is identical to BB84 except, as its name implies, rather than using two or four states, it uses six states on three bases X, Y, and Z. This creates an obstacle to the eavesdropper who has to guess the right basis from among three possibilities rather than just two of the BB84. This extra choice causes the eavesdropper to produce a higher rate of error, for example, 1/3 when attacking all qubits with a simple IR strategy, thus becoming more comfortable to detect. One can extend the analysis of Eve's symmetric collective attack to the 6-state BB84 by considering a third basis, which immediately sets a further constraint on Eve's ancillary state. the new error rate is then

e b = 1 cos x 2 cos x (3.8)
with x a real number, as noted in [START_REF] Bechmann-Pasquinucci | Eavesdropping without quantum memory[END_REF]. Assuming a symmetric collective attack, a similar calculation to the one for BB84 gives the following secret key rate for the 6-state protocol as

K 6 state = 1 + 3e b 2 log 2 e b 2 + ⇣ 1 3e b 2 ⌘ log 2 ⇣ 1 3e b 2 ⌘ = 1 H 2 ⇣ 3 2 e b ⌘ 3 2 e b log 2 (3) (3.9)
This rate exactly coincides with the unconditional key rate, proven against coherent attacks, and gives a security threshold value of about 12.6% slightly improving that of the BB84 protocol.

High-dimensional QKD

Discrete variable (DV) QKD schemes encode quantum states in qubits (d = 2). However, there has been considerable interest in developing large-alphabet DV QKD schemes that encode photons into qudits: high-dimensional basis states with d > 2. This may be intuitively understood from the fact that the presence of an optimal cloning attack leads to larger signal disturbance in higherdimensional QKD schemes. The BB84 protocol may be extended here by using qudits. The adoption of high-dimensional quantum system has two distinct benefits: (i) such schemes o↵er the ability to encode multiple log 2 (d) bits of information in each photon, i.e., an increase of the error-free key rate per sifted photons to a value of K = log 2 (d); (ii) an increase in the maximum tolerable error rate, i.e., the error threshold for K = 0. For the simple case of d-dimensional BB84 protocol, the secret key rate is given by [BHE + 18],

K (d) BB84 = log 2 (d) 2H (d) (e b ) (3.10)
where,

H (d) (x) := x log 2 (x/(d 1)) (1 x) log 2 (1 x) is the d-dimensional Shannon entropy [SS10]
. Furthermore, it is also possible to extend the six-state protocol to higher dimensions by employing all (d + 1) mutually unbiased bases, assuming that d is a power of a prime, where the secret key rate is given by,

K (d) 6 state = log 2 (d) h (d) ⇣ e b d + 1 d ⌘ d + 1 d e b log 2 (d + 1) (3.11)

Practical imperfection and countermeasure PNS attack

DV-QKD protocols are ideally defined on qubits (or qudits), single photons carrying one (or log d) bits of information. However, in practice, perfect single-photon sources are generally not available, and there is some probability for a source to emit multiple photons with identical encodings in a given run of the QKD protocol. This can be a security vulnerability to an eavesdropper who employs the photon number splitting (PNS) attack [HIGM95, L 00]. The essential idea behind the attack is that Eve can perform a quantum non-demolition measurement to determine the number of photons in a run, and when it is greater than 1, she could steal one of the excess photons while forwarding the others to Bob. In this way, Bob would not detect her presence while she lies in wait for Alice's basis revelation to make sharp measurements of the stolen photons and obtain perfect information of the multi-photon runs.

Countermeasure: Decoy states, SARG04

The need to counter the PNS attack triggered the invention of the decoy-state protocol [Hwa03, Wan05a, Wan05b, LMC05, MQZL05], which allows e cient distillation of secure keys using weak coherent pulse-based QKD systems that once were vulnerable. In decoy-state-based QKD, the average number of photons transmitted is increased during random timeslots, allowing Alice and Bob to detect if Eve is stealing photons when multiple photons are transmitted.

To mitigate a PNS attack, the SARG04 protocol [SARG04] modifies the sifting process. Instead of directly revealing bases, Alice and Bob publicly announce one of the four pairs of non-orthogonal states consisting of {[0i, |+i}, {|0i, | i}, {|1i, |+i}, and {|1i, | i}. The protocol works as follows: First, Alice chooses one of the four pairs and one of the two states in the pair and transmits it to Bob. Then, Bob performs a measurement with two bases {|0i, |1i} or {|+i, | i}. After that, sifting is performed for unambiguous discrimination between states in an announced pair. For example, assume Alice transmits |0i state in a set {|0i, |+i} and Bob measures it with a basis {|1i, | i}. If Bob measures |+i state, then it is discarded since it can be from |0i or |+i. If Bob measures | i state, it is stored for post-processing because it can only be from the |0i state. Since two states in a set are non-orthogonal, the PNS attack cannot provide Eve with perfect information on the encoded bit.

Overview of CV-QKD

The idea of continuous-variable QKD is to exploit coherent quantum communication. The main consequence of this choice is that CV-QKD and DV-QKD involve di↵erent measurement stages: homodyne (or heterodyne) for continuous-variable protocols instead of photon counting techniques discrete-variable protocols. One of CV-QKD's appealing feature is to rely on components (such as PIN photodiodes), that are identical, or very close to standard telecom components and are much more mature from a technological point of view than single-photon detectors.

A seminal result in QKD using continuous variables was the discovery that coherent states are su cient to distribute secret keys [START_REF] Grosshans | Continuous variable quantum cryptography using coherent states[END_REF][START_REF] Grosshans | Quantum cloning and teleportation criteria for continuous quantum variables[END_REF]. Because coherent states are much easier to generate in the lab than any other Gaussian state, this result opened the door to experimental demonstrations and field implementations [HHL + 15]. Here, in this section, we propose a general presentation of continuous-variable protocols.

Continuous variable systems

CV quantum systems are described by an infinite-dimensional Hilbert space. Consider a quantum system made of n bosonic modes of the electromagnetic field with tensor-product Hilbert space

⌦ n k=1 H k and associated n pairs of field operators â † k , âk , with k = 1, • • • , n.
For each mode k we can define the following field quadratures

qk := âk + â † k , pk := i(â † k âk ) (3.12)
These operators can be arranged in an N -mode vectors x := (q 1 , p1 , • • • , qn , pn ) T . Using the standard bosonic commutation relations, for the field's creation (â † kl ) and annihilation (â k ) operators, one can easily verify that the any pairs of entries of vectors x satisfy the following commutation relation

[x l , xm ] = 2i⌦ lm , ⌦ lm = ✓ 0 1 1 0 ◆ , (3.13)
where ⌦ lm is the symplectic form [WPGP + 12]. From Eqs. (3.12)-(3.13) we can see that the vacuum noise is here set to 1.

An n-mode quantum state can be represented either as a density operator ⇢ acting on ⌦ n k=1 H k or as a Wigner function defined over 2n-dimensional phase space. In particular, a state is Gaussian if its Wigner function is Gaussian, so that it is completely characterized by the first two statistical moments, i.e., the mean value x := hxi = Tr(x ⇢) and covariance matrix (CM) V, whose arbitrary element is defined by

V ij := 1 2 h{ xi , xj }i, (3.14)
where xi := xi hx i i and {, } is the anti-commutator. For a single-mode, one can consider di↵erent classes of quantum states, the most known are the coherent states. These are states with minimum (vacuum) noise uncertainty, symmetrically distributed in the two quadratures, and characterized by their complex amplitudes in the phase space. They are denoted as |↵i, where ↵ = q + ip, where (q, p) are the components of the mean value. Another important class is that of squeezed states, where the noise is less than the vacuum in one of the two quadratures (while greater than in the other) [WPGP + 12].

CV-QKD protocol

Realization of a generic CV-QKD protocol includes the following steps: Alice encodes a classical variable X in the amplitudes of Gaussian states, which are randomly displaced in the phase space using a zero-mean Gaussian distribution, whose variance is typically large. If coherent states are used, the modulation is symmetric in the phase space. If squeezed states are used instead, then the displacement is along the squeezing direction, and Alice randomly switches between q-and psqueezings.

Alice then sends the modulated signal states to Bob through the quantum channel, which is typically a thermal-loss channel with transmissivity T and some thermal noise, quantified by the mean number of thermal photons in the environment n or, equivalently, by the excess noise ✏ = T 1

(1 T )n. Bob performs homodyne or heterodyne detection on the incoming signals at the output of the quantum channel, thus retrieving his classical variable Y . Following this, Alice and Bob perform classical post-processing to extract secret pair of keys.

For CV-QKD, the information reconciliation protocol comprises of two di↵erent variations. The first protocol is a direct-reconciliation protocol [START_REF] Ch | Continuous variable quantum cryptography: Beating the 3 db loss limit[END_REF], in which we allow information reconciliation by forwarding public communication from the sender Alice to the receiver Bob. The second protocol is a reverse-reconciliation [START_REF] Grosshans | Reverse reconciliation protocols for quantum cryptography with continuous variables[END_REF][START_REF] Furrer | Reverse-reconciliation continuous-variable quantum key distribution based on the uncertainty principle[END_REF] protocol, where we allow information reconciliation by backward public communication from Bob to Alice. It is advantageous to perform a reverse reconciliation in place of a direct reconciliation.

In a Gaussian CV-QKD protocol, where the Gaussian signal states are Gaussian-modulated and the outputs are measured by homodyne or heterodyne detection [START_REF] Garcia | Quantum information with optical continuous variables: from bell tests to key distribution[END_REF], and the optimal attack is a collective Gaussian attack. Here Eve combines each signal state and a vacuum environmental state via a Gaussian unitary and collects the environment's output in a quantum memory for an optimized and delayed joint quantum measurement.

In a realistic scenario, taking into account imperfect reconciliation with e ciency 2 {0, 1}, the secret key rate against collective attack is given by

K DR coll = I(X; Y ) S(X; E) (3.15) K RR coll = I(X; Y ) S(Y ; E) (3.16)
In practice, the first term of the right side hand, I(X; Y ) is directly observed in a given implementation of the protocol. Therefore, the real question is to determine the value of S(Y ; E) or at least be able to find the upper bound for this quantity to derive a lower bound on the actual secret key rate of a given experiment.

To estimate the lower bound on the key rate, let us consider the prepare and measure version of the GG02 protocol [START_REF] Grosshans | Reverse reconciliation protocols for quantum cryptography with continuous variables[END_REF], where Alice encodes information in the quadratures X and P of coherent states. The random variables X and P are drawn according to a Gaussian distribution of variance V A : X, P ⇠ N (0, V A ). At the end of the quantum exchange, Alice and Bob perform a parameter estimation, which is done by analyzing m pairs of correlated data (x i , y i ) 1im where y i refers to the quadrature measurement of Bob and x i refers to the corresponding value of Alice's quadrature. For CV-QKD, it is su cient to estimate the covariance matrix AB of the state shared by Alice and Bob.

AB = ✓ V I 2 p T (V 2 1) z p T (V 2 1) z (1 + T (V 1) + T E)I 2 ◆ (3.17)
Where, T is the transmission and E is the excess noise of the quantum channel. It turns out that only two parameters need to be estimated: (i) the variance on the Bob's side hy 2 i, (ii) the correlation between Alice and Bob's data hxyi, as entries in the AB are linked to hx 2 i, hy 2 i and hxyi through

V = hx 2 i + 1, T = hxyi 2 hx 2 i 2 , 1 + T (V 1) + T E = hy 2 i (3.18)
Now S(Y ; E) = S(E) S(E|Y ) = S(AB) S(AB|Y ), as Eve's system can be considered without loss of generality to be a purification of Alice and Bob's system. The quantity S(AB) and S(AB|Y ) can be calculated from the symplectic eigenvalues ⌫ 1 , ⌫ 2 of AB and ⌫ 3 of AB|Y , where AB|Y is the covariance matrix of Alice's mode, given Bob's result of the homodyne measurement of say, quadrature x:

AB|Y = ✓ V T (V 2 1) 1+T V +T E 0 0 V ◆ (3.19)
The symplectic eigenvalues are given by:

⌫ 2 1 = 1 2 [ + p 2 4D] (3.20) ⌫ 2 2 = 1 2 [ p 2 4D] (3.21) ⌫ 2 3 =V ⇣ V T (V 2 1) 1 + T (V 1) + T E ⌘ , (3.22)
Where one defines,

=V 2 + (1 + T (V 1) + T E) 2 2T (V 2 1) (3.23) D =((1 + T (V 1) + T E)V T (V 2 1)) 2 . (3.24)
Now, from the expression of the entropy of a Gaussian state as a function of its symplectic eigenvalues, one obtains:

S(Y ; E) = g ⇣ ⌫ 1 1 2 ⌘ + g ⇣ ⌫ 2 1 2 ⌘ g ⇣ ⌫ 3 1 2 ⌘ (3.25)
where the function g is defined as

g(x) = (x + 1) log 2 (x + 1) x log 2 x (3.26)
In this finitesize regime the security of CV-QKD was first analyzed against collective attacks [START_REF] Leverrier | Finite-size analysis of a continuous-variable quantum key distribution[END_REF] by including corrections to the key rate taking into account of the data points used and discarded during parameter estimation and the convergence of the smooth min-entropy towards the von Neumann entropy.

CV-QKD with discrete modulation

In CV-QKD, information is encoded in quantum systems with infinite-dimensional Hilbert spaces. This allows the sender to use bright coherent states and highlye cient homodyne detections, which naturally boost the communication rate. These features do not come for free. At the error correction stage, one pays a penalty in mapping the continuous output data from the physical Gaussian channel into a binary-input additive white Gaussian-noise channel. This mapping is more accurate by employing discrete modulation [START_REF] Leverrier | Unconditional security proof of longdistance continuous-variable quantum key distribution with discrete modulation[END_REF]. The first discrete-modulated CV-QKD protocol was based on a binary encoding of coherent states [START_REF] Ch | Continuous variable quantum cryptography: Beating the 3 db loss limit[END_REF] and was designed to overcome the 3 dB limitation of CV-QKD in DR. Later protocols have consider three [START_REF] Brádler | Security proof of continuous-variable quantum key distribution using three coherent states[END_REF] or arbitrary number of phase-encoded coherent states [START_REF] Papanastasiou | Quantum key distribution with phase-encoded coherent states: Asymptotic security analysis in thermal-loss channels[END_REF].

The basic idea in Ref. [START_REF] Ch | Continuous variable quantum cryptography: Beating the 3 db loss limit[END_REF] is to perform a binary encoding which assigns the bit-value 0 (1) to a coherent state with positive (negative) displacement. Then, the receiver switches the homodyne detection setup, measuring quadrature q or p. After the quantum communication, the parties discard unfavorable data by applying an advantage distillation routine [START_REF] Maurer | Secret key agreement by public discussion from common information[END_REF][START_REF] Cachin | Linking information reconciliation and privacy amplification[END_REF], which is a post-selection procedure which extracts a key by using two-way classical communication. The asymptotic security of this protocol was first studied under individual attacks [START_REF] Ch | Continuous variable quantum cryptography: Beating the 3 db loss limit[END_REF] and later against collective attacks, with also a proof-of-concept experiment [SAA + 07] . In general, the security of CV-QKD with non-Gaussian modulation remains an open question (in finite size regime). In the asymptotic limit, its security has been proven against Gaussian attacks [START_REF] Leverrier | Continuous-variable quantum-keydistribution protocols with a non-gaussian modulation[END_REF] and, more recently, general attacks [START_REF] Ghorai | Composable security of two-way continuous-variable quantum key distribution without active symmetrization[END_REF].

Device-Independent QKD (DI-QKD)

Quantum Key distribution protocols are robust against future algorithmic and computational advances, including quantum computers' emergence. This is because its security is informationtheoretic, i.e., it can be proven based only on models of the local devices operated by legitimate users and does not require any assumptions on the resources available to an adversary. However, real-life implementations of QKD rarely conform to the assumptions in idealized models used in security proofs. Any features of the real devices not modeled in the security proof could compromise security, and there are cases where this has happened in actual implementations. Attacks that exploit features not modeled in the security proof are known as side-channel attacks. Real systems may still possess side channels, i.e., security vulnerabilities, if their implementation deviates significantly from the security analysis's idealized models.

A way to break out of this loophole that exploits imperfections in the practical realization is to consider device-independent approaches. The security of a device-independent protocol does not depend on the devices' implementation, as no assumptions are made on how devices operate and are used in the protocol. Instead, the security is derived from the input-output behavior, which is tested in the protocol. This has an advantage over standard QKD protocols with trusted devices where a user, in principle, should check the implementation security of their devices regularly to ensure their behavior is still in line with the assumptions of the security proof. This is a technically challenging task and not one that can be expected of an average user. By contrast, in a device-independent protocol, the implementation of the quantum part of Alice and Bob devices can be untrusted which reduces the attack surface to the classical part.

The setup for DI-QKD

The device-independent approach eliminates security flaws due to device imperfections by not making any assumption on devices' implementation. However, many other assumptions are in this scenario, which is also made in the trusted-devices case:

1. Alice and Bob have secure laboratories and control over all channels connecting their laboratory with the outside world. Otherwise, the untrusted devices could broadcast their outputs to the adversary outside the laboratory, or Eve could send a probe into the laboratory to inspect any secret data. Alice and Bob can prevent unwanted information flow between it and any other devices for any devices in their labs.

2. Each party has a trusted way to perform classical information processing.

3. Alice and Bob have access to a perfect random number generator within their laboratories.

4. Alice and Bob are connected by an authenticated classical channel on which an adversary could listen without detection.

5. Alice and Bob are also connected by an insecure quantum channel on which an adversary can intercept and modify signals in any way allowed by quantum mechanics.

Security criterion for DI-QKD

The most essential and necessary ingredient, which forms the basis for DI protocols' security, is a "test for quantumness" based on the violation of a Bell inequality. A Bell inequality can be thought of as a game played by the honest parties using the device they share. Di↵erent devices lead to di↵erent winning probabilities when playing the game. The game has a unique "feature"there exists a quantum device that achieves a winning probability ! q greater than all classical, local devices. Hence, if the honest parties observe that their device wins the game with probability ! q they conclude that it must be non-local.

DI security relies on the following deep but well-established facts. High winning probability in a Bell game not only implies that the metric system is non-local but, more importantly, that the kind of non-local correlations it exhibits cannot be shared: the higher the winning probability, the less information any eavesdropper can have about the devices' outcomes. The tradeo↵ between winning probability and secret correlations, can be made quantitative.

Measurement-Device-Independent QKD (MDI-QKD)

Measurement device Independent approach or QKD is a simple solution to remove all (existing and yet to be discovered) detector side channels, arguably the most critical part of the implementation. In contrast to DI-QKD, in its most straightforward formulation, MDI-QKD requires the additional assumption that Alice and Bob, i.e., the source devices are trusted along with the set of other assumptions, as mentioned in section (3.4.1).

In a simple MDI-QKD setting, 1. Both Alice and Bob prepare phase randomized weak coherent pulses (WCPs) in the four possible BB84 polarization states i.e., single-photon states with either rectilinear {|Hi, |V i} or diagonal {|Di, |Ai} polarization.

2. These states are sent to a untrusted central relay that is assumed under control of Charlie (or Eve), who performs a Bell state measurement that projects the incoming signals into a Bell state.

3. Once the quantum communication phase is completed, Charlie uses a public channel to announce the events where he has obtained a successful outcome in the relay, including as well his measurement outcome ↵ = 0, 1, 2, 3 of the Bell detection.

4. Alice and Bob keep the data that correspond to these instances and discard the rest.

The ideal Bell detection is a measurement with four POVM elements,

⇤ ↵ := ↵ | ih | ↵ , where | i = 1 p 2 (|HHi + |V V i) (3.27)
is a maximally entangled state, and ↵ are the Pauli operators (including the identity),

0 =|HihH| + |V ihV |, 1 =|HihV | + |V ihH|, 2 =i|HihV | i|V ihH|, 3 =|HihH| |V ihV |. (3.28)
Note that, if both Alice and Bob encode information in the rectilinear basis, then they know that their encoded bit values are the same if the outcome is ↵ = 0 or ↵ = 3, otherwise they know that they are opposite if ↵ = 1 or ↵ = 2. Therefore, Bob can obtain Alice's bit by flipping (or not flipping) his local bit according to the value of ↵. Similar is the situation if Alice and Bob use the diagonal basis, as depicted in Table 3.1 . If the parties choose di↵erent bases, they simply discard their data. Assuming that the rectilinear basis is used to generate the key, the asymptotic key rate is given by the following expression

(x) = f (x)H 2 (x)
gives the leak of the information from imperfect error correction, with f 1 being the e ciency of the classical error correction.

Limitation of point-to-point QKD

One of the crucial problems in QKD is to achieve long distances at reasonably-high rates. As evident from the Figure .(3.4), which shows a plot for secret-key rate (bits per channel use) versus Alice to Bob distance (km). Theoretical bounds for di↵erent QKD protocols are represented in lines, while the experimental result for di↵erent QKD schemes is shown as symbols.

Considering the maximum rates that are potentially achievable by current protocols, assuming infinitely long keys and ideal conditions, such as unit detector e ciency, zero dark count rates, zero intrinsic error, unit error correction e ciency, zero excess noise:

• Secret key capacity: The blue solid line represent the secret-key capacity of PLOB bound [START_REF] Pirandola | Fundamental limits of repeaterless quantum communications[END_REF], which sets the ultimate achievable rate for repeaterless QKD at K SKC log 2 (1 ⌘), (⌘ = 10 ↵⇥distance/10 , ↵ = 0.2dB/Km), bits per channel use.

• Single photon QKD: An ideal implementation of BB84 protocol (based on perfect singlephoton sources, ideal detectors and perfect error correction) shows a linear decay of the secret key rate in terms of the loss ⌘ in the channel, i.e., K spQKD = ⌘/2.

• Decoy state QKD: For ideal implementation decoy-state QKD protocol, the secret key rate in terms of loss in the channel is K dsQKD = ⌘/e, with e the Euler's number, as shown by green dotted dashed line in Figure 3.4.

• CV-QKD At long distances (i.e., small transmissivity ⌘), an ideal implementation of the CV QKD protocols has rate K CVQKD ' ⌘/(2 ln 2) ' 0.72⌘. This rate is r shown by red dashed line in the Figure 3.4.

• Symbol codes for di↵erent experimental results as shown in Figure 3.4: red triangles for CV-QKD experiments, brown square for DV-QKD experiments, and orange circle for MDI-QKD experiments.

Extending the communication range of QKD systems is a major objective because of the future network applications. However, the generation rate of the secret key by direct transmission is fundamentally limited by the distance, as evident from Figure .3.4. Example: For P dark = 10 5 , ↵ = 0.2db/Km, ⌘ ⇡ 0.1, the maximum distance for repeaters-less QKD is  250Km and for this limit most of the existing experimental realization of QKD protocol can reach up to 200 Km.

To overcome the fundamental rate-loss scaling of QKD, one may design a multi-hop network that exploits the assistance of quantum repeaters [START_REF] Briegel | Quantum repeaters: The role of imperfect local operations in quantum communication[END_REF]. A quantum repeater or quantum relay is any middle node between Alice and Bob which helps their quantum communication by breaking down their original quantum channel into sub-channels. It does not matter what technology the node is employing, e.g., it may or may not have quantum memories. A quantum repeater scheme is said to be "e↵ective" if it can be used to overcome QKD rate-loss performance for a direct transmission, as some distance (and even better a long distance).

The advantage of introducing a quantum repeater can be explained with a simple example. Suppose that an optical fiber connects Alice and Bob with transmissivity ⌘, such that the twoway capacity C(⌘) is zero. Split the fiber into two identical portions and introduce a middle relay. Since each segment is a lossy channel with transmissivity p ⌘, both Alice-relay and relay-Bob may be reach the capacity C( p ⌘) > C(⌘). Combining the outputs, e.g., composing keys or swapping entanglement, C( p ⌘) > 0 becomes an achievable rate for the entire repeater-assisted communication between Alice and Bob.

Twin-Field QKD

In the MDI-QKD protocol, the idea is to use a middle relay that can be untrusted, i.e., run by Eve. This is the first step towards the end-to-end network principle, which assumes a scenario with unreliable middle nodes. On the other hand, despite MDI-QKD employing a relay, it cannot beat the PLOB bound for point-to-point QKD [START_REF] Pirandola | Fundamental limits of repeaterless quantum communications[END_REF]. This limitation has been recently lifted by the introduction of a more e cient protocol called "twin-field" (TF) QKD [START_REF] Lucamarini | Overcoming the ratedistance limit of quantum key distribution without quantum repeaters[END_REF].

In the TF-QKD protocol, Alice and Bob send two phase-randomized optical fields (faint pulses) to the middle relay (Charlie/Eve) to produce a single-photon interference to be detected by a singlephoton detector, whose outcomes are publicly declared. The term twin derives from the fact that the optical fields' electromagnetic phases should be su ciently close to interfering. More precisely, Alice and Bob send to the relay pulses whose intensity µ i (for i = A or B) is randomly selected between three possible values. Then, they respectively choose phase A and B as i = (↵ i + i + i ) 2⇡, where ↵ i 2 {0, ⇡} encodes a bit, i 2 {0, ⇡/2} determines the basis, and the final term i is randomly selected from M slices of the interval [0, 2⇡), so that it takes one of the value 2⇡k/M for k = {0, 1, . . . , M 1}.

To ensure only phases close enough are selected, after disclosing on an authenticated channel, Alice and Bob only accept the same choices of the slice, i.e., the instances for A = B . These pulses interfere at the relay constructively (or destructively). Then, Alice announces the basis she used A and the intensity µ A for each instance. The raw key is extracted from the basis A = B = 0 and for one of the intensities. A bit ↵ a can be shared between Alice and Bob by considering the absolute di↵erence between ↵ A and ↵ B to be equal to 0 or ⇡ (depending on the relay's announcement). The rest of the results can be used for other purposes, including estimating error rates and decoy-state parameters.

Note that the twin pulses are in principle set by requiring A to be as close as possible to B the nonzero di↵erence between them introduces an intrinsic QBER. The two become identical provided that M is infinitely large. Realistically, a finite but large value of M can be used though, which decreases the probability of matching two-phase slices. An estimation made in [START_REF] Lucamarini | Overcoming the ratedistance limit of quantum key distribution without quantum repeaters[END_REF] gives the optimal value of M = 16 with QBER of ⇡ 1.28%.

In [START_REF] Lucamarini | Overcoming the ratedistance limit of quantum key distribution without quantum repeaters[END_REF], the authors considered a restricted scenario where the 'global phase' does not leak any useful information to Eve, giving a key rate

K TF (µ, L) = d M K(µ, L) (3.30) K(•)
is the secret key rate of an e cient BB84 protocol with tagging argument [START_REF] Heid | E ciency of coherent-state quantum cryptography in the presence of loss: Influence of realistic error correction[END_REF], and µ, L is the intensity and the distance, respectively. Later [START_REF] Tamaki | Information theoretic security of quantum key distribution overcoming the repeaterless secret key capacity bound[END_REF], considered a collective attack where Eve uses an identical beam splitter set along each path connecting Alice and Bob to the relay. While this attack considerably increases Eve's gain, the key rate scaling O( p ⌘) remains unchanged. Using the TF-QKD protocol over a communication line with total Alice-Bob's transmissivity ⌘, not only beats PLOB bound but also the rate performance is also not so far from the single-repeater bound of log 2 (1 p ⌘).

Floodlight QKD

Floodlight (FL)-QKD represents a two-way CV-QKD protocol that can provide orders-of-magnitude higher SKRs than conventional QKD protocols. The idea behind FL-QKD is to employ multimode encoding. In other words, each message is carried by many optical modes so that the SKR per encoding is substantially increased, even though the SKR per optical mode remains restricted by the PLOB bound. A 55 Mbit/s experimental SKR over a 10-dB-loss channel has been reported [ZZD + 16]. More recently, a 1.3 Gbits/s SKR in the presence of a 10-dB attenuation has been demonstrated [START_REF] Zhang | Floodlight quantum key distribution: Demonstrating a framework for high-rate secure communication[END_REF].

In FL-QKD, Alice employs broadband amplified spontaneous emission (ASE) source to generate correlated reference and signal light beams. The weak-signal light beam is sent to Bob for phase modulation followed by the optical amplification, while the strong ASE portion of the beam is retained at the Alice side as the local oscillator (LO) reference beam. Bob performs phase modulation on the weak-signal light beam, followed by an amplification using an EDFA. The EDFA compensates for the channel loss and adds bright noise to mask his phase-modulated signal into noise, and such prevents Eve's passive eavesdropping, given that Eve does not have the right reference signal. Additionally, Alice does not need a shot-noise limited homodyne detector but a commercial homodyne detector instead to detect Bob's sequence. In addition to Broadband ASE classical signal, Alice employs a spontaneous parametric down-conversion (SPDC) photon-pair source to generate the time-correlated signal and idler photon, with idler photon being detected by the SPD, and the signal photon being sent towards the Bob with the weak classical ASE signal. Alice ensures that her signal photon has the same polarization as the weak classical ASE signal. After combining the SPDC's signal photons with the weak ASE-noise signal, Alice taps the combined signal portion and applies the second SPD. These two SPDs comprise Alice's channel monitoring circuit. Bob taps the portion of the received signal and passes it to the SPD. Alice and Bob then perform the coincidence measurement to estimate the extent of Eve's activity. The authors claim that this protocol is secure against passive attacks, in which Eve uses the lost light. However, it is sensitive to the active attacks when Eve injects her light into Bob's terminal and decodes Bob's beam stream using her owns stored reference. To overcome this problem, the authors claim that Eve's photons are uncorrelated with the idler photons and contribute to the coincidence measurement but introduce the noise photons. This increase in noise photons can be used to quantify the level of Eve's intrusion as follows:

f E = 1 C IB CIB C IA CIA S A S B , (3.31)
where C IB (C IA ) denotes time-aligned coincidence rate of Bob's (ALice's) tap, while CIB ( CIA ) denoted the corresponding time-shifted coincidence rate. We use S A (S B ) to denote the singles rate of Bob's (Alice's) tap. The SKR of the FL-QKD scheme can be lower bounded by

K FL-QKD h I AB (P e ) (UB) BE (f E ) i R, (3.32)
where is the reconciliation e ciency, I AB is Alice-Bob mutual information determined by

I AB (P e ) = 1 + P e log 2 P e + (1 P e ) log 2 (1 P e ), (3.33)
where P e being Alice's bit error probability of phase-modulated channel. We use R to denote the signal rate and

(UB) BE (f E ) to denote the upper bound of Bob-Eve Holevo's information.

Everlasting security

For many cryptographic tasks (be it classical or quantum) information-theoretic secure protocols simply do not exist (in particular if we cannot assume an majority of honest participants). A compromise is the concept of everlasting security. In a nutshell, a protocol is everlastingly secure if it cannot be broken by an adversary that becomes computationally unlimited after the protocol execution. This guarantees that all assumptions need only to hold during the protocol execution, sensitive data is not threatened by possible future attacks on today's schemes. We only need to reliably judge the current state of the art, not future technologies Definition 3.9.1 (Everlasting secure key establishment protocol) Any key establishment protocol is everlasting secure if it is secure against an adversary who:

1. throughout the execution of the protocol is a computationally limited algorithm.

2. after the protocol is over, may run any (unbounded in space or time) algorithm.

Everlasting [START_REF] Unruh | Everlasting multi-party computation[END_REF] or long-term [START_REF] Stebila | The case for quantum key distribution[END_REF] security implies that information-theoretic security is guaranteed except during the short period of time during which we assume a computational (or memory) assumption holds. This also implies that assumptions on an adversary's computational power only need to hold during the protocol execution. For example, the assumption of an initial short shared secret (for authenticating the classical channel) in the implementation of QKD can be replaced with a computational assumption [START_REF] Broadbent | Quantum cryptography beyond quantum key distribution[END_REF] or an assumption about the quantum storage capabilities of the eavesdropper [START_REF] Harnik | On everlasting security in the ¡i¿hybrid¡/i¿ bounded storage model[END_REF]. Sensitive data is not threatened by possible future attacks on today's schemes. Moreover, we only need to reliably judge the current state of the art, not future technologies.

Rationale for everlasting security

Development of quantum cryptography, in particular quantum key distribution has been driven by the desire to achieve unconditional security. However, the usefulness of QKD has been challenged by [START_REF] Daniel | Introduction to post-quantum cryptography[END_REF]. To run a QKD protocol, an authenticated channel is needed. But how to implement such a channel? If we use a public key infrastructure for signing messages, we lose unconditional security and thus the main advantage of QKD. If we use shared key authentication, a key needs to be exchanged beforehand. (And, if we exchange an authentication key in a personal meeting, why not just exchange enough key material for one-time pad encryption -storage is cheap.)

A simple change of focus resolves the problems described in the previous paragraph. Instead of seeing the goal of quantum cryptography in achieving unconditional security, we can see it as achieving everlasting security. For example, if we run a QKD protocol and authenticate all messages using signatures and a public key infrastructure, then we do not get an unconditionally secure protocol, but we do get everlasting security: only the signatures are vulnerable to unlimited adversaries, but breaking the security of the signatures after the protocol execution does not help the adversary to recover the key.

Chapter 4 QKD Against Bounded Adversary QKD commonly o↵ers security against an unbounded adversary, i.e., the adversary can have access to unlimited technology. For example, the eavesdropper (Eve) may have a universal quantum computer with unlimited computational power, as well as a perfect quantum memory of unbounded capacity and ideal detectors. Such a high level of security puts QKD at the forefront on theoretical ground of what is achievable in theory, in terms of security. While these strong assumptions put QKD on a solid theoretical ground, they may be considered unrealistic given the present stage of development of quantum technologies. Such strong assumptions create a disproportion between the technology that will be deployed in a foreseeable future and what is assumed that is already available to Eve. Thus, assessing the usefulness of QKD to serve real-world use cases in practice remains a complex and disputed question.

One way to overcome this gap is to consider a di↵erent security scenario where a potential eavesdropper has some technological limitations. We review a few such examples of security models, where certain assumptions are made on Eve's technological capabilities. First, we review the Bounded Quantum Storage Model (BQSM), where Eve is assumed to be able to store only a limited number of qubits. Moreover, this number is assumed to grow sub-linearly with the number of bits exchanged between Alice and Bob. Second, we consider the Noisy Storage Model, where the adversary's quantum storage is bounded and noisy, respectively. The assumption of bounded quantum storage deals with the noiseless case (but assumes a small amount of storage), whereas the noisy-storage model deals with the case of noise (but possibly a large amount of storage). Finally we study the assumption that Eve can store unlimited qubits in quantum memory, however, only for a finite time, and its application to Quantum Data Locking.

Before we proceed to review the di↵erent scenarios, we briefly review the entropic uncertainty relations, which will play a significant role in proving the security against Eve with constrained quantum memory.

Entropic uncertainty relations

Consider a collection of k-measurements ⇧ = {⇧ j } j=1,...,k . On a given state ⇢, the j th measurement produces a random variable ⇧ j (⇢) with output x j and associated probability p ⇧ j (⇢) (x j ). An entropic uncertainty relation is expressed by an inequality of the form

inf ⇢ 1 k k X j=1 H[⇧ j (⇢)] c ⇧ (4.1)
where H[⇧ j (⇢)] = P

x j p ⇧ j (⇢) (x j ) log 2 p ⇧ j (⇢) (x j ) is the Shannon entropy of ⇧ j (⇢) and c M is a constant that only depends on the set of measurements M. By convexity, it is su cient to restrict on pure states.

For example, consider the case of a d-dimensional Hilbert space and a pair of projective measurements A and B. Each measurement is defined by a corresponding collection of d-orthogonormal vectors A ⌘ {|a 1 i, . . . , |a d i} and B ⌘ {|b 1 i, . . . , |b d i}. Then Maassen-U nk entropic uncertainty relation [START_REF] Hans Maassen | Generalized entropic uncertainty relations[END_REF] states that

inf ⇢ H[A(⇢)] + H[B(⇢)] 2 c A,B (4.2)
where c A,B = log 2 max k,h |ha k |b h i| and

H[A(⇢)] = d X k=1 ha k |⇢|a k i log 2 ha k |⇢|a k i, (4.3) H[B(⇢)] = d X h=1 hb h |⇢|b h i log 2 hb k |⇢|b k i. (4.4)
In particular, if the two observables are mutually unbiased, then max k,h |ha k |b h i| = 1/ p d and we obtain

inf ⇢ H[A(⇢)] + H[B(⇢)]

QKD in the bounded quantum storage model 4.2.1 Bounded Storage Model

In information, theoretic cryptography physical assumptions appear, which do not rely on any hardness assumptions but merely assume a limit on some other resource. In classical cryptography, the bounded-storage model introduced in [START_REF] Maurer | Secret key agreement by public discussion from common information[END_REF] assumes that the adversary can only store a certain number of classical bits. Protocols are known that do (in principle) allow the secure implementation of any cryptographic task as long as the adversary's storage is small. However, It was later discovered that any classical protocol which requires the honest parties to store n bits in order to execute it successfully could be broken by an adversary that can store more than about O(n 2

)bits. This gap changes dramatically when using quantum communication. Likewise, one now assumes that the adversary's quantum storage is limited to a certain number of qubits. There is no restriction on how many classical bits the adversary can store. This is known as the bounded-quantumstorage model. [FGS + 18a] (see also Ref. [START_REF] Damgard | Cryptography in the bounded quantum-storage model[END_REF] ). The advantages over the classical boundedstorage model are two-fold: First, given current day technology, it is tough to store quantum states. Secondly, the honest player does not require any quantum storage, making the protocol implementable using present-day technology.

Key distribution in bounded quantum storage model

We consider a one-way protocol in which the sender Alice encodes a variable X into a d-dimensional Hilbert space, with |X| = d, i.e., log d bits on a d-dimensional Hilbert space. Let S be a set of orthonormal bases of a d -dimensional Hilbert space H d . For each basis # 2 S, we assume that the d basis vectors are parametrized by the elements of the fixed set X of size |X | = d. We then consider QKD protocols consisting of the steps described as

• One-Way QKD: Let N 2 N be arbitrary. 1. Preparation: For i = 1 . . . N, Alice chooses at random a basis # i 2 S and a random element X i 2 X . She encodes X i into the state of a quantum system according to the basis # i and sends this system to Bob. Bob measures each of the states he receives according to a randomly chosen basis # 0 i and stores the outcome Y i 2 X of this measurement. 2. Sifting: Alice and Bob publicly announce their choices of bases and keep their data at position i only if # i = # 0 i . In the following, we denote by X and Y the concatenation of the remaining data X i and Y i , respectively. X and Y are sometimes called the sifted raw key.

Error correction:

Alice computes some error correction information C depending on X and sends C to Bob. Bob computes a guess X for Alice's string X, using C and Y .

4. Privacy amplification: Alice chooses at random a function f from a two-universal family of hash functions and announces f to Bob. Alice and Bob then compute the final key by applying f to their strings X and X, respectively.

Note that the quantum channel is only used in the preparation step. Afterward, the communication between Alice and Bob is only classical (over an authentic channel).

The protocol is specified by collecting k di↵erent orthogonal bases where Alice randomly selects one of the bases and then encodes the classical random variable X by using the d mutually orthogonal vectors in the chosen basis. Bob independently selects one of the k bases at random and applies the corresponding projective measurement on the receiver side. The protocol is analogous to a d -dimensional version of BB84 with k di↵erent bases. After the quantum part of the protocol, in which n states are prepared, transmitted, and measured, the users proceed with the sifting phase, in which they select only the signal transmissions for which they have made the same choice of bases. The protocol then concludes with error reconciliation and privacy amplification.

The di↵erence with standard QKD is that in the BQSM, the eavesdropper Eve is assumed to be only capable of storing a finite amount of quantum information. More specifically, it is assumed that Eve has kept no more than q qubits in her quantum memory after n quantum signal transmissions and before sifting. Therefore, all remaining quantum states intercepted by Eve have already been measured before the sifting phase occurs.

A fundamental estimate of the number of secret bits (excluding sifting) that can be extracted from such a protocol is given by (for direct reconciliation):

`✏ ' H ✏ min (X n |ZE) H max (C) (4.6)
where ✏ is a security parameter, H ✏ min (X n |ZE) is the smooth min-entropy [74,438] conditioned on Eve's side information for n signal transmissions, and H max (C) is the number of bits publicly exchanged for error reconciliation. Under the assumptions of the BQSM, here Eve's side information comprises a quantum part E and a classical part Z. Furthermore, since Eve's quantum memory has capacity below q qubits, we have

`✏ & H ✏ min (X n |Z) q H max (C) (4.7)
It remains to bound the (classical) conditional smooth min-entropy H ✏ min (X n |Z). It has been shown in the reference [FGS + 18a] that if the set of k bases employed in the protocol satisfies an entropic uncertainty relation as in Equation (4.1) , then for any 2 (0, 1/2)

H ✏ min (X n |Z) (c ⇧ 2 ) n, (4.8)
with

✏ = exp  2 n 32 (log 2 (kd/ )) 2 .
(4.9)

For example, using two mutually unbiased bases we can apply the Maassen-U nk entropic uncertainty relation in Equation (4.5) and obtain for su ciently small

H ✏ min (X n |Z) & n 2 log 2 d (4.10)
In general, the assumptions of BQSM allow us to increase the resilience to noise of a QKD protocol, but the rate is not expected to improve dramatically compared to an unbounded quantum-capable eavesdropper. We conclude by noting that the number of secret bits in Eq. (4.6) must be multiplied by a factor 1/k to account for the probability that Alice and Bob chose the same basis.

Noisy storage model

The noisy storage model [WST08a, STW09, Sch10] can best be understood by thinking about what a dishonest attacker -the adversary -can or cannot do. The adversary is computationally all-powerful and may have a quantum computer that operates flawlessly and instantaneously. The adversary can also have an arbitrary quantum storage device before and after the protocol. The only restriction assumed is that the adversary cannot store qubits perfectly as they undergo decoherence.

We will now have a closer look at the noisy-storage model. A noisy quantum memory as is defined as a device whose input states are in some Hilbert space H in . A state ⇢ stored in the device decoheres over time. That is, the content of the memory after some time t is a state F t (⇢), where F t : B (H in ) ! B (H out ) is a completely positive trace-preserving map corresponding to the noise in the memory. Since the amount of noise may of course depend on the storage time, the behaviour of the storage is completely described by the family of maps {F t } t>0 . We will make the minimal assumption that the noise is Markovian, that is, the family {F t } t>0 is a continuous one-parameter semigroup

F 0 = I and F t 1 +t 2 = F t 1 F t 2 (4.11)
This tells us that the noise in storage only increases with time, and is essential to ensure that the adversary cannot gain any information by delaying the readout. This is the only restriction imposed on the adversary who may otherwise be all-powerful. In particular, we allow that all his actions are instantaneous, including computation, communication, measurement and state preparation.

In a nutshell, the noisy-storage model assumes that it is challenging to store many qubits without making any errors. Given that no experimental implementation can reliably store more than a handful of qubits right now, this is a technologically well-motivated assumption. However, it is possible to achieve security even if the adversary could store thousands of qubits -we need to send more qubits during the protocol.

The secuirty of cryptographic protocols in the noisy storage model are proved by introducing certain time delays t which force any adversary to use the storage device for a time at least t. The assumptions imply that the best an adversary can do is to read out the information from the device immediately after time t, as any further delay will only degrade his information further.Thus, to analyze the security, F = F t can be considered, instead of the family {F t } t 0 . Note that since the adversary's actions are assumed to be instantaneous, he can use any error-correcting code even if the best encoding and decoding procedure may be di cult to perform. Summarizing, the noisy storage model assumes that 1. The adversary has unlimited classical storage, and (quantum) computational resources.

2. Whenever the protocol requires the adversary to wait for a time t, he has to measure/discard all his quantum information except what he can encode (arbitrarily) into H in . This information then undergoes noise described by F.

Noisy Storage Model allows achieving security, in principle, for any cryptographic problem in which Alice and Bob do not trust each other. Two-party cryptographic primitives [START_REF] Wehner | Implementation of two-party protocols in the noisy-storage model[END_REF] such as oblivious transfer and bit commitment are proven to be unconditionally secure [START_REF] Wehner | Implementation of two-party protocols in the noisy-storage model[END_REF][START_REF] Konig | Unconditional security from noisy quantum storage[END_REF] for realistic noise levels, against the most general attack. Experimental Implementation of these protocols was demonstrated with present-day hardware used for quantum key distribution was demonstrated [ENG + 14, NJCM + 12]. A quantum protocol for oblivious transfer was experimentally demonstrated for optical continuous-variable systems, and the security was proved in the noisystorage model [FGS + 18b].

Quantum data locking

The phenomenon of Quantum Data Locking (QDL) can be exploited to obtain e cient highdimensional QKD protocols within the assumption that Eve has access to a quantum memory of unlimited capacity, but that can store quantum information only for a finite time. This assumption implies that she is forced to measure her share of the quantum system within a given time after having obtained it. When the memory time goes to zero, we obtain as a limiting case the setting of personal attacks, where Eve is forced to measure the signals as soon as she receives them. We first briefly review the security criterion against an eavesdropper with time-limited quantum storage, and then we review the methodology behind the Quantum Data Locking.

Security against eavesdropper with time-limited storage

Suppose Alice wishes to use a memoryless quantum channel N A!B to send private information to Bob. Upon n uses of the channel, she encodes M messages x = 1, . . . , M, each with probability p X (x), into the input states ⇢ A (x) 's. Then Bob will receive the output states ⇢ B (x) = N ⌦n A!B (⇢ A (x)). Let us recall that a quantum channel N A!B can always be represented as the reduced dynamics induced by a unitary transformation on a larger space, that is,

N A!B (⇢ A ) = Tr E ⇥ U (⇢ A ⌦ ! E ) U † ⇤ (4.12)
where ! E is a pure state for a quantum system associated with the environment of the channel, and U is a unitary transformation coupling the system with its environment. In the worst-case scenario the eavesdroper Eve might collect all the information leaking into the channel environment, in which case the state obtained by Eve reads ⇢ E (x) = Ñ ⌦n A!E (⇢ A (x)) , where ÑA!E is the complementary channel, defined as

ÑA!E (⇢ A ) = Tr B ⇥ U (⇢ A ⌦ ! E ) U † ⇤ (4.13)
Let us consider the state

XE = M X x=1 p X (x)|xihx| O ⇢ E (x) (4.14)
This state describes the correlations between the classical input x and Eve's quantum system. To quantify the security of the channel one usually considers the trace distance,

:= 1 2 k XE X ⌦ E k 1 (4.15)
where

X = P M x=1 p X (x)|xihx|, E = P M x=1 p X (x)⇢ E (x) are the reduced states of XE and || • || 1 = Tr| • |.
If the trace distance is small, this implies that the state XE is close to the uncorrelated state X ⌦ E . Recall that, from an operational point of view, the trace distance is the bias in distinguishing the states by a measurement. The trace norm is indeed the standard security quantifier used in quantum key distribution: if  ✏, the communication protocol is secure up to a probability ✏.

The trace norm is the proper security quantifier in a generic setting. However, under certain assumptions on the technological capabilities of the eavesdropper, we can adopt a weaker security criterion. If we know that the eavesdropper cannot store quantum information for longer than a given time ⌧, then we know that she is forced to make a measurement within a time ⌧ after she received the quantum state. This leads us to consider a post-measurement security quantifier. A measurement ⇤ on Eve '

:= max ⇤ 1 2 p ⇤ XY p X p ⇤ Y 1 (4.17)
(the meaning of the subscript "acc" will be clear in the next paragraph) where

1 2 p ⇤ XY p X p ⇤ Y 1 = 1 2 P x,y p X (x)p ⇤ Y |x (y) p X (x)p ⇤ Y (y)
is the total variation distance. The operational meaning of acc is the bias in distinguishing between the classical distributions p ⇤ XY and p X p ⇤ Y . In other words, acc is the bias in distinguishing between the states XE and X ⌦ E by a local measurement.

The accessible information is an entropic quantity naturally associated with the distance acc . Let us recall that the accessible information is defined as the maximum classical mutual information that Eve can obtain about the input variable by local measurements on her subsystem, that is,

I acc (X; E) = max ⇤ I(X; Y ) (4.18)
where I(X; Y ) = H(X) + H(Y ) H(XY ) is the classical mutual information of the variables X and Y . From Alicki-Fannes' inequality [START_REF] Alicki | Continuity of quantum conditional information[END_REF] :

I acc (X; E)  2 acc log d n + ⌘ (2 acc ) (4.19)
where ⌘(•) = (•) log(•). On the other hand, Pinsker's inequality yields [START_REF] Fedotov | Refinements of pinsker's inequality[END_REF] acc  r 1 2

I acc (X; E) (4.20)
These two inequalities imply the e↵ective equivalence of acc and I acc (X; E) as security quantifiers. If the accessible information is small, Pinsker's inequality implies that the acc is also small. Viceversa, if acc is small, then the accessible information is small provided acc << (log

d n ) 1 = n 1 / log d.

Comparison with BB84

The first QDL protocol was discussed in Ref. [DHL + 04, HLSW04]. Such a protocol is analogous to BB84, with the fundamental di↵erence that Alice and Bob share one secret bit at the protocol's beginning. While in BB84, Alice and Bob randomly select their local basis and only later reconcile their choice in the sifting phase, in QDL, they use the 1 bit of information they secretly share to agree on the choice of the basis on which to encode (and decode) information. Therefore, according to this secret bit, Alice encodes n bits into n qubits, using either the computational or the diagonal basis, and Bob measures the received qubits on the same basis. We follow the original presentation of Ref. [DHL + 04] and assume a noiseless channel from Alice and Bob. Suppose that Eve intercepts the n signal qubits. As she is forced to measure them (either instantaneously or after a given time), the amount of information she can obtain about the message can be quantified by the accessible information.

While it is clear that Eve has to measure her share of the quantum state at a certain point, the accessible information criterion is sensitive to the time at which such a measurement takes place. If Eve obtains a small amount of side information before she measures her share, she could use it to increase her accessible information by a disproportionate amount. Consequently, accessible information security is not, in general, composable [START_REF] König | Small accessible quantum information does not imply security[END_REF]; that is, a secure protocol according to the accessible information criterion may not remain so when used as a subroutine of another communication protocol. On the other hand, if Eve obtains K bits of side information after the measurement, then (since the classical mutual information obeys total proportionality) her accessible information cannot increase by more than K bits, and composable security will be granted.

As is customary in quantum key distribution, the secret key generation protocol using quantum data locking is divided into two parts. The first part is a QDL protocol in which Alice encodes her share of the raw key into quantum states and sends them to Bob via an insecure quantum channel. After Bob measures the channel's output, he obtains his share of the raw key to be reconciled with Alice's one. The security of this part is o↵ered by the QDL e↵ect and is quantified by the accessible information. Alice sends error-correcting information to Bob through a public channel (in our case, there is no need for privacy amplification since the raw key is already secure due to QDL. Hence, we are in a situation where the QDL protocol is used as a subroutine of the key distribution protocol. This implies that the latter will be secure only if the former is secure in the composable sense. As discussed above, this is, in general, true only under the assumption that Eve has already measured her share of the quantum state when the second part of the protocol takes place. If Alice knows that Eve's quantum memory has a coherence time not more extensive than ⌧ , she can wait for a su ciently long time before sending error-correcting information to Bob through the public channel.

QDL under noiseless channel setting

In a quantum data locking protocol [DHL + 04, HLSW04] the legitimate parties Alice and Bob initially share a secret key of log K bits. They use the key to agree on a code to send classical information through a quantum channel. If they publicly declare a list of K codes, they can secretly use the shared key to agree on one of them. On the other hand, if an eavesdropper, who does not know the secret key, intercepts, and measures the quantum codewords, we require that her accessible information about the input messages must be negligibly small.

Let us first consider the case in which the channel from Alice to Bob is noiseless. In this case, Alice can encode classical information using a set of orthogonal n -qudit states belonging to a given basis. If Bob knows Alice's basis, he can reliably decode by measuring on the same basis. Suppose that Eve intercepts the whole set of n qudits. To ensure security, K must be chosen large enough to make Eve's mutual information negligibly small. It was shown in [START_REF] Fawzi | From low-distortion norm embeddings to explicit uncertainty relations and e cient information locking[END_REF] that for n large enough, there exist choices of

log K = 4 log 1/✏ + O(log log 1/✏) (4.21) bases such that I acc (X; E)  ✏ log d n (4.22)
Notice that for any given (small) ✏ and n large enough, this implies that a relatively small secret key is su cient to lock an arbitrarily long message. It is worth stressing that this result represents a strong violation of classical information theory in the quantum framework. Indeed, it is well known that in the classical framework, the secure encryption of a message of m bits requires at least m bits of the secret key (this result is based on the security of the one-time pad). The results of [START_REF] Fawzi | From low-distortion norm embeddings to explicit uncertainty relations and e cient information locking[END_REF] imply that one can lock information through a noiseless qudit channel at a rate of log d bits per channel use by consuming secret key at a rate (in bits per channel use) of

k = 1 n log K ⇠ 1 n log 1/✏ (4.23)
Such a secret-key consumption rate is asymptotically zero if ✏ is constant or decreases sub-exponentially in n.

QDL under noisy channel setting

While the phenomenon of quantum data locking has been known for more than ten years, the problem of locking information through noisy channels has been considered only recently in [GHK + 14a], where the notion of locking capacity of a noisy channel was introduced. The latter is defined as the maximum number of bits per channel use that can be reliably sent through a given channel in such a way that the eavesdropper's accessible information is negligibly small. Two notions of locking capacities have been defined. The weak-locking capacity is defined by requiring security against an eavesdropper who measures the channel's output from Alice to Bob. The strong-locking capacity instead requires security against an eavesdropper having direct access to the input states prepared by Alice. In an optical setting, a cipher based on the quantum data locking e↵ect is dubbed a quantum enigma machine [GHK + 14a]. While the twentieth century's Enigma machine relied on computational security (the presumed di culty of inverting the intricate pattern of electromechanical elements that was used to scramble the inputs of a typing machine), a quantum enigma machine would ensure provable information-theoretical security against an eavesdropper who cannot store quantum information for an arbitrarily long time.

Alice and Bob publicly agree on a set of K codes C 1 , . . . C K , where each code contains M equiprobable codewords

C k = {| k (x)i} x=1,...,M , with | k (x)i 2 C d n .
In a strong-locking scenario Eve intercepts the input states | k (x)i's. since she does not know the code, the state (4.14) reads:

XE = 1 M M X x=1 |xihx| ⌦ 1 K K X k=1 | k (x)ih k (x)| (4.24) Putting ⇢(x) = K 1 P K k=1 | k (x)i h k (x)| and ⇢ = M 1 P M x=1 ⇢(x)
, the accessible information of XE reads

I acc (X; E) = max ⇧ ( log M X y Tr (⇢⇧ y ) log Tr (⇢⇧ y ) + X xy M 1 Tr (⇢(x)⇧ y ) log ⇥ M 1 Tr (⇢(x)⇧ y ) ⇤ )
(4.25) where the maximum is over POVM's ⇧.

By convexity of mutual information, the maximum is achieved for a rank-one measurement with POVM elements of the form ⇧ y = µ y | y i h y | where the | y i 's are unit vectors and µ y > 0. The condition P

y µ y | y i h y | = I implies P y µ y /d n = 1. Putting Q x ( y ) = h y |⇢(x)| y i , we then obtain I acc (X; E) = log M min {µy| y ih y |} X y µ y M ( H [Q ( y )] ⌘ " X x Q x ( y ) #) (4.26)
where H [Q ( y )] = P

x Q x ( y ) log Q x ( y ) . Finally, we notice that the positive quantities µ y /d n can be interpreted as probability weights. An upper bound on the accessible information is then obtained by the fact that the average cannot exceed the maximum, which yields

I acc (X; E) = log M d n M min {µy| y ih y |} X y µ y d n ( H [Q ( y )] ⌘ " X x Q x ( y ) #) (4.27)  log M d n M min | i ( H[Q( )] ⌘ " X x Q x ( ) #) (4.28)
where the minimum is over all unit vectors | i 2 C d n . We now show that for certain choices of the codes C k 's, the accessible information is smaller than ✏ log d n for n and K large enough. Consider the case of random codes, where the codewords in C k are chosen i.i.d. from a certain ensemble of states. Then for any given x and | i the quantity

Q x ( ) = 1 K K X k=1 |h k (x) | i| 2 (4.29)
is the sum of random variables which, for K large enough, will converge to its average E [Q x ( )] . If the random codewords are chosen from an isotropic ensemble, that is, one satisfying

E [| ih |] = I/d n , then E [Q x ( )] = 1/d n . In turn, if Q x ( ) ⇠ (1 ± ✏)/d n , then H[Q( )] & (1 ✏)M/d n log d n , and ⌘ [ P x Q x ( )] ⇠ ⌘ [M/d n ] = M/d n log M/d n ,
= E [Q x ( ) 2 ] E [Q x ( )] 2 = E ⇥ Q x ( ) 2 ⇤ d 2n (4.31)
Notice that the factor depends on the ensemble from which the random codewords are drawn.

If the codewords are drawn from the uniform distribution on the unit sphere in

C d n , one obtains E [Q x ( ) 2 ] = 2 d n (d n +1) , which yields n = 2d n d n +1
. If the channel from Alice to Bob is noiseless, we have = log d and thus obtain an asymptotically vanishing secret-key consumption rate, lim n!1 1 n log K = 0. This result corresponds to the findings of [START_REF] Hayden | Randomizing quantum states: Constructions and applications[END_REF][START_REF] Fawzi | From low-distortion norm embeddings to explicit uncertainty relations and e cient information locking[END_REF] which considered random codewords in a high-dimensional Hilbert space and obtained quantum data locking protocols with zero asymptotic secret-key consumption rate through a noiseless channel.

Suppose instead that the codewords are of the form

| k (x)i = ⌦ n j=1 | k,j (x)
i , where for any j = 1, . . . , n, the vectors | k,j (x)i's are drawn i.i.d. from the uniform distribution on the unit sphere in C d . For these separable codewords we obtain

E [Q x ( ) 2 ] = h 2 d(d+1) i n , which yields n = 2d d+1 n .
This result corresponds to the quantum data locking protocols discussed in [START_REF] Lupo | Quantum data locking for high-rate private communication[END_REF]. Given a noisy channel allowing a classical communication rate , we obtain a secret-key consumption rate of k = max{1 log(1 + 1/d), log d } bits per channel use.

Application

The results reviewed in the previous section can be applied to achieve secure communication against an eavesdropper with time-limited quantum storage. Suppose Alice and Bob initially share nk bits of the secret key. They can use this secret key to lock n uses of the quantum channel. If the channel allows a classical communication rate of bits per channel use, they will be able to communicate about n bit of locked information. After a waiting time su ciently longer than the coherence time of Eve's quantum memory, Alice and Bob can run a second quantum data locking protocol. If > k, they can recycle nk bits of the previous message as a secret key for the new round of quantum data locking. Many times, by repeating this procedure, they will achieve a net rate of locked communication of r = k bits per channel use.

Discrete variable QDL

A simple non-trivial example of noisy communication is the d -dimensional erasure channel. Upon n uses of the erasure channel, Alice prepares quantum data locking codewords of the form | k (x)i = ⌦ n j=1 | k,j (x)i , where | k,j (x)i are random codewords drawn from the uniform distribution on the unit sphere in C d . Given that the channel from Alice to Bob is a memoryless qudit erasure channel with erasure probability p, they can achieve a classical communication rate (in bits per channel use) of

= (1 p) log d (4.32)
The complementary channel from Alice to Eve is also a qudit erasure channel, with erasure probability

(1 p). As discussed in the previous section, a secret-key consumption rate of k = max{1 log(1 + 1/d), log d } bits is needed for quantum data locking. In our example, the erasure channel from Alice to Eve will erase all but a fraction p of the qudits sent by Alice. This implies that the secret-key consumption rate will be also reduced by a factor p, leading to k = max{p p log(1+1/d), p log d }. For an 8 -bit channel (d = 256), the net rate of weak locking for the erasure channel, Similar results are obtained for other channels of the form ÑA!E (⇢) = (1 p)⇢ + p⇢ 0 , where ⇢ 0 is a given density operator [START_REF] Lupo | Quantum data locking for high-rate private communication[END_REF].

r = k = (1 p) log d max{p p log(1 + 1/d), ( 2p

Continuous variable QDL

We now see the application of quantum data locking to a continuous-variable quantum system. In [START_REF] Lupo | Continuous-variable quantum enigma machines for long-distance key distribution[END_REF] authors have considered the case of a lossy bosonic channel with transmissivity ⌘, where the input codewords are multimode coherent states drawn from a Gaussian distribution with N mean photons per mode. Although the quantum system has infinite dimensions, it is su cient to consider the typical subspace spanned by these random codewords. For n -mode coherent states, such a typical subspace has dimension d n ⇠ 2 ng(N ) , with g(N ) = (N + 1) log(N + 1) N log N. Here we consider a weak-locking scenario where Eve measures the complementary channel, which in this case is also a lossy bosonic channel with transmissivity (1 ⌘). Inspired by [START_REF] Pirandola | Direct and reverse secret-key capacities of a quantum channel[END_REF] we have introduced a reverse-reconciliation protocol for secret-key generation by quantum data locking. In this protocol, Alice and Bob publicly agree on a collection of measurements ⇧ k , for k = 1, . . . , K.

Then Alice locally prepares an entangled bipartite state and sends one subsystem to Bob through the quantum channel. According to the pre-shared secret key's value, Bob makes the measurement ⇧ k . This induces a virtual backward quantum channel from Bob to Alice. As shown in [6], this protocol may achieve an asymptotic classical communication rate of = g(N ) g [(1 ⌘)N 0 ] bits per mode, with N 0 = N/(1 + ⌘N ). On the other hand, weak locking can be obtained with a secretkey consumption rate of

k = 2g[(1 ⌘)N ] g [(1 ⌘)N 0 ] g [(1 ⌘)N 00
] with N 00 = (1+2⌘N )N 0 . In this way, we achieve a net weak-locking rate of r = k bits per mode which, in the limit of N ! 1 yields, for any ⌘ > 0

r = log ✓ 1 1 ⌘ ◆ + 1 (4.34)
This yields a rate larger than 1 bit per mode for any non-zero transmissivity, i.e., a constant rate of secret-key generation across arbitrarily long communication distances.

The obtained rate of weak-locking can be compared with the secret-key rate achievable assuming the standard security criterion quantified by the trace distance. For the lossy channel a lower and an upper bound on this rate are respectively given by r lb = log

⇣ 1 1 ⌘ ⌘ and r ub = log ⇣ 1+⌘ 1 ⌘ ⌘ .
Part II

Quantum Computational Hybrid Cryptography

Chapter 5

Quantum Computational Time-lock security model

Introduction

As presented in Chapter 3 the use of quantum resources enables cryptographic primitives that are not achievable with classical means such as QKD or QRNG. Theoretical quantum cryptography has largely developed around the central challenge of proposing explicit quantum and informationtheoretically-secure versions of the core cryptographic services used in our digital world. This ambitious plan has been extremely fruitful, driving the quantum cryptographic field from a small community of pioneers in the 1980s, to an established field today, exemplified by the IACR conference QCrypt and the development of a quantum industry, in which quantum cryptography is playing a prominent role. However, current QKD systems have now reached levels of performance essentially comparable to the fundamental limits on the secret capacity [START_REF] Pirandola | Fundamental limits of repeaterless quantum communications[END_REF][START_REF] Takeoka | Fundamental rate-loss tradeo↵ for optical quantum key distribution[END_REF]. This indicates the impressive technological maturity that quantum communications engineering has reached. Conversely, this also fundamentally limits our hope to experience large performance gains for QKD in the future. A fundamental challenge for theoretical quantum cryptography therefore consists in understanding the relations and trade-o↵ between security models and achievable cryptographic primitives and secure functionalities.

Extending the functionality and overcoming the performance limitations of quantum-based secure communications hence requires to consider a broader picture. This can consist of pushing further the entanglement frontier, by developing our ability to send, store and process large entangled states. Such fundamental e↵orts will be crucial for developing large-scale quantum information processing, however, it requires some complex technological challenges to be overcome.

The approach we consider in this chapter explores a complementary space: consider security models weaker than unconditional security and characterize the gain in practicality (i.e. performance and functionality, over cost). This approach requires a clear bench-marking of the security gain, with respect to classical cryptography, and the "security cost" related to the assumptions that have been introduced.

In this chapter, we propose to explore the benefits that can be taken from assuming shortterm computational security of one-way function (say AES for short). This assumption positions our work in a space outside of unconditional security. However, we want to recall here that such an assumption is more conservative than assuming the long-term security of AES. 91 This latter option is however implicitly made in the context of many QKD practical deployments [PLL + 09, SFI + 11, DLQY16, ZXC + 18], when QKD is used to renew AES encryption keys, leading to a secure communication construction that is only as secure as AES, and in which the added value of QKD is highly questionable. [PPS04, ABB + 14, Ber] We want to claim that the direction we consider here might be a rational way out of the realworld quantum cryptography conundrum: namely to explore a space of assumptions where quantum cryptography can o↵er a clear security advantage over classical cryptography, namely a world in which one-way-functions would not be long-term-secure, but could still be used at short-term, to boost the performance of quantum cryptography beyond the fundamental performance bounds [START_REF] Pirandola | Fundamental limits of repeaterless quantum communications[END_REF][START_REF] Takeoka | Fundamental rate-loss tradeo↵ for optical quantum key distribution[END_REF], that might be too restrictive for real-world use [START_REF] Sasaki | Quantum networks: where should we be heading?[END_REF].

Time-lock

A time-lock is a part of a locking mechanism commonly found in bank vaults and other highsecurity containers, designed to prevent the opening of the safe or vault until it reaches the preset time. An authorized employee of the bank can open the vault, however, any unauthorized thief or attacker trying to break in the vault cannot open it before this preset time. Combined with an extra security mechanism, such as an alarm alerting the Sheri↵, the time-lock forms a very e↵ective security mechanism. Quantum Computational Time-lock construction will essentially follow the same principle, however, in that case, a computational one-way function will play the role of the time-lock mechanism, while the decoherence (of quantum storage), plays the role of the Sheri↵.

Short term secure encryption

Definition 5.3.1 (Computationally secure encryption scheme) The encryption scheme (Gen; Enc; Dec) is computationally secure, if for all sequential polynomial-time adversaries A : {0, 1} ⇤ ! {0, 1} there exists a negligible function negl such that for all m 0 , m 1 2 {0, 1} ⇤ ,

Pr[A(Enc k (m 0 ) = 1) Pr[A(Enc k (m 1 ) = 1)]  negl(n) (5.1)
In the above definition we have used the notion of sequential polynomial time. This is the notion of polynomial time usually employed in cryptography [START_REF] Unruh | Revocable quantum timed-release encryption[END_REF] that counts all executions steps, no matter whether they are in parallel or sequential. Thus sequential polynomial time is more or less independent of the machine model, but for concreteness we specify that an algorithm is sequentialpolynomial-time if it can be implemented by a quantum circuit that is output by a probabilistic polynomial-time Turing machine (the Turing machine may run in polynomial-time in the size of both the classical and the quantum input).

Definition 5.3.2 (T -secure encryption) An encryption scheme is T -secure if it can provide computational security against an adversary accessing the encrypted message during a time, at most T.

We refer to Alice and Bob as authorized parties who have access to T -secure encryption and Eve as an unauthorized party who does not have access to T -secure encryption.

An example of T-secure encryption is the time-release encryption [START_REF] Unruh | Revocable quantum timed-release encryption[END_REF] (also-known-as timelock puzzle). Timed-release encryption (TRE) is a two-factor encryption scheme combining public key encryption and time-dependent encryption -decryption requires a trapdoor which is kept confidential by a time-server until at an appointed time. A T -timed-release encryption algorithm takes a message m and "encrypts" it in such a way that the message cannot be decrypted within time T by an "untrusted party", but can be decrypted after time T 0 > T . TRE constructions based on iterated hashing are secure against a quantum adversary [Unr].

Uncloneable encryption is a very similar notion to that of short term secure encryption. It is an encryption scheme where without the key, one cannot make a copy of the cyphertext. Unknown Recipient Encryption (URE) guarantees that if the cyphertext arrives at a recipient, he can verify that no one else got the plaintext. (The "unknown" in "unknown recipient encryption" means that it is not necessary to know the recipient beforehand, not that the recipient will be kept secret.) Proposition 5.3.1 If an encryption scheme is computationally secure, then it is also a T -secure encryption provided the adversary is sequential polynomial time limited during a time at least T .

.

Proof:

The proof of the proposition follows from Definition 5.3.1, according to which an encryption is computationally secure against sequential polynomial-time adversaries. Thus, if an adversary is assumed to be sequential polynomial-time limited for time a at least T , then the encryption scheme is computationally secure until time T . As a result, following Definition 5.3.2, the encryption scheme

(Gen; Enc; Dec) is T -secure. ⇤
Everlasting security based on shot-term computational security assumption A cryptographic protocol has everlasting security if it is secure against adversaries that are computationally unlimited after the protocol execution. As underlined in [START_REF] Unruh | Universally composable quantum multi-party computation[END_REF], such model is well suited to scenario requiring long-term security, but where we cannot predict which cryptographic schemes will be broken, say, several decades after the protocol execution. Everlasting secure communication cannot be obtained solely with classical means and computational techniques, since a classical communication can always be copied, stored, and attacked later. In [Unr10] Unruh established in a variant of the Universal Composability framework, that everlasting secure communications and general secure multi-party computation is achievable with quantum resources and using signature cards as a trusted setup.

Another recent work illustrates how the relaxation from unconditional to everlasting security can be used to strongly boost the practicality of Device-Independent QKD [START_REF] Metger | Deviceindependent quantum key distribution from computational assumptions[END_REF]. As a matter of fact, the short-term security (during protocol execution) of post-quantum cryptographic assumptions can be leveraged to relax the extremely stringent requirement for loophole-free Bell tests.

Time-limited quantum storage

Definition 5.4.1 (t coh -decohering quantum memory) A quantum memory is t coh -decohering if it's evolution can be described by a complete positive trace-preserving map N t coh : ⇢ ! N t coh (⇢), such that N t coh (⇢)

I d d 1 = O ⇣ 1 d ⌘ (5.2)
Where, the evolution N t coh is Markovian and d is the dimension of the memory.

In the above definition, we considered the evolution of the quantum storage to be Markovian, i.e., the family {N T } T >0 is a continuous one-parameter semi-group

N 0 = I and N T 1 +T 2 = N T 1 N T 2 .
(5.3)

This assumption tells that the noise in the quantum memory increases over time, and is essential to ensure that the adversary cannot gain any information by delaying the readout.

Given the technological challenges associated with quantum storage [SAA + 10], a reasonable assumption consists in assuming that the adversary is generically limited in its capacity to store quantum information. This is in contrast with QKD, which is defined under the assumption that an adversary have unlimited quantum storage and computational resources. While this assumption have laid a ground for high level of theoretical security guarantee, the former may be considered unrealistic given the current developments in quantum technologies.

The bounded-quantum storage model, introduced by Damgard, Fehr, Salvail and Scha↵ner [START_REF] Ivan B Damgård | Cryptography in the bounded-quantum-storage model[END_REF] is one di↵erent security model which assumes that the potential adversary can only store a limited amount of qubits. Furthermore, this number is assumed to grow only sublinearly with the number of bits exchanged between Alice and Bob. Thus, the security is generally proved by overflowing adversary's quantum memory. In general the assumptions of bounded quantum storage allow us to increase the resilience to noise of a QKD protocol, but the rate is not expected to improve dramatically compared to an unbounded quantum-capable eavesdropper.

This model is inspired by the classical bounded storage model, [START_REF] Cachin | Unconditional security against memory-bounded adversaries[END_REF], for which a cryptographic advantage can only provided, for key establishment, against an attacker whose memory size is less than quadratic with respect to the one of legitimate users [START_REF] Dziembowski | On generating the initial key in the boundedstorage model[END_REF], thereby limiting the impact of such model in practice, in an era where cheap classical storage has become abundant. The boundedquantum storage model allows to significantly widen the scope of cryptographic primitives that can be constructed with quantum resources, in particular Oblivious Transfer (OT), Bit Commitment (BC) and password-based identification [START_REF] Ivan B Damgård | Cryptography in the bounded-quantum-storage model[END_REF].

The noisy storage model, introduced by Wehner, Scha↵ner and Terhal [START_REF] Wehner | Cryptography from noisy storage[END_REF] provides a more realistic way to account for the di culty of storing quantum information. It assumes that the attacker has an arbitrary amount of quantum storage, whose quality, in particular, degrades with time. Assuming time-degradation of the classical capacity of the storage enables to prove the unconditional security of OT and BC [START_REF] Konig | Unconditional security from noisy quantum storage[END_REF], while entanglement sampling technique allows to extend the validity of the noisy storage to the case where the time-limited bound applies to the quantum capacity [START_REF] Dupuis | Entanglement sampling and applications[END_REF]. The notion of time-limited quantum memory is similar to the noisystorage model [START_REF] Wehner | Cryptography from noisy storage[END_REF]. The assumption of bounded quantum storage deals with the noiseless case (but assumes a small amount of storage), whereas the noisy-storage model deals with the case of noise (but possibly a large amount of storage). New protocols for bit commitment and oblivious transfer based on weak string erasure have been constructed in this security model, and the security is proved against arbitrary attacks [START_REF] Wehner | Cryptography from noisy storage[END_REF].

Another recent line of work, called Quantum data locking (QDL), is based on the even stronger assumption that quantum storage fully decoheres after some time limit. Relying on a pre-shared secret, legitimate users can then leverage the information locking property to design secure communication schemes, that rely on the time-limited quantum storage assumption to impose that the attacker is limited to accessible information. This assumption is in general not composable with the plain quantum security model of QKD. Di↵erent QDL constructions can then be used to upper bound this accessible information. A first category relies on to single-photon encoding [GHK + 14b] and has been experimentally demonstrated [LHA + 16], with however standard (QKD-like) limitations in terms of loss-tolerance while requiring greater experimental complexity. A second category relies on continuous-variable encoding, and could in principle be used to reach quantum data locking secure rates close to the classical capacity [START_REF] Lupo | Quantum data locking for high-rate private communication[END_REF]. However such constructions resort to random coding arguments for which practical implementation with structured measurement is not possible.

QCT security model

Model Assumptions As proposed in 2015 [START_REF] Alléaume | A hybrid security model for quantum cryptography allowing to design practical schemes for long-distance key distribution with everlasting security[END_REF] a novel security model that we later coined as Quantum Computational Timelock (QCT) security model. It is depicted on Figure 5.1 and consists of two nested assumptions: Definition 5.5.1 (QCT security model) It consist of two assumptions, 1. Alice and Bob are assumed to have access to a public authenticated classical channel and to an encryption scheme that is computationally secure with respect to any unauthorized attacker Eve for a time at least t comp after a cyphertext is exchanged on the classical channel.

2. Eve's d-dimensional quantum memory is t coh -decohering with t coh << t comp . Seeing the quantum memory as a channel, it can be written as as a time-dependent and complete positive trace-preserving map N t : ⇢ ! N t (⇢), as defined in Equation 5.2.

It is interesting to note that these two categories of assumptions, namely short-term computational security [START_REF] Unruh | Revocable quantum timed-release encryption[END_REF] and noisy quantum storage [START_REF] Konig | Unconditional security from noisy quantum storage[END_REF], have so far already been considered in quantum cryptography, yet only disjointly.

In the QCT Security Model we need some initial authentication between Alice and Bob, (See the Section 6.2 where the key establishment protocol based on QCT security model is described). This initial authentication can be based on an authenticated channel (which is an assumption then). Another alternative requires distributing a shared secret (with correct authentication) for authenticating communications over a public channel. In the latter case, the assumption is then about the ability to share an initial secret, with authentication.

Definitely we want the encryption scheme to be short term secure against a quantum computer. However, we did not specify on the kind of encryption schemes that can be considered under the QCT model assumptions. We can refine this QCT model assumption by considering that the shortterm secure encryption (be it based on a symmetric or asymmetric scheme) is quantum secure, i.e. secure against a quantum computer.

The QCT security model explores a space of assumptions, namely, a world in which encryption schemes would not be long-term-secure but could still be used in short-term. Secondly, the optical quantum memories are technologically bound to decohere within a timescale shorter than when the encryption scheme is secure. The objective of this security model is to construct cryptographic protocols that can boost quantum cryptography's performance beyond the fundamental performance bounds [START_REF] Pirandola | Fundamental limits of repeaterless quantum communications[END_REF][START_REF] Takeoka | Fundamental rate-loss tradeo↵ for optical quantum key distribution[END_REF], that might be too restrictive for real-world use [START_REF] Sasaki | Quantum networks: where should we be heading?[END_REF].

Rationale of the QCT security model

The Quantum Computational Timelock (QCT) approach intends to reduce the divergence between practical and theoretical quantum cryptography and address the associated dilemma described in the previous subsection by devising a hybrid security model. This QCT security model is positioned between the "absolute security model" used in QKD, where no assumptions limit the power of the attacker concerning the quantum channel (where some trust assumptions 1 must be fulfilled to guarantee the security of endpoints), and classical cryptographic security models based on computational hardness assumptions, that also require trusted classical hardware at the endpoints.

The rationale for the QCT security model is also rooted on a central observation: quantum cryptographic functionalities can in the broad sense be guaranteed assuming the existence of computational long-term-secure one-way-function [START_REF] Goldreich | Foundations of cryptography: volume 2, basic applications[END_REF][START_REF] Anssi | Should quantum key distribution be used for secure communications?[END_REF]. This conversely implies that a quantum cryptographic advantage can only arise in stronger models, i.e. in security models where long-term computational security of one-way function (and therefore encryption) does not hold.

Validity of QCT security model

Validity of short term secure encryption assumption

The first assumption is reasonable to make as it only requires computational encryption to be secure for a short time, unlike classical cryptographic protocols, which assume that encryptions are di cult to break even after a very long time. The assumption is more conservative in assuming the long-term 1 devices in Alice and Bob's lad are assumed to work exactly according to their specifications, and are shielded, i.e., they do not leak any information from leaking out of the lab. security of encryption schemes like AES, which for instance, is assumed to be secured for the time of the order of 10 9 sec i.e., ⇡ 30 years [START_REF] Hathaway | National policy on the use of the advanced encryption standard (aes) to protect national security systems and national security information[END_REF]. This latter option is however implicitly made in the context of many QKD practical deployments [PLL + 09, SFI + 11, DLQY16, ZXC + 18], when QKD is used to renew AES encryption keys, leading to a secure communication construction that is only as secure as AES, and in which the added value of QKD is highly questionable. [PPS04, ABB + 14, Ber].

Definitely we want the encryption scheme to be short term secure against a quantum computer. However, We did not specify on the kind of encryption schemes that can be considered to be t compsecure. We can refine this QCT assumption by considering either public-key encryption scheme or secret-key encryption scheme to be short-term secure (against a quantum computer).

Advantages of considering public-key encryption schemes for short term secure computational assumption is that no shared initial secret key is required to start the key establishment protocol. Authentication of the classical channel and secret information sharing between authenticated parties can be done using the same public keys. Moreover, public-key encryption schemes are specifically beneficial when multiparty key distribution is desired. Unfortunately, there are no known constructions for public-key encryption schemes that are secure (even short-term secure) against a quantum computer.

Advantages of using symmetric-key encryption schemes for short term secure computational assumption is that there are no publicly known quantum attacks on classical symmetric-key cryptographic schemes and the cryptanalysis of symmetric-key classical cryptography on a quantum computer reduces to exhaustive search. Performing exhaustive key search given a known plaintext-cyphertext pair corresponds to the problem of finding an element in an unsorted database of N elements. The complexity of this problem is of O(N ) on a classical computer but only of O( p N ) on a quantum computer.

Validity of time-limited quantum storage assumption

The practical implementation of an attack by an adversary on the time-limited quantum storage assumption will require e cient quantum storage with coherence time greater than the computational time (t coh > t comp ), i.e., an adversary needs to be able to store quantum information for a time greater than the time for which encryption is assumed to be secure, and retrieve it on-demand later. A natural question to be asked is how plausible it is to achieve this requirement?

To provide the answer, in this section, we discuss today's quantum storage capabilities, by analyzing di↵erent experimental demonstrations of state of the art quantum memories. For the comparison, we only consider those experimentally demonstrated quantum memories,

• Which have shown storage of optically interfaced quantum light

• Storing light at a single photon level (quantum regime).

Based on the approach to light-matter coupling, we categorize quantum memories into two categories.

Single-atom-based quantum memories:

The first is a single-atom-based quantum memory, where a single atom is placed in a highly reflective optical cavity. Light shining into the cavity repeatedly reflects from its mirrors which can dramatically increase the absorption of an incoming photon. Based on di↵erent approach to design the quantum memory we briefly discuss following quantum memories: • Trapped ions: Memories such as trapped ions: have been shown to exhibit long coherence times on the order of 10 min [WUZ + 17] though, not optically interfaced. Nevertheless, these memories can be optically interfaced by tuning the optical resonator's frequency near an atomic transition to create a dipole coupling between the atoms and the cavity field. For storage of photonic qubit in a single atom, the overall storage and retrieval e ciency of 16% for coherence time of 139µs was recorded [LMR + 11].

• Nuclear spin: Quantum memory based on solid-state nuclear spin systems, such as Silicon-vacancy centres (SiVC) in diamonds have shown a coherence time of 115ns [PJH + 17].

For Nitrogen-vacancy centers (NVC) in diamonds an experiment was proposed [START_REF] Lai | Single-nitrogenvacancy-center quantum memory for a superconducting flux qubit mediated by a ferromagnet[END_REF], which o↵ers to achieve a coherence time of 40ns with an overall e ciency of 25%. A detailed review of optically interfaced solid-state quantum memories can be found here, [ACB + 18].

• Cavity QED: Superconducting circuit QED are hybrid systems that have shown to exhibit a coherence time up to 100s [START_REF] Devoret | Superconducting circuits for quantum information: An outlook[END_REF]. However, since microwave photons are not well suited for long-distance communication, an optical-to-microwave interface is needed which introduces noise due to optical interactions. Heralded transfer of a polarization qubit from a photon onto a single atom with 39% e ciency and storage time of 3µs was realized [START_REF] Kalb | Heralded storage of a photonic quantum bit in a single atom[END_REF].

Ensemble-based quantum memories:

Another approach is the ensemble-based quantum memories or the collective coupling. An ensemble of atoms is prepared in the ground state which is in a large superposition. The incoming photon is absorbed by the ensemble such that the state of the photon is delocalized over all the atoms in the ensemble. The collective state is then e ciently converted back into a single photon with a well-defined direction. We also report the storage and retrieval e ciency of these memories. These memories have preferential importance due to their strong light-matter coupling and high bandwidths. The collective state in an ensemble of atoms is more robust to environmental dephasing. A large ensemble facilitates storing multiple photons in a single memory. A list of techniques has been deployed to develop such quantum memories.

• Raman Schemes: Warm vapor Raman memory schemes have been used to e ciently store GHz-bandwidth photons for up to nanoseconds with an e ciency of 30%[RNL + 10, CCE + 16b] and with cold atoms, the e ciency is of 65% with coherence time 60 µs [VGTE + 18].

• Electromagnetically Induced Transparency (EIT): Electromagnetically Induced Transparency (EIT) is an optical phenomenon in atoms that uses quantum interference to induce transparency into an otherwise resonant and opaque medium. For quantum memory application using EIT, the coherence time was recorded up to 54 µs with an e ciency of 56%[CLW + 13].

Both EIT and Raman memory schemes are optically controlled quantum memories, where a strong optical pulse is used to induce the absorption of photons into the storage medium. The main challenge of optically controlled quantum memories is the noise, in particular, as the single-photon level signal is emitted with a strong control beam, due to which the residual control beam becomes a serious source of noise in the single-photon signal band.

Another important scheme of quantum memory is called engineered absorption, which is based on the photon echo e↵ect. There are two important approaches in this scheme:

• Gradient Echo Memories GEM: Memories designed using the GEM method have shown very high e ciency up to 90% with coherence time-limited to 100 µs. Laser-cold atoms used for GEM have produced an e ciency of 87% with a coherence time of 0.6 ms[CCE + 16a].

• Atomic Frequency Combs (AFC): Solid-state AFC has shown lifetime storage up to few hundreds of ms, however, the e ciency is very low [OTW + 18, HEK + 20].

• Optical Cavity: An optical cavity is an e↵ective method to enhance atom-light coupling strength. The cavity retains the photon and releases it when needed. The main advantages of a cavity-based quantum memory are its simple and inexpensive configuration and the very broad working wavelength range. However, due to the loss of the cavity, it cannot provide a long storage time. It has shown the e ciency of 72% with the coherence time of 110 µs

[EVGC + 18].
Figure 5.2: Validity of QCT security model with respect to existing computational hardness assumption for AES and demonstrated quantum storage coherence time at single photon level. For example, assuming t comp > 10 5 sec, seems safe.

Analysis

A practical lower bound on the value of t comp can be inferred from assumed long-term security of the AES256 encryption scheme, that is considered to meet the requirements for long-term (30 years) confidentiality of Top Secret data [START_REF] Hathaway | National policy on the use of the advanced encryption standard (aes) to protect national security systems and national security information[END_REF].

Regarding the coherence time of optically addressable quantum memory, as reviewed in above section, experimental demonstrations of storage and then retrieval of optically encoded quantum information, at single photon level. This indicates that the value of t coh ranges from a few nanoseconds to microseconds [SAA + 10].

Given the large gap between the upper bound on t coh and lower bound on t comp , the validity of the QCT security model can be assumed with a very high confidence today. This also leaves a considerable margin for its validity in the future. Finally, it has to be noted that aim here to build a key distribution protocol with everlasting security, which means in particular that the validity of the QCT security model only needs to hold at the time of protocol execution to provide information-theoretic security in the future. A comparison of e ciency and coherence time of di↵erent optical quantum memory systems is shown in Table [5.1]. Thus, assuming, for example, t comp = 10 5 s ⇠ 1 day, leaves a reasonable security margin with respect to the state of art in quantum storage capabilities, as shown in Figure 5.2.

Objectives of the QCT security model

The objective of the QCT security model is to enable performance and functionality improvements in quantum cryptography, while maintaining a clear advantage with respect to both classical cryptography (based on computational assumptions) and with respect to QKD.

• Security gain over classical cryptography. As we shall use the QCT approach to build a key establishment scheme, called MUB-QCT (presented in the next Chapter) the resulting protocol cannot be unconditionally secure due to the nature of the QCT assumptions. However, the model is crafted to enable everlasting security. This means that the established keys can be provably secure against a computationally unbounded adversary, provided that the initial ephemeral encrypted communication is not broken by an adversary within a time shorter than the decoherence time of its available quantum storage (at protocol execution time). Such security level is impossible to reach only with classical means 2 .

• Improvement of the performance envelope, with respect to QKD and more broadly to repeaterless quantum secret capacity fundamental bounds [START_REF] Pirandola | Fundamental limits of repeaterless quantum communications[END_REF]. This improvement will be sought by considering constructions where security can be proved in the regime where Alice sends multiple copies of the same quantum state to Bob, thereby increasing rates and loss tolerance with respect to discrete-variable QKD, whose security fundamentally relies on no-cloning and therefore forbids the emission of multiple copies. We will also target improvements in terms of practical security, stemming from reduced trust requirements associated with constructions in the QCT paradigm.

2

The reason this lies in the definition of the everlasting security itself, where the unconditional security is guaranteed against an (passive) adversary who is computationally bounded during the execution of the protocol and computationally unbounded after the execution of the protocol. While following a classical cryptographic protocol a passive adversary can make copies of the classical information and stores them. After the execution of the protocol, the adversary can perform parallel computations using unlimited computational power and resource, and thus, in principle can break the security.

Chapter 6

From QCT to a Key Establishment Protocol

Introduction

In this chapter we discuss key-establishment in Quantum Computational Timelock (QCT) security model. The newly proposed key-establishment protocol is called as "MUB-QCT", where we use Mutually Unbiased Bases as the important ingredient to construct the key-distribution protocol.

We first present a general structure of constructing a cryptographic construction in the QCT security model in the Section 6.2. We also discuss the eavesdropping model in the QCT security model and define the security parameters to prove the security of a key distribution in the QCT security model. In Section 6.3.1 and Section 6.3.2, we describe the explicit MUB-QCT key distribution protocols.

Key establishment from QCT security model

Using the QCT security model we propose a generic cryptographic construction for key establishment. We refer to Alice and Bob as authorized parties who have access to t comp -secure encryption and Eve as an unauthorized party who does not have access to T -secure encryption.

In a generic key-establishment framework, authorized parties, Alice and Bob, want to exchange a bit(s) x 2 X reliably while guaranteeing that an unauthorized Eve can only learn a negligible amount of information about x. Alice and Bob are assumed to have access to an authenticated classical communication channel or the ability to exchange a small secret in an authenticated way. In this setting, to establish the secure keys, Alice and Bob perform following steps

• Setting a computational time-lock: Alice and Bob, that are assumed to have access to the t comp -secure encryption scheme (Enc; Dec), use it to time-lock the classical secret s 2 S

• Quantum communication: The second step consists of an encrypted quantum communication phase, where Alice encodes the random bit x using the secret s as

| s x i = U s |xi (6.1)
and sends the state to Bob via an insecure quantum channel. Bob performs the projective measurement on the quantum state | s x i, using s, and obtains y 2 Y, which with high probability reconciles with x, as shown in Fig ( 6.1a). 103 Figure 6.1: A general protocol describing QCT construction in QCT security model. Protocol is defined between authorized parties Alice and Bob, and an unauthorized party Eve. Alice encodes the classical message x on a quantum state ⇢ x , using the secret s, and send it over the quantum channel. Objective for both Bob and Eve is to guess x given ⇢ x and Enc(s). Bob measure it immediately using the measurement operator M s y , obtaining the outcome y. However, assumptions of QCT security model forces Eve to measure the quantum state ⇢ x before t coh using the POVM ⇧ ! to obtain classical outcome ! and perform post-measurement classical decoding at time t t comp to guess z.

Key establishment protocol in QCT security model

We now consider a simple protocol describing a key establishment in the QCT security model. The protocol is defined for a single quantum channel use as, Protocol 1 Quantum Computational Time-lock Key Establishment Input: Alice: (Enc, Dec, x 2 X , s 2 S), Bob:

(Enc, Dec, s, | s x i), Eve: (Enc, Dec, ⇢ x ). Output: Alice: x 2 X , Bob: y 2 Y, Eve: z 2 Z • Alice:
1. Input: bit x 2 X , a secret s 2 S. 2. Set a computational time-lock Enc(s) and sends it to Bob. 3. Encodes the bit x on a d-dimensional quantum state as ⇢ xs = | s x ih s x |, using the secret s, and sends it to Bob.

• Bob:

1. Decrypts Enc(s) using Dec, to obtain s. 2. Performs projective measurement on ⇢ xs using s, and outputs a bit y 2 Y.

Eavesdropping model: reduction to wiretap channel setting

In the QCT construction, authorized parties, Alice and Bob, are connected via a authentic classical channel and an insecure quantum channel. As mentioned before, Alice and Bob use the computational assumptions to exchange the key for the authentication of classical channel. An adversary, Eve, is assumed to have full access to the input of Alice and Bob's communication channels. Every classical (quantum) message communicated between Alice and Bob over the classical (quantum) channel can be wiretapped by Eve and stored in classical (quantum) memory.

As a consequence of this setting, Alice and Bob have access to a realization of correlated classical random variables X and Y , respectively, whereas an adversary, Eve, obtains a random variable Z. Moreover, Eve has no information about X and Y other than through her knowledge of Z. Under this setting, Alice and Bob can distill a secret key from their shared correlation by performing classical post-processing using a suitable universal 2 hasg function [START_REF] Carter | Universal classes of hash functions[END_REF][START_REF] Bennett | Generalized privacy amplification[END_REF]. With this setting for Eve's channel, we are in a similar set-up as strong data locking [START_REF] Lupo | Quantum data locking for high-rate private communication[END_REF], whereas an adversary Eve receives direct inputs from Alice.

However, for an unauthorized adversary Eve, the classical secret s is time-locked until time t comp . The input state received by the Eve is

⇢ x = 1 |s| X s ⇢ xs . (6.2)
As a worst-case scenario, Eve can mount her attack using a copy of the input state ⇢ x . However, she cannot store quantum information during time longer that t coh < t comp and hence must measure state without knowing s as depicted in Figure 6.1(b). Her measurement ⇧ ! on ⇢ x gives classical outcome !. Later at time t comp , when the time-locked encryption

MUB-QCT protocol

In this section we study key agreement protocol that we called MUB-Quantum Computational Timelock (MUB-QCT), where a classical bit x is encoded on a d-dimensional quantum state (qudit). The protocol leverages the QCT security model to transmit an ephemeral secret S between Alice and Bob. This secret S is then used to unitarily randomize the qudit state (twirling operation) using a full set mutually unbiased bases (MUBs).

Notations: We make use of the following notation: for an integer d, we denote a set of d elements {0, . . . , d 1} as [d]. Any random variable is denoted by a capital letter, for example X, with probability distribution P X over a finite alphabet X . The realization of X is denoted by the lowercase letters x, for x 2 X . We denote vectors in superscript face: for example

x n := (x 1 , . . . , x n ), x n 2 X n .
Parameters: The m-MUB-QCT-(b, c) key distribution protocol is parametrized by the following parameters

• b : number of bits encoded on a d-dimensional quantum state.

• c : the classical capacity of the encoding.

• m : number of copies of the qudit state sent per channel use.

Ingredients: An essential element of the MUB-QCT protocol will consist in randomizing one of the basis states of a d-dimensional Hilbert space using set of unitaries:

• A complete set of d + 1 mutually unbiased bases (MUB), in dimension d. We index this set by ✓ 2 [d + 1] and will denote {U ✓ } the unitary operations that transforms the computational basis into the di↵erent MUB basis indexed by ✓.

• A full set of pair-wise independent permutations {P }, 2 [|P|] . A family P of permutations of a set of d elements [d], is pair-wise independent if for all i 1 6 = i 2 and j 1 6 = j 2 , and for chosen uniformly over P one has, Pr

{ (i 1 ) = j 1 , (i 2 ) = j 2 } = 1 d(d 1)
. The total number of pair-wise independent permutations for a set of

d-elements is |P| = ( d d/2 ) 2 ⇠ 2 d 1 for large d.
Di↵erent Protocols: Based on the number of bits encoded on a d-dimensional quantum state and the number of copies of the qudit state sent per channel use, we propose di↵erent versions of MUB-QCT protocol.

• In section 6.3.1, we propose 1-MUB-QCT-(log d, log d) protocol, where for a single copy of quantum state sent per channel use log d bits are encoded on a qudit, using a full set of MUBS.

• In section 6.3.2 we propose 1-MUB-QCT-(1, log d) protocol, where for a single copy of quantum state sent per channel use a bit is encoded on a qudit, using a full set of MUBS and a full set of pair-wise independent permutations. We consider a noisy and lossless quantum channel setting. However, the generalization to the case of a lossy quantum channel could be addressed relatively simply, by adding a sifting phase,.

1-MUB-QCT-(log d, log d) protocol

Encoding at Alice

• Setting a computational timelock: Alice picks ✓ at random in [d + 1]. The information S = ✓ is sent from Alice to Bob using a short-term-secure encryption scheme. S constitutes a computational timelock, i.e. a classical secret shared between Alice and Bob, but not available to Eve during time at least t comp .

• Quantum communication Given an input bit x 2 [d], Alice generates the state U ✓ |xi and sends it to Bob

We will denote the state encoded by Alice and inputted on the quantum channel as

| ✓ x i = U ✓ |xi (6.3)
Decoding at Bob Bob's decoding strategy is fixed in order to o↵er perfect correctness over a ideal quantum channel. It corresponds to the following operations:

• Knowing S = (✓) , Bob unitarily transforms the received state back into the standard basis, by applying U ✓ ) † to his received state

} ✓ y2[d] with M ✓ y = X ✓ (U ✓ )(|yihy|)(U ✓ ) † ) (6.4) Protocol 2 1-MUB-QCT-(log d, log d) Protocol Input: Alice: (x n 2 [d] n , ✓ n 2 [d + 1] n Bob: (Enc(✓ n ), Dec, ⇢ x✓ ). Output: Alice: (S A = x `2 [d] l ), Bob: (S B = y `2 [d] l
) The protocol:

1. Data generation:

• Alice chooses x n 2 [d] n and ✓ n 2 [d + 1] n , uniformly at random.

Time lock:

• Alice time locks ✓ n using a time-lock encryption scheme Enc, and sends it to Bob.

• Bob decrypts it immediately using the decryption function Dec, to obtain ✓ n .

3. Quantum communication:

• For (i = 1; i  n; i + +) -State preparation: Alice prepare a qudit state ⇢ x✓ = | ✓ x ih ✓ x |, Equation (6.3).
-Distribution: Alice sends the quantum state ⇢ x✓ , to Bob.

-Measurement: Bob measures each quantum state using a POVM, M ✓ y , and outputs the result

y i 2 [d].
• After n iterations (channel use) Alice and Bob obtains a string (x n ; y n ) 4. Parameter estimation:

• Alice chooses a sub-string, of length ñ < n from x n and sends to Bob the corresponding positions and values of the string.

• Bob compares this substring to the corresponding one in his output y n and announces the result.

• Alice and Bob use the result to estimate the error probability np e (where p e is the estimated error probability per channel use, as calculated in Appendix B). They abort the protocol if the estimated error exceeds a threshold value " P E (predefined by Alice and Bob), otherwise they accept the protocol and outputs (x ñ; y ñ), for ñ < n.

Information Reconciliation and Privacy Amplification:

• Error correction: To correct the errors, Alice and Bob use an error correcting code [START_REF] Carter | Universal classes of hash functions[END_REF] that minimizes the leak to the Eve, given the parameters of code and the estimated error " P E . The error correction outputs error corrected keys (x n 0 ; ŷn 0 ). Alice and Bob then verify whether their keys are identical, using universal hashing on a small subset of the error-corrected strings. The over all error correction procedure succeeds except with a small probability " EC .

• Privacy amplification: Finally Alice and Bob uses a privacy amplification protocol based on universal hashing [START_REF] Bennett | Generalized privacy amplification[END_REF] to transform the error-corrected keys into the final secret keys S A = S B = S.

1-MUB-QCT-(1, log d) protocol

We shall call A = A 1 A 2 be the d dimensional Hilbert space used in the protocol, with d a power of 2. We also denote {|xi} : x 2 {0, 1} and {|ri} : r 2 [d/2] the (standard) orthonormal bases of A 1 and A 2 respectively. The encoding vector basis on A is defined as

i xr ⌘ d 2 ⇥ x + r and noted {|i xr i} x2{0,1},r2[d/2] .

Encoding at Alice

• Setting a computational timelock: In order to construct the cryptographic primitive, Alice picks ✓ and at random in

[d + 1] ⇥ [|P|].
The information S = (✓, ) is sent from Alice to Bob using a using a t comp -secure encryption scheme. S constitutes a computational timelock, i.e. a classical secret shared between Alice and Bob, but not available to Eve during time at least t comp .

• Quantum communication Given an input bit x 2 {0, 1}, Alice generates (locally at random) r in [d/2] and sends the state P U ✓ |i xr i to Bob

We will denote the state encoded by Alice and inputted on the quantum channel as

| ✓, ix,r i = P U ✓ |i x,r i (6.5)
Decoding at Bob Bob's decoding strategy is fixed in order to o↵er perfect correctness over a ideal quantum channel. It corresponds to the following operations:

• Knowing S = (✓, ) , Bob unitarily transforms the received state back into the standard basis, by applying (P U ✓ ) † to his received state

• Bob implements a two-outcome projective measurement in the standard basis, corresponding to POVM {M y } y=0,1 with M y = P d/2 r=1 |i y,r ihi y,r | Bob's global decoding strategy can thus be represented by a two-outcome projective measurement {M y } ✓ y=0,1 with

M ✓ y = X ✓, (P U ✓ )( d/2 X r=1 |i y,r ihi y,r |)(P U ✓ ) † ) (6.6) Protocol 3 1-MUB-QCT (1,log d) Protocol Input: Alice: (x 2 {0, 1} n , ✓ 2 [d + 1] n , 2 [|P|] n , r 2 [d/2] n ), Bob: (Enc(✓ n , n ), Dec, ⇢ x ). Output: Alice: x `2 {0, 1} `, Bob: y `2 {0, 1} `.
The protocol:

1. Data generation: Alice chooses (x n , ✓ n , n , r n ), uniformly at random in {0, 1} n ⇥ [d + 1] n ⇥ [|P| ⇥ [d/2] n
2. Timelock: Alice and Bob exchange timelocked information (✓ n , n

) using short-term secure encryption scheme (Enc, Dec).

Quantum communication:

For (k = 1; k  n; k + +)
• Encode and send x over a qudit: Alice sends a single copy of the qudit state | ✓, x k ,r k i to Bob over the quantum channel.

Short term secure key

" !"#(%, ') #$% & ', )
', )

!"#(%, ')

ρ ! * Eve Quantum Storage t + !"# + !"$% Measure ! ! Immediately , - . & Classical Decoding !"#(%, ') !"#(%, ') ', ) /0% ρ ! 1 ' ()
Measurement using 2 detectors 0 1

Alice Bob

Figure 6.3: A general overview of MUB-QCT protocol. Communication between authorized Alice and Bob (in green). Technologically limited Eve (in yellow) cannot break timelocked encryption before t comp and can only store quantum state in quantum memory during time t coh < t comp . As a result, forcing Eve to measure ⇢ x immediately. At a later at time, after t comp , time-locked encryption elapses, and Eve learns (✓, ) and performs classical decoding to obtain z.

• Receive qudit and decode y: Upon reception of the qudit state at the quantum channel output and knowing (✓ k , k ) Bob performs the measurement {M y } ✓ k k and obtains outcome y k .

4. Classical post-processing:

• Parameter estimation: Based on a random sampling of (x n , y n ) Alice and Bob estimate the bit error rate n.p e (Where, p e is the error rate per channel use). If n.p e is below some set threshold " th , they abort.

• Finally Alice and Bob run an error correction algorithm followed by privacy amplification (PA) to obtain the final keys (S A ; S B ), of length `.

MUB-QCT with multiple quantum state copies

In this section, we explore the MUB-QCT protocol with multiple copies of the quantum state per channel use. The motivation is to explore if the MUB-QCT protocol o↵ers high tolerance to the channel loss incurred at long-distance by transmitting multiple photons per channel use i.e., more than one copy of quantum state per channel use. We propose MUB-QCT protocol with multiple copies per channel use, namely m-MUB-QCT-(log d, log d) and m-MUB-QCT-(1, log d) protocols.

m-MUB-QCT-(log d, log d) Protocol

Alice prepares m copies of the qudit state, | ✓ x i, using same basis ✓ . She send the state ⇢ (m) x to Bob over a quantum channel, where,

⇢ (m) x = 1 |✓| X ✓ ⇣ | ✓ x ih ✓ x | ⌘ ⌦m . = 1 |✓| X ✓ ⇣ U ✓ |i x ihi x |U ✓ ) † ⌘ ⌦m . (6.7)
Alice and Bob then follow the rest of the protocol as defined in Protocol 2.

m-MUB-QCT-(1, log d) protocol

Alice prepares m copies of the qudit state, P U ✓ |i xr ihi xr |(P U ✓ ) † , using same basis ✓, permutation , and local randomness r. She send the state

⇢ (m) x
to Bob over a quantum channel, where,

⇢ (m) x = 1 |r||✓|| | X r,✓, ⇣ P U ✓ |i xr ihi xr |(P U ✓ ) † ⌘ ⌦m . (6.8)
Alice and Bob then follow the rest of the protocol as defined in Protocol 3.

Security against photon number splitting attack

This section presents how, unlike QKD protocol [HIGM95, L 00], the MUB-QCT protocol in the QCT security model o↵ers security against the photon number splitting attack (Section 3.2.4). As a result, we can understand why multiple copies per channel use of the same quantum state can be sent in the MUB-QCT protocol. One way to overcome the channel losses at large distance is by sending multiple copies of single photons per channel use. However, the situation completely changes when sending multiple copies of single photon. For a source to emit multiple copies with identical encodings in a given run of the key distribution protocol, an eavesdropper who employs the photon number splitting (PNS) attack can be a security vulnerability. The essential idea behind the attack is that Eve can perform a quantum non-demolition measurement to determine the number of photons in a run. If the pulse contains more than one photon, then Eve can split o↵ the extra photons and transmit the remaining single photon to Bob. Eve can store these extra photons in a perfect quantum memory until Alice reveals the encoding basis. Eve can then measure her photons in the correct basis and can obtain information of the key without introducing detectable errors. In this way Bob would not be able to detect her presence while she lies in wait for Alice's basis revelation to make sharp measurements of the stolen photons and obtain perfect information of the multi-photon runs.

In order to protect against a PNS attack and maximize both the key generation rates and the possible distance over which QKD can be used, 'decoy states' (Section 3.2.4) have been introduced. The decoy states are weak coherent pulses with di↵erent mean number of photons. Since Eve cannot distinguish between decoy pulses and real QKD pulses, she attacks all pulses; Alice and Bob can then identify a PNS attack by comparing the gain and quantum bit error rate (QBER) for the di↵erent decoy states. However, the maximum achievable key rate for QKD with decoy state is limited to ⌘/e, which is even less than single photon QKD:BB84 .

We derive our motivation from this limitation and aim to construct the MUB-QCT protocol, which embraces sending multiple copies of a single-photon, in the QCT security model (Chapter 5). In this situation, the security of any key distribution protocol against PNS attack follows intrinsically 1. Correctness: The protocol is " cor -correct if, for S A , S B , and

" cor > 0, P r[X 6 = Y ]  " cor (7.1)
2. Secrecy: The protocol is " sec -secret if for " sec > 0

I(X; Z)  " sec (7.2)

Security of 1-MUB-QCT-(log d, log d) protocol

Recall from section 6.3.1, in the 1-MUB-QCT-(log d, log d) protocol, to generate a secure key with Bob, Alice encodes log d bits on a d-dimensional quantum system using a full set of (d +1) Mutually Unbiased Bases (Definition 1.33). She chooses a mutually unbiased base U ✓ for ✓ 2 [d + 1] from a full set of d + 1 MUBs. Using a short-term secure encryption scheme she exchange Enc(✓) with Bob. She then encodes log d bits i.e., x 2 [d] onto a d-dimensional qudit as

⇢ x = 1 |✓| X ✓ U ✓ |xihx|U † ✓ (7.3)
Alice sends this state to Bob, who on receiving this state performs a measurement using operators M ✓ y defined by the time-locked information ✓ as

M ✓ y = X i U ✓ |yihy|U † ✓ (7.4)
and obtains an outcome y 2 [d].

Optimal attack strategy for Eve

For an unauthorized Eve, the secret ✓ is time-locked until t comp , while her quantum storage fully decoheres within t coh < t comp . Thus on receiving the state ⇢ x Eve could perform following strategies:

I Eve performs an immediate measurement at time t = 0, using a POVM ⇧ ! , obtain a classical outcome !. At t comp when time-lock encryption elapses, she obtains the secret ✓ and perform post-measurement classical decoding using ✓ and ! to obtain z 2 Z.

II Eve stores the quantum state ⇢ x in her quantum storage and wait for time-locked encryption to elapse. At t comp , when she receives the secret ✓, she decodes the key bit by performing the measurement on N tcomp (⇢ x ) using the secret ✓ to obtain z 2 Z.

Proposition 7.2.1 In MUB-QCT, under the assumptions of the QCT security model, the optimal attack strategy of an adversary Eve is to perform immediate measurement on all incoming quantum states followed by post-measurement decoding.

Proof: If Eve follows strategy I, and opts to measure the state N tcomp (⇢ x ) at t comp , then following the assumption of the QCT security model the quantum state left in her memory at time t comp is

1 2 N t coh (⇢ x ) I d d 1  o ⇣ 1 d ⌘ (7.5)
As a result following [START_REF] Renner | Security of quantum key distribution[END_REF], the best success probability to guess the value of x 2 [d] correctly follows as

P I  1 d + o ⇣ 1 d ⌘ (7.6)
However, If Eve chooses to follow the strategy II, then the optimal immediate measurement strategy followed by a post-measurement decoding for Eve is the "state discrimination with postmeasurement information" as described in [START_REF] Gopal | Using postmeasurement information in state discrimination[END_REF]. For this strategy the best measurement corresponds to a POVM ( ⇧⌦ ), with |X | |✓| outcomes, each labeled by the |✓| long binary strings

⌦ = ! 0 , . . . , ! |✓| , for ! ✓ 2 X = [d]
. Such that, when the time-locked encryption elapses and the information about the pair ✓ is revealed, Eve applies the following map f ✓ on the string ⌦, which corresponds to an output z = f ✓ (⌦) i.e., the assignment is done by selecting the value ! ✓ corresponding to ✓. Finally, Eve guesses the value of x from the output z. Following Equation (1.52), is calculated as

P guess = max ⇧⌦ 1 |x||✓| X ⌦ Tr ⇣ ⇧⌦ X ✓ ⇢ ! ✓ ✓ ⌘ Where, ⇢ ! ✓ ✓ = |e ✓ ! ✓ ihe ✓ ! ✓ | = max ⇧⌦ 1 |x||✓| X ⌦ Tr ⇣ ⇧⌦ F(⌦) ⌘ Where, F(⌦) = X ✓ ⇢ ! ✓ ✓  max ⇧⌦ 1 |x||✓| X ⌦ ⌦ Tr ⇣ ⇧⌦ ⌘  |x||✓| max ⇧⌦ X ⌦ Tr ⇣ ⇧⌦ ⌘ = d |x||✓| = d + 1 . (7.7)
Where, ⌦ is the maximum eigenvalue of F(⌦) and is the maximum of all { ⌦ } for an ensemble of {F(⌦)}. The last two inequalities follow from [Proposition 2, [START_REF] Carmeli | State discrimination with postmeasurement information and incompatibility of quantum measurements[END_REF]]. Now the calculation for guessing probability is translated to the problem of finding the maximum eigenvalue .

We calculate the maximum eigenvalue using di↵erent methods:

• Numerical simulation

We first calculated the P guess numerically using an SDP calculation in MATLAB. We obtain following value of P guess for di↵erent values of d, as shown in Table [ Assuming that the corresponds to ⌦ = {0, . . . , 0}. This implies that the problem of finding corresponds to finding the maximum eigenvalue max of the state F({0, . . . , 0}), max (F({0, . . . , 0})) (7.8)

It is interesting to observe that the operator F({0, . . . , 0}) leaves the linear space H 0 = span({✓ 0 }|✓ 2

[d + 1]) invariant i.e., for each vector ↵ in H 0 , F↵ 2 H 0 .
Here, H 0 is a d + 1 dimensional vector space with d + 1 non-orthogonal basis

({✓ 0 }|✓ 2 [d + 1]).
Let A be a restriction of F({0, . . . , 0}) onto the space H 0 i.e., A is a d + 1 dimensional matrix which linearly transform F({0, . . . , 0}) with respect to the non-orthogonal basis

({✓ 0 }|✓ 2 [d + 1]). Let {↵ 1 , . . . , ↵ d+1 } = ({✓ 0 }|✓ 2 [d + 1]), then F ↵ j = d+1 X i=1 A ij ↵ i (7.9)
These equations can be written in the equivalent form as = 0 (7.12)

d+1 X j=1 ( ij F A ji I)↵ j = 0 (7.10) Let Z ij = ij F A ji I, then d+1 X j=1 Z ij ↵ j = 0 (7.
Solving this for F({0, . . . , 0}) we can find

A = 0 B B B @ 1 1 p d . . . 1 p d 1 p d 1 . . . 1 p d . . . . . . . . . . . . 1 p d 1 p d . . . 1 1 C C C A (7.13)
Now using the fact that the maximum eigenvalue is invariant under the change of the basis, the corresponds to the maximum eigenvalue max of matirx A and is calculated as

= 1 + p d (7.14)
Finally, the upper bound on the guessing probability is

P guess  1 + p d d + 1 (7.15)
• By bounding sum of l rank one projectors

To calculate , we use the the fact that for any matrix A, its maximum eigenvalue is always less than or equal to any matrix norm | |  ||A|| [HLW + 15]. We consider the infinite matrix norm for our calculations. Following which,

 ||F(⌦)|| 1 (7.16)
As a result, to calculate the maximum eigenvalue , it is now required to calculate the sum of the norm of (d + 1) projectors. For this we use following theorem Lemma 7.2.1 Following inequality holds for the sum of l rank-1 projectors acting on an arbitrary finite dimensional Hilbert space

C d || 1 + . . . + l || 1  1 + (l 1) cos cos = max i,j>1
|| i j || (7.17)

Proof: See Appendix A. ⇤ In our case we have, i = |e ✓ ! ✓ ihe ✓ ! ✓ |, l = (d + 1) and cos = 1 p d , as |he ✓ 1 i |e ✓ 2 j i| = 1/ p d. Following which we have  F(⌦) 1  1 + p d (7.18)
As a result,

P guess  1 + p d d + 1 (7.19)
Consequently strategy II. is the optimal eavesdropping strategy. ⇤

Security analysis

Following the security definition 7.1.1 of a cryptographic protocol in QCT security model, to prove the security of MUB-QCT protocol we need to prove two things namely correctness and the secretness.

As a result we have following lemmas proving the security of the protocol

Correctness

For a single channel use, In order to decode log d-bits of information, Bob performs a measurement in the basis ✓, described by a POVM M ✓ y , Equation (7.4). His measurement apparatus consists of d detectors, such that a click in each corresponds to one of the d -bit. Now, let, p c = (1 p e ) be the probability that there is a correct detection given that there is a click in detector, and let, p e be the probability that there is a wrong detection given that there is a click in detector. Then, assuming that the correct detection, if there is a click p c , occurs in one detector and error in detection p e is uniformly distributed over d 1 detectors, we have For n-channel use, the total probability for error detection is then np e . For a lossy channel, with T the transmittance (defined as T = 10 ↵L/10 , ↵ = 0.2dB/km), for the detector e ciency ⌘, the visibility of the detection V and p dark the dark-count probability per detector the estimated error probability per channel use p e is calculated is Appendix B.

H(X|Y ) = h d (p e ) = (
Lemma 7.2.1 (MUB-QCT: Correctness) The MUB-QCT protocol is " P E -correct.

Proof: The MUB-QCT protocol outputs di↵erent keys (S A ; S B ), if error correction fails to produce identical key bits, which happens if the estimated error probability np e exceeds the threshold value " P E . Thus, the MUB-QCT protocol is " P E -correct. ⇤ Secretness Lemma 7.2.2 (MUB-QCT: Secrecy) For an optimal immediate measurement that Eve performs on the input state ⇢ x , the MUB-QCT is secret with

I(X; Z)  " sec (7.21)
where,

" sec = log 2 d + log 2 ⇣ p d+1 d+1
⌘ .

Proof: To insure the secrecy of the MUB-QCT protocol, a security criterion is to bound on the mutual information of Eve

I(X; Z) = H(X) H(X|Z)  H(X) H min (X|Z) (7.22)
where, we have used the fact that H(X|Z) H min (X|Z) where H min (X|Z) is the min entropy defined as

H min (X|Z) = log 2 ⇣ P guess (X|Z) ⌘ (7.23)
Thus following Equation 7.19

I(X; Z)  H(X) H min (X|Z) = log 2 d + log 2 ⇣ p d + 1 d + 1 ⌘ (7.24)
⇤ Very notably, the bound on Eve information can be achieved under QCT security model, by only considering the input state and not Bob measurement's results.

Security of 1-MUB-QCT-(1, log d) protocol

Preliminaries: Randomness Extractor

Randomness is an essential resource for information theory, cryptography, and computation. However, most sources of randomness exhibit only weak forms of unpredictability. The goal of randomness extraction is to distill (almost) perfect randomness from a weak source of randomness. A general model for weak random sources was given by David Zuckerman [Zuc90, Zuc96b] who suggested to "measure" the amount of randomness a probability distribution contains by its min-entropy where the min-entropy of a distribution X on {0, 1} n is defined by H min (x) = log(P guess (X = x)). In other words, a distribution has min-entropy at least k if the probability of every element is bounded by 2 k . Intuitively, such a distribution contains k random bits.

Consider the goal of designing an extractor for all distributions X with H min (X) n 1. That is a function E : {0, 1} n ! {0, 1} such that for every distribution X on {0, 1} n the distribution E(X) is a random bit. (Note that here we only want to extract a single random bit.) It is easy to see that no such function E exists. This is because every such function E has a bit b such that the set S = {x | E(x) = b} is of size at least 2 n 1 . It follows that the distribution X which is uniformly distributed on X has H min (X) n 1 and yet E(X) is fixed to the value b.

Thus, we will need to settle for a weaker concept of the extractor. We will allow the extractor to use an additional input: A "short seed" of truly random bits. We require that for every distribution X with su cient min-entropy, the extractor's output distribution is (close to ) uniform. Naturally, we want the seed to be smaller than the output of the extractor. The input of an extractor contains two independent sources of randomness: the source and the seed. In some applications, it is required that the extractor's output will be uniform even to someone who gets to know the seed. A way of enforcing such a condition is to demand that even if the seed is concatenated to the output, the resulting distribution is close to uniform. However, this is not quite enough for most applications, and we want an even stronger statement. In particular, imagine that some side information E about X is provided, increasing the guessing probability to P guess (X|E). For example, such side information could come from an earlier application of an extractor to the same source. Thus, a strong statement asks the output to be entirely random even with respect to such side information, i.e., uniform and uncorrelated from E. Classically, it is known that extractors are indeed robust against classical side information [57], yielding a uniform output whenever the min-entropy about X given access to side information E is su ciently high. Especially with respect to cryptographic applications, we thereby again want extractors that work for any source X of su ciently high entropy H min (X|E) without any additional assumptions about the source.

Quantum to quantum randomness extractors

In a classical world, the sources of randomness are described by probability distributions, and the randomness extractors are families of (deterministic) functions taking each possible value of the source to a binary string. To understand the definition of quantum extractors, it is convenient to see a classical extractor as a family of permutations acting on the source's possible values. This family of permutations should satisfy the following property; for any probability distribution on input bit strings with high min-entropy, applying a typical permutation from the family to the input induces an almost uniform probability distribution on a prefix of the output. We define a quantum to quantum extractor in a similar way by allowing the operations performed to be general unitary transformations and the input to the extractor to be quantum.

Constructions for QQ-extractors are well known in quantum information theory due to a notion known as 'decoupling,' which plays a central role in quantum information theory. In general, a map that transforms a state ⇢ AE into a state that is close to a product state A ⌦ ⇢ E is a decoupling map. Decoupling processes thereby typically take the form of choosing a random unitary from a set {U 1 , . . . , U L } to A = A 1 A 2 and tracing out (i.e., ignoring) the system A 2 . For certain classes of unitaries such as (almost) unitary 2 -designs, the resulting state ⇢ A 1 E is close to maximally mixed on A 1 and uncorrelated from E, whenever H min (A | E) is su ciently large.

1

The operator is a string concatenation operation corresponding to joining character strings end-to-end. Definition 7.3.4 (QQ-Extractors) Let A = A 1 A 2 with n = log |A|. Define the trace-out map Tr A 2 : L(A) ! L (A 1 ) by Tr A 2 (.) = P a 2 ha 2 |(.)|a 2 i , where {|a 2 i} is an orthonormal basis of A 2 For k 2 [ n, n] and " 2 [0, 1], a(k, ") QQ -extractor is a set {U 1 , . . . , U L } of unitary transformations on A such that for all states ⇢ AE 2 S(AE) satisfying H min (A | E) ⇢ k, we have

1 L L X i=1 Tr A 2 h U i ⇢ AE U † i i I A 1 |A 1 | ⌦ ⇢ E 1  " (7.28)
log L is called the seed size of the QQ -extractor.

have arbitrarily large dimension. The quantity H min (A|E) measures the uncertainty that an adversary has about the system A. As it is usually impossible to model an adversary's knowledge, abound on the conditional min-entropy is often all one can get. A notable di↵erence with the classical setting is that the conditional min-entropy k can be harmful when the systems A and E are entangled. In fact, in many cryptographic applications, this case is the most interesting.

Quantum to classical randomness extractors

When characterizing the power of a source to supply randomness it is hence a natural question to ask, how much classical randomness we can extract from a quantum system. To tackle this question we here take on the study of quantum-to classical randomness extractors (QC-extractors).

A Quantum to classical randomness extractor (QC-extractor) extracts an almost uniform classical randomness from a physical source ⇢ AE , by performing measurements on the quantum state ⇢ A . It is formally defined in [START_REF] Berta | Quantum to classical randomness extractors[END_REF] as, Definition 7.3.5 (QC-extractor [START_REF] Berta | Quantum to classical randomness extractors[END_REF]) Let A = A 1 A 2 be a quantum system, n = log |A|.

Then, for k 2 [ n, n] and " 2 [0, 1], a (k, ")-QC-extractor is a set {U 1 , . . . , U L } of unitary transformation such that for all state ⇢ AE satisfying H min (A|E) k, we have

1 L L X j=1 ⇧j A!X 1 (⇢ AE ) I A 1 |A 1 | ⌦ ⇢ E  ". (7.29)
As opposed to classical-to-classical extractors (CC-extractors) given by functions Ext(•, R) mapping the outcome of the randomness source to a string K, a QC-extractor is described by projective measurements whose outcomes correspond to a classical string K. That is, a QC-extractor is a set of measurements

n ⇧1 A!K , . . . , ⇧L A!K o
, where the random seed R determines the measurement

M R A!K that we will perform. The measurement map { ⇧j A!X 1 (⇢ AE )} is a defined as ⇧j A!X 1 (⇢ AE ) := I A 1 !X 1 ⇣ T A!A 1 ⇣ U j ⇢ AE U † j ⌘⌘ (7.30)
where, I A 1 !X 1 is a canonical identity map i.e., I A 1 !X 1 (|iihj| A 1 ) = |iihj| X 1 and

T A!A 1 (•) = X a 1 ,a 2 ha 1 a 2 |(•)|a 1 a 2 i|a 1 iha 1 | (7.31)
where, |a 1 i, |a 2 i (standard) orthonormal bases of A 1 , A 2 respectively. The measurement map { ⇧j A!X 1 (⇢ A )} consist in choosing a random unitary from a set {U 1 , . . . , U L } applying it on ⇢ A and then tracing out the system A 2 , i.e., for A = A 1 A 2 measurements ⇧j A!X 1 (⇢ A ) consisting of applying a random unitary U j on ⇢ A , followed by a measurement T (•) A!A 1 on A 1 , thus yields a QC-extractor.

QC-extractors based on full set of MUBs Definition 7.3.6 (Pair-wise independent permutation) A family P of permutations of a set of d elements [d], is pair-wise independent if for all i 1 6 = i 2 and j 1 6 = j 2 , and if is uniformly distributed over P,

Pr { (i 1 ) = j 1 , (i 2 ) = j 2 } = 1 d(d 1) . (7.32)
In this paper, permutations of basis elements of a Hilbert space A should be seen as a unitary transformation on A. Total number of pair-wise independent permutations for a set of d-elements

are |P| = ( d d/2 )
2 , which for a large value of d is approximately equal to 2 d 1 . A construction of QC-extractor based on full set of mutually unbiased bases (MUBs) and a set P of pair-wise independent permutations was provided in [START_REF] Berta | Quantum to classical randomness extractors[END_REF]. The upper bounds on the maximum amount of randomness that can be extracted then follows from the following [Theorem III.8, [START_REF] Berta | Quantum to classical randomness extractors[END_REF]]: Theorem 7.3.7 (QC-extractor based on full set of MUBs) Let A = A 1 A 2 , n = log |A|, |A a prime power, and let T A!A 1 be the measurement map as defined in Equation (7.31). Then if {U 1 , . . . , U |A|+1 } defines a full set of mutually unbiased bases, we have

1 |P|(|A| + 1) X P 2P |A|+1 X ✓=1 ⇧✓ A!X 1 (⇢ AE ) I A 1 |A 1 | ⌦ ⇢ E  " (7.33) for " = q |A 1 | |A|+1 2 H min (A|E), where ⇧✓ A!X 1 (⇢ AE ) = T A!A 1 ⇣ P U ✓ ⇢ AE (P U ✓ ) †
⌘ , P = {P }, is a set of pair-wise independent matrices. In particular, the set {P U ✓ : P 2 P, ✓ 2 [|A| + 1]} defines a (k, ")-QC-extractor provided

log |A 1 |  n + k 2 log(1/") (7.34)
and the number of the unitaries is L = (|A| + 1)|P|.

Full set of MUBs along with the set of pair wise independent permutations forms a strong QCrandomness extractor i.e., even if the unitaries (U ✓ , P ) are revealed to an adversary Eve after the measurement ⇧✓ A!X 1 (⇢ AE ) following holds,

⇢ X 1 EU ✓ P I A 1 |A 1 | ⌦ ⇢ EU ✓ P  s |A 1 | |A| + 1 2 H min (A|E) (7.35) where ⇢ X 1 EU ✓ P := ⇣ 1 |✓|| | X ✓, ⇧✓ A!X 1 (⇢ AE ) ⌘ ⌦ |✓ih✓| ⌦ | ih | (7.
(X|E)  1 2 + ⌦ ⇣ 1 d ⌘ .
Proof: For strategy II, one simple strategy for Eve is to perform a measurement in a random MUB, followed by post-measurement decoding. For this strategy, Eve can successfully guess the key bit with probability at least

P II guess (X|E) 1 2 + O ⇣ 1 d ⌘ . (7.38)
We now prove that this guessining probability is infact also an upper bound. We considering the measurement in a fixed basis followed by a post-measurment decoding, as Eve has no preferable measurement basis since the full set of MUBs forms 2-design [GKR]). Based on the work of Berta et. al., [START_REF] Berta | Quantum to classical randomness extractors[END_REF] on Quantum to Classical Randomness Extractors, we can establish that such generic strategy II, reduces to applying a strong QC-extractor to ⇢ x .

For the side information E, that Eve can get on X, the optimal immediate measurement is equivalent to the measurement map T A!A 1 in Equation (7.31). Corresponding to tracing out A 2 (defined by {|ri} : r 2 [d/2]) from the quanum state ⇢ A (Equation 2), and then measuring the remaining system A 1 in the (standard) orthonormal basis {|!i}, obtaining a classical outcome ! 2 {0, 1}. Following which we have

T ! (⇢ xE ) = T A!A 1 (⇢ xE ) (7.39) = T A!A 1 ⇣ 1 |✓|| | X ✓ P U ✓ ⇢ AE (P U ✓ ) † ⌘ (7.40) = 1 |✓|| | X ✓,

⇧✓

A!! (⇢ AE ) (7.41) Which, following Theorem 7.3.7, corresponds to accessing the output of a strong QC-extractor based on a full set of MUBs [START_REF] Berta | Quantum to classical randomness extractors[END_REF]. Moreover, a full set of MUBs forms a stromg QC-Extractor i.e., even if the unitaries (U ✓ , P ) are revealed at t comp , following holds,

⇢ xEU ✓ P I A 1 |A 1 | ⌦ ⇢ EU ✓ P  " (7.42)
where After the parameter estimation, Alice and Bob abort the protocol if the estimated error probability per channel use p e exceeds the threshold error probability per channel use " th . For a lossy channel, with T the transmittance (defined as T = 10 ↵L/10 , ↵ = 0.2dB/km), for the detector e ciency ⌘, the visibility of the detection V and p dark the dark-count probability per detector the estimated error probability per channel use p e can be calculated as (See B for detailed calculation)

⇢ xEU ✓ P := T A!A 1 (⇢ xE ) ⌦ |✓ih✓| ⌦ | ih |, and " = q |A 1 | |A|+1 2 H min (A|E) . We have |A| = d, |A 1 | = 2,

Security of MUB-QCT protocol with multiple copies per channel use

The proof for 1-MUB-QCT is valid against general attacks, in the QCT security model, thanks to the reduction of Eve optimal strategy to observing the output of a strong randomness extractor. In the multiple copy case, this proof strategy however does not carry over. In particular, the randomization of a full set of MUBs defines a 2-design that is not su cient to randomize multiple copies, for m > 1.

The 1-MUB-QCT protocol considered the quantum communication of a single qudit state ⇢ x from Alice to Bob. In such case we have shown that Eve's information vanishes as O(1/d). This in principle leaves the room to operate secure key establishment, a higher number of copies, i.e. m copies of ⇢ x per channel use: this is the m-MUB-QCT protocol.

Interestingly the m-MUB-QCT protocol could open the way to higher key rates and long-distance operation, while keeping implementation simple and using with coherent states with mean photon numbers ⇠ m.

In section 8.1 we first present possible Eavesdropping strategies when Alice sends multiple copies per channel use. These possible Eavesdropping strategies are categorized as single copy fixed measurement, collective measurement and adaptive measurement. We also present a special kind of adaptive measurement called proactive MUB-measurement where Eve proactively measures each copy in a di↵erent MUB.

Possible attack strategies for multiple copies per channel use 8.1.1 Individual measurement

In this attack strategy Eve is restricted to perform same individual measurement (which she performs on a single copy), on each of the m-copies of the quantum state. For any locally optimal scheme, the optimization is done by minimizing the error probability of the measurement of only a single copy.

Here we consider the case where each measurement is also performed independently, i.e. without any information obtained from the measurement of other copies.

Collective measurement

For any number of copies m 1, the minimum possible error probability can be obtained in principle by measuring all m copies of the state using a collective measurement. This attack strategy corresponds to performing a measurement at once on the collective state of all m-copies [ABB + 05].

Adaptive measurement

In the simplest scenario Eve can perform an optimal single-copy measurement on the first copy, use the outcome of the measurement to define the optimal measurement on the next copy, and finally the outcome of the optimal measurement on last copy in the sequence decides the result of the overall measurement [ABB + 05].

Security analysis of m-MUB-QCT against restricted attacks

We can however perform security analysis against restricted attacks, by considering two relaxations:

• Non-adaptive attacks. This corresponds to assuming that Eve cannot update her attack strategy adaptively, over the m copies.

• Individual attacks. This corresponds to discard the possibility of correlated attacks over different channel use. We conjecture that individual attacks are likely to be the best strategy if the security of the ephemeral encryption is valid throughout the full session (during the n consecutive channel uses).

We consider a specific non-adaptive attack strategy, Proactive MUB measurement, in which Eve proactively measures each of the m copies in a di↵erent MUB, where she obtains a sequence of m classical measurement outcomes {a 1 , a 2 , . . . , a m }, such that for each i 2 [m], a i 2 [d]. This is followed by a post-measurement decoding at time t comp , using ({a i }, , ✓).

Security analysis: m-MUB-QCT-(1, log d) protocol

Proactive MUB Measurement Eve proactively measures each copy individually in a di↵erent bases, chosen from the full set of MUBs. After measuring all the copies, Eve obtains a sequence of m classical measurement outcomes {a 1 , a 2 , . . . , a m }, such that for each i 2 [m], a i 2 {0, 1} for the 1 bit case. This is followed by a post-measurement decoding at time t comp , using ({a i }, , ✓).

For m d + 1 a post-measurement decoding strategy, which results in guessing the key bit x with certainty consist of applying P on one of the a i , for which the measurement was done in the correct basis U ✓ .

For m < d + 1, using the fact that the set of permutation operations commutes with MUB basis change [START_REF] Rickles | Symmetries in physics: Understanding permutation symmetry[END_REF], we can reduce to the simpler case without permutation, where Eve measures each copy in a di↵erent MUB, and learns the correct it only if her measurement basis coincides with ✓. As a result, Eve's mutual information increases linearly with m as

I Pro (X; Z) ⇠ O ⇣ m d ⌘ (8.2)
This implies while performing proactive MUB-measurement, Eve cannot guess x perfectly when significantly less than d copies of the state | ✓, x,r i are sent by Alice.

Individual attack

We to Bob over a quantum channel, where,

⇢ (m) x = 1 |r||✓|| | X r,✓ ⇣ P U ✓ |i xr ihi xr |(P U ✓ ) † . ⌘ ⌦m . (8.3)
Eve is restricted to perform the same individual fixed measurement on each of the m copies. As a result, Eve obtains a m-bit long sequence {z i }, where, each z i is equal to x with guessing probability P guess (Equation (7.45)) and di↵ers with 1 P guess . An obvious choice for decoding the key bit is to use majority rule, according to which the largest number of occurrences of a bit value in the {z i } is the value of input bit. Let {B i } be an i.i.d. sequence of Bernoulli random variables with parameter 1 P guess i.e., b i = 1 with probability 1 P guess and b i = 0, with probability P guess . Then, we can write z i = x b i , i.e., Z i = X i↵ b i = 0.

Error in decoding due to majority rule occurs if the number of times the incorrect value of x, in the m-bit long sequence {z i }, turnouts to be greater than m 2 . i.e.,

P Fix error (X|Z) m = Pr h m X i=1 B i > m 2 i . (8.4)
Error probability can be bounded using the Cherno↵ bound [START_REF] Mousavi | How tight is cherno↵ bound?[END_REF], according to which if {B i } is a sequence of Bernoulli random variables with parameter p then Pr

h m X i=1 B i > mp + t i 1 2 ⇣ 1 s 1 exp ⇣ 2t 2 mp ⌘⌘ (8.5) For p = 1 P guess , t = m/d P Fix error (X|Z) m 1 2 ⇣ 1 r 1 exp ⇣ 4m d 2 2d ⌘⌘ . 1 2 ⇣ 1 r 1 ⇣ 1 4m d 2 ⌘⌘ . 1
I Fix (X; Z) m = O ⇣ p m d ⌘ (8.8)
Implying that when restricting Eve to perform fixed optimal measurements on each copy, m  O(d 2

) copies can be sent, while the accessible information is still negligible.

Analysis

For m-MUB-QCT-(1, log d) protocol, we found out that the proactive MUB measurement strategy is more e cient than the single copy fixed measurement. It moreover allows secure key distribution with input states containing up to O(d) photons, implying a significant performance increase, characterized by a O(d)-multiplication of key rate. As a result, we conjecture that the proactive MUB-measurement attack strategy is the best optimal non-adaptive attack strategy.

Security analysis: m-MUB-QCT-(log d, log d) protocol

Alice prepares m copies of the qudit state, ⇢ x , using same basis ✓. The m copy state of ⇢ x is then defined as

⇢ (m) x = 1 |✓| X ✓ (U ✓ |xihx|U † ✓ ) ⌦m .
(8.9)

When Eve performs proactive MUB-measurement, as discussed in the section 8.2.1, Eve's mutual information increases linearly with m as

I Pro (X; Z) ⇠ O ⇣ m d ⌘ (8.10)
This implies while performing proactive MUB-measurement, Eve cannot guess x perfectly when significantly less than d copies of the quantum state are sent by Alice. For individual attack strategy Eve is restricted to perform same individual measurement (which she performs on a single copy), on each of the m-copies of the quantum state. When Alice sends m copies of the quantum state, an adversary wins if she is able to guess at least 1 copy correctly. Let P (s, m), (s  m), be the probability of guessing s copies when m copies are provided. Then, the guessing probability for adversary is (1 P guess ) m s (8.12)

Using which P guess (m) is calculated as

P guess (m) = 1 (1 P guess ) m = 1 ⇣ 1 1 + p d 1 + d ⌘ m ⇠ O ⇣ m p d ⌘ (8.13)
This implies that m < O( p d) copies can be sent, while the guessing probability P guess (m) is still negligible. For example, if d = 10 6 then m < 10 3 can be sent while still guaranteeing the security of the key.

As a result, for m-MUB-QCT-(log, log d) protocol, we found out that the single copy fixed measurement is more e cient than proactive MUB measurement strateg. It moreover allows secure key distribution with input states containing up to O( p d) photons. However, the number of detectors required increases with the increase, which can in result decrease the achievable transmission distance due to errors from multiple detectors.

Challenges: Security of the m-MUB-QCT protocol against adaptive attacks.

In the multi-copy case, the security analysis presented so far does not account for general attacks (in particular adaptive strategies), for which we do not know if the proactive MUB measurement is optimal. Thus, the question of the optimal attack in the multiple copy case remains open and a direction for our future work.

Chapter 9

Performance analysis of the MUB-QCT protocol

Introduction

In this chapter we analyze the performance e ciency of the MUB-QCT protocol. We also discuss the important functionality o↵ered by the MUB-QCT protocol. In chapter 6.3.3 we demonstrated that MUB-QCT enables everlasting secure key distribution with input states containing up to O( p d) photons. This leads to a series of important improvements when compared to QKD: on the functional side, the ability to operate securely between one sender and many receivers, whose implementation can moreover be untrusted; significant performance increase, characterized by a O( p d) multiplication of key rates and an extension by 25km ⇥ log(d) of the attainable distance over fiber. Implementable with a large number of modes with current or near-term multimode photonics technologies, the MUB-QCT construction has the potential to provide a radical shift to the performance and practicality of quantum key distribution.

Noise tolerance:

The maximum tolerable error rate (the error threshold for R = 0) as a function of d is

" th ⇠ 1/2 O(1/d) (9.1)
i.e., up to 50% for large d. Thus, higher the d higher is the resilience to noise, allowing the lower signal to noise ratio for the received signal, which can be translated into longer transmission distances. High dimensional encoding in the MUB-QCT protocol allows high resilience to noise by o↵ering a maximum tolerable error rate of up to 50% for large d. Key rate per channel use for the MUB-QCT protocol as a function of error rate for di↵erent values of d is plotted in Figure 9.1. The figure explains that the maximum tolerable error rate increases as the dimension of the Hilbert space increases.

Resource requirements:

In MUB-QCT, the number of detectors remains constant irrespective of the dimension of the quantum system. MUB-QCT protocol's detectors requirement remains fixed, i.e., two detectors (to distinguish a bit), irrespective of the quantum system's dimension. The MUB-QCT protocol can be implemented with only two detectors, irrespectively of d. As mentioned earlier, the measurement apparatus consists of two detectors, such that a click in each corresponds to one of the bit value i.e., 0 or 1. This is completely in contrast to the high-dimensional QKD, where, the detectors requirement scales linearly with d. HD-QKD schemes [LPD + 13, LBZ + 19, LBZ + 16a, JPLS19] also o↵ers high tolerance to noise for large d, and the ability to encode log 2 d bits of information on single photon is an additional advantage. However, the e cient implementation of such schemes requires d-singlephoton detectors, financially restricting the use of large d. Thus, the MUB-QCT protocol significantly relaxes the financial dependency, while still allowing to distill secret keys at long distances, as compare to HD-QKD. In this case when encoding one bit and sending m-copies of the quantum state the secret key rate for a loss channel is defined as

Protocol

R (1 (1 T ) m )H min (X|Z) H(X|Y ) (1 (1 T ) m
)( log(P Pro guess (X|Z) m )) + p c log p c + p e log p e (9.2)

Analyzing the plot in Figure 9.3, we observe three distinct regimes, Constant rate regime: short distance, where the secret key rate is constant and commensurate to those of data communication rates, as at-least one photons always get clicked in detectors; Single copy regime: longer distances, where the key rate is similar to the single copy case, scaling as the transmissivity T , and decays exponentially with distance; Cuto↵ regime: extremely long distances, where detector dark count rates sharply limit the secret key rate. We proved that when performing MUB-QCT using a d-dimensional quantum system, m < d copies of a quantum state can be sent per channel use. This ability to send multiple copies has a striking consequence as it can o↵er high tolerance to the error in detection due to channel loss, resulting in an important and significant performance boost, characterized by a O(d) multiplication of key rates and an extension by 50km ⇥ log(d) of the attainable distance over fiber. This is evident from the Figure (9.3), where the key rate is plotted for di↵erent values of d and is optimized by maximizing the key rate for di↵erent value of m. Analyzing the plots, we found that as we go to high dimensions the key rate per channel use increases. For d ⇠ 10 the performance of the MUB-QCT is comparable to that of BB84 protocol and for d > 10 2 , there is a significant improvement in the performance.

m-MUB-QCT-(log d, log d) Protocol

For the log d case, when sending m-copies of the quantum state the secret key rate for a loss channel is defined as

R (1 (1 T ) m )H min (X|Z) H(X|Y ) (1 (1 T ) m )( log(P guess (m))) + p c log p c + p e log ⇣ p e d 1 ⌘ (9.3)
We plot Equation (9.3), for single photon detectors based on superconducting nanowire singlephoton detectors (SNSPDs) [YCY + 16], in Figure 9.4. Observing the Figure 9.4, we see that the achievable distance decreases as we increase the dimension, which is due to errors in detection increases with the increase in number of detectors. As a result, it is advantageous to use m-MUB-QCT-(1, log d) protocol. This hardware may require some trust factor depending on their utility in the protocol. For instance, Figure 9.5: Trust assumptions on the hardware, required to prove security in di↵erent key distribution protocols. Elements that are trusted to work according to their specifications are represented in orange color, while, for elements in blue color, no assumptions are made on the internal working and specifications, removing an important constraint on the security of the protocol. The black color boundary represents the shield, which ensures that these devices do not leak any information out of the lab. In the figure shorthand notations are defined as, T Q : quantum transmitter, R Q : quantum receiver C: classical, and, Q quantum. The yellow color key is a short key required to generate short-term-secure encryption in QCT and also serve as an initial password to authenticate the classical channel. in preparation and measure type QKD protocols it is assumed that these devices work exactly according to their specifications, and are shielded, i.e., they do not leak any information from leaking out of the lab. As a result of this, it is required for Alice to know the specifications of devices in Bob's lab, in another way, the security of the protocol inherently depends on the security of these devices. However, such a condition is di cult to ensure when implementing the protocol, as many attacks have been demonstrated to be directed towards quantum devices [QFLM07, ZFQ + 08, LWW + 10].

MDI-type security

In Measurement Device Independent (MDI) QKD [LCQ12, BP12], any detector vulnerability is removed by making no trust assumption on the measurement devices, which is the most crucial part of the implementation and quantum transmitter and only classical processing devices are assumed to work according to their specifications. Consequently, the measurement device is located outside Alice and Bob's lab, as shown in the Figure (9.5). As a result, the security of the protocol does not depend on the security of measurement devices, o↵ering an important implementation security advantage.

Device independent (DI) QKD [ER14, ABG + 07] is another security framework providing unparalleled security, which holds irrespective of the quality and internal working of quantum devices (transmitter and receiver). However, DI-QKD makes some important assumptions like, there is no information leakage from trusted parties' locations and Alice and Bob have access to trusted randomness. These two assumptions are the cryptographic analogous of the locality (no-signaling) and free-will loophole respectively. This high level of security can only be established under conditions which are very di cult to achieve experimentally. As a result, DI-QKD although, guarantee unprecedented security, yet, it is not the panacea for secure key distribution as it is di cult to implement and still requires important trust assumptions, that may not be much easier to comply with, than the one for prepare and measure QKD.

In Quantum Computational Timelock, MUB-QCT protocol, Alice and Bob are not required to estimate the errors by monitoring their channel, to bound Eve's information on the secret key. To bound Eve's information, Alice and Bob are required to calculate only the accessible information of the Eve, which depends on the input state prepared by Alice's quantum source and does not depend on Bob's measurement device. As a result, Alice is not required to know the specifications of measurement devices on Bob's side. Thus, the security is independent of any trust assumption on the measurement device. However, this kind of security is guaranteed only if the assumptions of the QCT security model holds. We call this, MDI-type security, as the security is similar to the MDI QKD protocol provided some additional restrictions.

Multiparty key distribution

The possibility of sending multiple copies of the quantum state per channel use can be exploited to realize multiparty key distribution in the QCT security model. In principle, m multiple copies prepared by Alice can be transmitted to at most m authorized Bobs, allowing them to distill the same key, as depicted in Figure (9.6). A general description of a m-party MUB-QCT distribution would consist of,

• Alice and m authorized parties exchange the classical secret (encoding bases) using a short term secure encryption.

• Alice prepares m-identical copies of a qudit state using the classical secret and send one copy to each of the m-parties.

• Each party then measures the individual state as directed by the classical secret.

• After multiple channel use, they perform information reconciliation on their strings to distill a secret key.

Its clear that in a d-dimension there can be at most m < p d parties. However, to enhance the performance per party the number of parties can be reduced to m 0 < m allowing to send on average m/m 0 copies of the same state per channel per party.

Chapter 10 Conclusion 10.1 Brief review of the results presented in the thesis

Extending the functionality and overcoming the performance limitation under which QKD can operate requires either quantum repeaters or new security models. Investigating the latter option, we introduced a new Quantum Computational Timelock (QCT) security model (Chapter 5), where we assume that an encryption scheme is computationally secure for a time longer than the decoherence time of quantum memories. We discussed the rational (5.6) of using a hybrid security model combining both quantum and computational assumptions. We also discussed the validity (5.7) of these assumptions against the state of the art quantum and computational technologies.

In chapter 6, we proposed the key establishment in the QCTsecurity model. We constructed a specific key establishment protocol that we call the MUB-QCT key distribution protocol, where the classical message is encoded on a d-dimensional quantum state using a complete set of Mutually Unbiased Bases (MUBs) (6.3). We proposed multiple versions of the MUB-QCT protocol

• 1-MUB-QCT-(log d, log d): where for one copy of the quantum state sent per channel use, log d bits of information is encoded on a qudit using a full set of MUBs.

• 1-MUB-QCT-(1, log d): where for one copy of the quantum state sent per channel use, a bit is encoded on a qudit using a full set of MUBs and a complete set of pair-wise independent permutations. .

• m-MUB-QCT-(log d, log d): multiple copy case where m copies of a qudit encoding log d bits of information is sent per channel use.

• m-MUB-QCT-(1, log d): multiple copy case where m copies of a qudit encoding a bit is sent per channel use.

We proved the security of 1-MUB-QCT protocols by upper bounding Eve's information for the optimal eavesdropping attack strategy, which corresponds to immediate measurement followed by a post measurement decoding (Chapter 7). For 1-MUB-QCT-(1, log d) protocol we show that for an adversary this optimal strategy reduces to accessing the output of a strong QC-extractor. We show that for the 1-MUB-QCT-(log d, log d) protocol Eve's information is upper bounded as O(1/ p d) while for the 1-MUB-QCT-(1, log d) Eve's information is upper bounded as O(1/d).

Since the MUB-QCT protocol defines an e↵ective wire-tap scenario, we showed that the key rate in the asymptotic limit for the MUB-QCT protocol, can be derived using following • MDI security: In the MUB-QCT protocol, the upper bound on Eve information can be achieved by only considering the input state and not Bob measurement's results. Consequently, the implementation of Bob's measurement device is not required to be trusted to guarantee security, as displayed on Figure 9.5.

We showed that the m-MUB-QCT protocol opens the way to higher key rates and long-distance operation, while keeping implementation simple and using with coherent states with mean photon numbers ⇠ m. We proved the security of the m-MUB-QCT protocol against a specific non-adaptive attack strategy called the proactive MUB measurement strategy , where Eve measures each copy in a a di↵erent MUB and showed that it allows secure key distribution with input states containing up to O(d) photons for m-MUB-QCT-(1, log d) protocol, implying a significant performance increase, characterized by a O(d)-multiplication of key rate as shown in Figure 9.3. The possibility of sending multiple copies of the quantum state per channel use can moreover be leveraged to perform multiparty key distribution between one Alice and multiple Bobs Our results illustrate that hybrid approaches to quantum cryptography constitute a promising and practical route to extend the performance and functionality of quantum cryptography. In particular, our newly proposed MUB-QCT protocol enables everlasting security key establishment -not achievable with classical means -with performance significantly outperforming those of QKD.

Comparison with related work

Our work is in particular related to the recently proposed idea of Quantum Enigma Machine [GHK + 14a] and Quantum data locking [START_REF] Lupo | Quantum-locked key distribution at nearly the classical capacity rate[END_REF][START_REF] Lupo | Continuous-variable quantum enigma machines for long-distance key distribution[END_REF] where the security is proved by upper bound Eve's accessible information in discrete as well as continuous variable settings [START_REF] Lupo | Quantum data locking for high-rate private communication[END_REF]. However, existing work on Quantum data locking systematically uses random coding arguments to build and prove the security of protocols, making the implementation so far not possible in practice.

Although further analysis is required on that matter, we conjecture that a fundamental di↵erence between Quantum data locking (QDL) and our Quantum Computational Timelock (QCT) stems from the fact that Discrete Variable QDL constructions need to operate with a key much smaller than the channel capacity and thus much smaller than log(d) bits. This requirement stems from the constraint of obtaining a positive data locking rate [GHK + 14a]. QCT, on the other hand, leverages on an additional short-term-secure encryption assumption. This enables Alice and Bob to share a secret S that is comparable to, or even possibly much larger than, log(d) bits. This gives rise to the possibility to use strong locking schemes, such as one based on a full family of MUBs, that are moreover easy to implement with multimode coherent states, containing m photons on average. This is precisely what we propose in this article with the MUB-QCT construction.

On the other hand Quantum Data Locking, operating in a regime where the key is much smaller than log(d) bits requires to consider locking constructions over quantum codewords that are entangled with respect to mode partitions. This leads to constructions for which the measurement that Bob must perform, are in general entangled measurements between modes, and therefore di cult to implement in practice.

Flood-light QKD (FL-QKD) [ZZD + 16, ZZWS17]. is another recently proposed protocol. It aims at providing performance level beyond what is achievable with QKD, in particular in terms of rate. FL-QKD consists in sending coherent light over a very large number of modes, while keeping mean photon number per mode below one to guarantee no-cloning. It is based on a two-way procedure, and the optical storage of a random coherent wavefront, used to perform a multimode homodyne measurement. FL-QKD could potentially allow Gbit/s secret-key rates over metropolitanarea distances. However, its current security analysis only guarantees protection against frequencydomain collective attacks and is still vulnerable to block-wise coherent attacks [START_REF] Zhuang | Security-proof framework for two-way gaussian quantum-key-distribution protocols[END_REF]. Moreover, while it can have a decisive impact on rate (which we also expect for QCT), FL-QKD cannot be used to extend the distance, as compared to standard QKD. Chapter 11

Perspectives

In this chapter we describe di↵erent perspective for the future work.

QCT based on communication complexity

In this section we consider one-way communication complexity problems such as Hidden matching problem [BYJK08, GKRW06, GKK + 07, Gav09] and Khot-Vishnoi game [START_REF] Buhrman | Near-optimal and explicit bell inequality violations[END_REF]. One important property of such problems is that they define an evaluation function, on n bit input, for which there is an an exponential separation between the classical one-way randomized communication complexity and the quantum one-way communication complexity. For hidden matching problem the classical one-way randomized communication complexity scales like ⌦( p n) bits and the quantum one-way communication complexity scales like O(log n) qubits. While, the Khot-Vishnoi game o↵ers quadratically stronger advantage over the Hidden matching game with the the classical one-way randomized communication complexity scales like ⌦(n) bits and the quantum one-way communication complexity scales like O((log n) 2

) qubits. The exponential separation between the classical and quantum communication complexity for such problems can be utilized to construct a key distribution protocol and prove their security in the QCT security model. The main idea to prove the security of a key distribution protocol in the QCT security model using communication complexity problem is to reduce an unauthorized Eve to a classical communication setting while authorized Alice and Bob are allowed to do quantum communication. The separation between the Eve's classical communication complexity and Alice-Bob's quantum communication complexity can then allow to send multiple copies per channel use (⌦( p n) for QCT key distribution using Hidden matching problem and ⌦(n) for QCT key distribution using Khot-Vishnoi game) while still bounding Eve's information to be less than the Alice and Bob's mutual information. As a result, will allow Alice and Bob to exchange secure keys over a long distance.

In the sections below, we describe the two communication complexity problems and propose the key distribution protocols in the QCT security model. Proving the security of the protocols is the possible direction for the future work.

Hidden matching game

The Hidden matching problem was introduced in quantum communication complexity by BarYossef et al. [START_REF] Bar-Yossef | Exponential separation of quantum and classical one-way communication complexity[END_REF], and many variants of it were subsequently studied [GKRW06, GKK + 07, Gav09].

145 This is a one-way communication complexity task involving two players Alice and Bob. It is described as follows. For any positive even integer n, Alice receives as input a string x 2 {0, 1} n while Bob receives a n/2 tuples matching i uniformly randomly from M n 2 { 1 , .., n 1 } . Here M n is the set of n 1 perfect disjoint matchings on n nodes. The objective of the problem is for Bob to output any one of the n/2 possible parity values x k x l for a pair (k, l) that belongs to the matching i with minimum communication resources. Here x k , x l are k th and l th bit of x respectively.

Optimal classical protocol

For this problem, the randomized classical lower bound of ⌦( p n) was shown by Bar-Yossefet al. [START_REF] Bar-Yossef | Exponential separation of quantum and classical one-way communication complexity[END_REF] and Buhrman et al [START_REF] Buhrman | Near-optimal and explicit bell inequality violations[END_REF]. In high level, Alice's message should allow Bob to output the parity of an edge from each one of the possible matchings, in other words for O(n) di↵erent edges. No matter which edges one picks, they will always contain at least ⌦( p n) di↵erent bits of the input x, and hence Alice must send at least ⌦( p n) bits of information and hence communication. The proof structure for computing lower bound in [START_REF] Buhrman | Near-optimal and explicit bell inequality violations[END_REF] is as follows: if Alice's message to Bob is small, let's say c bit, then the set of inputs x 2 {0, 1} n for which Alice sends a particular message m, will be large (typically of the order of 2 n c ). This would mean that Bob will have very little knowledge of most of the bits of x. Using the KKL inequality [START_REF] Kahn | The influence of variables on boolean functions[END_REF], this implies that Bob would not be able to correctly answer the parity x i x j for most of the ✓ n 2 ◆ tuples of the form (i, j).

Even though Bob has some relaxation in a sense that he can output the parity outcome of any one of the n/2 tuples of i , still it turns out that on average it is hard for him to output the correct parity outcome. Using this idea, and the KKL inequality, the classical lower bound to succeed with an error probability p error is,

c > log 2 e e ✓ 1 2
p error ◆ p n 1 (11.1)
Bar-Yossef et al. also proved that this bound is tight by describing a randomized one-way protocol using birthday paradox argument to show that only O( p n) classical bits is su cient to implement the problem. The proof structure is as follows: Let us assume that Bob's matching set M n is restricted to be one of the n 1 disjoint matchings. Since Alice has no information about which matching Bob has received, to maximize the winning condition she encodes her message to contain the parity information of at least one pair from each matching with high probability. Suppose she does this by sending c random bits of the input x or equivalently c(c 1)/2 tuples to Bob. Each perfect disjoint matching i that Bob would receive has n/2 tuples. Thus the matching set M n has in total n(n 1)/2 distinct tuples. The probability that none of the tuples that Alice sends to Bob is in the matching i received by Bob is,

p error = ✓ 1 1 n 1 ◆ c(c 1)/2 ⇡ exp c 2 /2n (

Quantum protocol

Using a simple quantum protocol, the above task can be solved by transmitting exponentially fewer number of qubits. Alice encodes her input x 2 {0, 1} n into the following superposition:

|xi = 1 p n n X k=1 ( 1) x k |ki (11.4)
where x k is the k-th bit of the string x. She then sends it to Bob. For any matching i 2 M n that Bob has as input, there exists a measurement by Bob which allows him to give the correct answer with certainty. To do so, he just measures the quantum state in the basis

n 1 p 2 (|ki ± |li}, 8(k, l) 2 i . The outcome 1 p 2 (|ki + |li) occurs i↵ x k x l = 0 whereas 1 p 2 (|ki |li) occurs i↵ x i x j = 1.
Thus Bob gets the parity result of one of the tuples (k, l) 2 i with certainty. This protocol uses only log 2 n qubits, and hence both the communication and the transmitted information is exponentially better than the classical counterpart.

QCT key distribution using Hidden matching Notations: The Hidden Matching problem is built around an -matching M , that constitutes part of the input given to Bob. M consists of a sequence of n disjoint edges

(i 1 , j 1 ) , • • • (i n , j n ) over [n].
In the following n will be assumed to be even. We will call M n the set of all such -matchings on n bits. If = 1/2 the matching is perfect and if < 1/2 the matching is partial. We can view M as an n ⇥ n matrix with two ones per rows, namely at position i l and j l for the l-th row of matrix M . Let x 2 {0, 1} n , applying the matching M to x leads to the n-bit string Protocol 4 QCT Key distribution protocol using Hidden matching

z = z 1 , • • • , z l , • • • ,
• Alice randomly generates a -matching M with = 1/4

• Alice also locally randomly generate a n bit vector, called x.

• Alice also locally randomly generate a bit b.

• Alice evaluates ! 2 {0, 1} n/4 as ! = Mx b n (where the matrix product is limited to the n edges of the matching M and where b n is a vector with either n 0s or n 1s).

• Alice then sends (M, !) to Bob using computational encryption E k .

• Alice then uses the quantum channel to send Bob the multimode coherent state of ↵ 2 photons, encoded in one supermode x, this state is. ), we have an erasure due to the matching.

|↵i x ⌘ ⌦ n i=1 (
• In case there is no erasure (probablility (2 ) 2 ), Bob then gets a "signal' click that perfectly discriminates b = 0 and b = 1

Khot-Vishnoi Game

Khot Vishnoi game is characterized by a two parameters an integer n, which is considered to be a power of 2, and a "noise parameter" ⌘ 2 [0, 1/2]. Consider the group {0, 1} n of all n -bit strings with ' ' denoting bitwise addition mod 2, and let H be the subgroup containing the n Hadamard codewords. This subgroup partitions {0, 1} n into 2 n /n cosets of n elements each. Alice receives an input coset, chosen at random from a set of shifted Hadamard codewords x = u H. (11.5) This coset of codewords can be written as {u + H}, with u 2 R {0, 1} n . These codewords are orthogonal to each other and are consist of n vectors of length 2 n . Alice adds a string of low Hamming weight z 2 {0, 1} n to her input which reads

y = x z = u z H, (11.6)
and send as an input coset to Bob. This adding of extra string is also known as bias, where each bit is set to 1 with probability ⌘, independently of other bits. Notice that addition of z gives a natural bijection between the two cosets, mapping each element of the first coset to a relatively nearby element of the second coset; namely, the distance between the two elements is the Hamming weight of z, which is typically around ⌘n. Both players are now suppose to output an element from their coset and they win the game if the elements matches under this bijection. In other words, Alice outputs an element a 2 x and Bob outputs b 2 y, they win the game i↵

a b = z (11.7)
Notice that the number of possible inputs to each player is 2 n /n and the number of possible outputs for each player is n.

Alice: Bob:

u 2 R {0, 1} n , H, z 2 {0, 1} n Input: x = u H Input: y = x z = u z H # # Output: a Output: b Win if: a b = z
Classical Value of the Khot-Vishnoi game:

In [START_REF] Buhrman | Near-optimal and explicit bell inequality violations[END_REF] there exists a strategy whose winning probability is roughly 1/n ⌘/(1 ⌘) . To get some intuition for this game, first think of ⌘ as some small constant (even though we will eventually choose it close to 1/2), and consider the following natural classical strategy: Alice and Bob each output the element of their coset that has highest Hamming weight. The idea is that if a is the element of highest Hamming weight in Alice's coset x, we expect a z to also be of high Hamming weight (because it is close to a in Hamming distance), and so Bob is somewhat likely to pick it. We now give a brief back-of-the-envelope calculation suggesting that the winning probability of this strategy is of order 1/n ⌘/(1 ⌘) ; since it is not required for our main result, we will not attempt to make this argument rigorous.

Let t 0 be such that the probability that a binomial B(n, 1/2) variable is greater than (n + t)/2 is 1/n. Recalling that a binomial distribution B(n, p) can be approximated by the normal distribution N (np, np(1 p)), and that the probability that a normal variable is greater than its mean by s standard deviations is approximately e s 2 /2 , we can essentially choose t to be the solution to e t 2 /(2n) = 1/n( so t = p 2n ln n). Then we expect Alice's n -element coset to contain exactly one element of Hamming weight greater than (n + t)/2. Since the element a that Alice picks is the one of highest Hamming weight, we assume for simplicity that its Hamming weight is (n + t)/2. The players win the game if and only if a z has the highest weight among Bob's n elements, which we heuristically approximate by the event that a z has Hamming weight at least (n + t)/2. The Hamming weight of a z is distributed as the sum of B((n + t)/2, 1 ⌘) and B((n t)/2, ⌘), which can be approximated as above by the normal distribution N ((n+t)/2 ⌘t, n⌘(1 ⌘)). Hence for the Hamming weight of a z to be at least (n + t)/2, the normal variable needs to be greater than its mean by ⌘t/ p n⌘(1 ⌘) standard deviations, and the probability of this happening is approximately e ⌘ 2 t 2 /(2n⌘(1 ⌘))

= 1/n ⌘/(1 ⌘) , as claimed. Now we show that no classical strategy can be substantially better. The main technical tool used in the proof is the so-called Bonami-Beckner hypercontractive inequality, which is applicable to our setting because we choose u uniform and u z may be viewed as a "noisy version" of u.

Theorem 11.1.2 For any n which is a power of 2, and any ⌘ 2 [0, 1/2], every classical strategy for the Khot-Vishnoi game has winning probability at most 1/n ⌘/(1 ⌘) .

Proof: Recall that the inputs are generated as follows: we choose a uniformly random u 2 {0, 1} n and an ⌘ -biased z 2 {0, 1} n , and define the respective inputs to be the cosets u H and u z H. We can assume without loss of generality that Alice's and Bob's behavior is deterministic. Define functions A, B : {0, 1} n ! {0, 1} by A(u) = 1 if and only if Alice's output on u H is u, and similarly for Bob. Notice that by definition, these functions attain the value 1 on exactly one element of each coset. Recall that the players win if and only if the sum of Alice's output and Bob's output equals z. Hence for all u, z, P h2H A(u h)B(u z h) is 1 if the players win on input pair u H, u z H and 0 otherwise. Therefore, the winning probability is given by E

u,z " X h2H A(u h)B(u z h) # = X h2H E u,z [A(u h)B(u z h)] (11.8) = n E u,z [A(u)B(u z)] (11.9)
where the second equality uses the fact that for all h, u h is uniformly distributed. We use the framework of hypercontractivity (see e.g. [O'D08]), which we briefly explain now. Specifically, for a function F : {0, 1} n ! R, define its p -norm by kF k p = (E x [|F (u)| p ]) 1/p where the expectation is uniform over all u 2 {0, 1} n . The noise-operator T 1 2⌘ adds " ⌘ -noise" to each of F 's input bits; more precisely, (T 1 2⌘ F ) (u) = E z [F (u z)], where z is an ⌘ -biased "noise string." The linear operator T ⇢ is diagonal in the Fourier basis: it just multiplies each character function S (S ✓

that E u [F (u) • (T ⇢ G) (u)] = E u ⇥ T p ⇢ F (u) • T p ⇢ G (u) ⇤ . The Bonami-Beckner inequality implies kT ⇢ F k 2  kF k 1+⇢ 2 for all ⇢ 2 [0, 1]. We now have, E u,z [A(u)B(u z)] = E u [A(u) (T 1 2⌘ B) (u)] = E u ⇥ T p 1 2⌘ A (u) • T p 1 2⌘ B (u) ⇤  T p 1 2⌘ A 2 • T p 1 2⌘ B 2  kAk 2 2⌘ • kBk 2 2⌘ = ✓ E u [A(u)] ◆ 1/(2 2⌘) • ✓ E u [B(u)] ◆ 1/(2 2⌘) = 1 n 1/(1 ⌘)
Here the first inequality is Cauchy-Schwarz, and the second is the hypercontractive inequality. We complete the proof by noting that n/n 1/(1 ⌘) = 1/n ⌘/(1 ⌘) . ⇤

Quantum strategy for the Khot-Vishnoi game:

In this section we describe a good quantum strategy for the Khot-Vishnoi game, following the ideas of Kempe, Regev, and Toner [START_REF] Kempe | Unique games with entangled provers are easy[END_REF]]and the SDP-solution of [START_REF] Subhash | The unique games conjecture, integrality gap for cut problems and embeddability of negative type metrics into[END_REF].

Theorem 11.1.3 For any n which is a power of 2, and any ⌘ 2 [0, 1/2], there exists a quantum strategy that wins the Khot-Vishnoi game with probability at least (1 2⌘) 2 , using a maximally entangled state with local dimension n.

Proof: For a 2 {0, 1} n , let v a 2 R n denote the unit vector (( 1)

a i / p n) i2[n] . Notice that for all a, b we have ⌦ v a , v b ↵ = 1 2d(a, b)/n
, where d(a, b) denotes the Hamming distance between a and b. In particular, the n vectors v a , as a ranges over a coset of H, form an orthonormal basis of R n .

The quantum strategy is as follows. Alice and Bob start with the n -dimensional maximally entangled state. Alice, given coset x = u H as input, performs a projective measurement in the orthonormal basis given by {v a | a 2 x} and outputs the value a given by the measurement. Bob proceeds similarly with the basis v b | b 2 y induced by his coset y = x z H. A standard calculation now shows that the probability to obtain the pair of outputs a, b is ⌦ v a , v b ↵ 2 /n. Since the players win i↵ b = a z, the winning probability on inputs x, y is given by

1 n X a2x ⌦ v a , v a z ↵ 2 = 1 n X a2x (1 2d(a, a z)/n) 2 = (1 2|z|/n) 2 (11.10)
where |z| denotes the Hamming weight (number of 1 s ) of the ⌘ -biased string z. Taking expectation and using convexity, the overall winning probability is

E z ⇥ (1 2|z|/n) 2 ⇤ (E z [1 2|z|/n]) 2 = (1 2⌘) 2 (11.11)

⇤

QCT Key distribution Protocol based on Khot-Vishnoi game:

Let n be an integer, which is considered to be a power of 2, and let H be a set of n Hadamard codewords. Let {U u } be a set of unitaties for u 2 |2 n | and {B z } be a set of diagonal unitary matrices with z 2 |2 n | such that each diagonal element is set to 1 with probability ⌘ = 1/2 1/ log n. Alice chooses u and z at random and timelocks it using a t comp secure encryption scheme and shares it with Bob. Alice then encodes a bit a 2 {0, 1}on a n-dimensional quantum state using U u and B z as • Alice time locks u and z using a time-lock encryption scheme Enc, and sends it to Bob.

⇢ a = 1 |u||z| X u,z B z U u
• Bob decrypts it immediately using the decryption function Dec, to obtain (u, z).

III Quantum communication:

• State preparation: Alice prepare a qudit state ⇢ a , Equation (11.12).

• Distribution: Alice sends qudit system, ⇢ a , to Bob. ). Following which they perform classical post-processing.

11.2 Prove the security of QCT construction using other tools

Bitwise quantum to classical randomness extractors

Construction of bitwise quantum to classical randomness extractor is composed of unitaries acting on single qudits followed by some measurements in the computational basis. An appealing feature of the measurements defined by these unitaries is that they can be implemented with current technology.

In addition to computational e ciency, the fact that the unitaries act on a single qubit is often a desirable property for the design of cryptographic protocols in which the creation of randomness is not the only requirement for security. The unitaries considered for bitwise QC Extractor are even simpler. They are composed of unitaries V acting on single qudits followed by permutations P of the computational basis elements. As the measurement T commutes with the permutations P , we can first apply V , then measure in the computational basis and finally apply the permutation to the (classical) outcome of the measurement. In addition to the computational e ciency, the fact that the unitaries act on single qudits, is often a desirable property for the design of cryptographic protocols. In particular, the application to the noisy storage model that we present in Section V does make use of this fact.

Let d 2 be a prime power so that there exists a complete set of mutually unbiased bases in dimension d. We represent such a set of bases by a set of unitary transformations {V 0 , V 1 , . . . , V d } mapping these bases to the standard basis. For example, for the qubit space (d = 2), we can choose Consider the map T A!A 1 as defined in Equation (7). Then for 0 and 0 > 0,

V 0 = ✓ 1 0 0 1 ◆ V 1 = 1 p 2 ✓ 1 1 1 1 ◆ V 2 = 1 p 2 ✓ 1 i i 1
1 |P| 1 (d + 1) n X P 2P X V 2V d,n T A!A 1 P V ⇢ AE (P V ) † I A 1 |A 1 | ⌦ ⇢ E 1  q
2 (1 log(d+1)+⇠ log d)n 1 + 2 H min (A|E)⇢+z + 2 ( + 0 ) where V d,n is defined as above, P is a set of pair-wise independent permutation matrices, and z = log 2 02 + 1 1 . In particular, the set {P V : P 2 P, V 2 V d,n } is a(k, ") -extractor provided log |A 1 |  (log(d + 1) 1)n + min{0, k} 4 log(1/") 7

and the number of unitaries is

L = (d + 1) n d n (d n 1)
The proof can be found in [START_REF] Berta | Quantum to classical randomness extractors[END_REF].

QCT key distribution based on bitwise quantum to classical randomness extractor

The QCT key establishment protocol can be constructed using the unitaries as considered to for the bitwise QC Extractor. The security of such a protocol can then follow from bitwise QC extractor construction. The main idea will be to show that the optimal eavesdropping strategy for an adversary reduces to obtaining an output of a bitwise QC extractor. These unitaries are easy to generate experimentally and can provide a solution to the implementation challange as described in the section 11.3

Pseudo-random quantum states

An quantum information-theoretic conjecture was proposed by Ji, Liu and Song [JLS18] (CRYPTO 2018), which suggested that a uniform superposition with random binary phase is statistically indistinguishable from a Haar random state. That is, any polynomial number of copies of the aforementioned state is within exponentially small trace distance from the same number of copies of a Haar random state. This conjecture was later proved by Zvika Brakerski Omri Shmueli in [START_REF] Brakerski | pseudo) random quantum states with binary phase[END_REF].

As a consequence of this, a provable elementary construction of pseudorandom quantum states from post-quantum pseudorandom functions is possible. Moreover, replacing the pseudorandom function with a (2t)-wise independent function, results in an explicit construction for quantum state t-designs for all t.

In terms of computational complexity, this construction uses circuits with restricted structure known in the literature as HT, which contains a single parallel layer of Hadamard gates, followed by a circuit of To↵oli gates. Such a restricted model of quantum computation is enough to approximate the Haar measure.

QCT key distribution based on pseudo-random quantum states

The QCT key establishment protocol can be constructed where Alice generates a n-qubit uniform superposition state with only binary phase, 1 p 2 n P x2{0,1} n ( 1) f (x) |xi, where f : {0, 1} n ! {0, 1} is a random function. Using a (2t)-wise independent function as f makes it perfectly indistinguishable from a completely random function. The t-design construction can be implemented by an HT circuit, comprising of a single parallel layer of Hadamard gates, followed by a circuit of To↵oli gates. The idea to prove security of such a protocol will be to show that for an unauthorized adversary the direct input state received is a pseudorandom state and is indistinguishable from the Haar measure.

Identify and demonstrate specific implementation routes

In this section we explore the possible implementation of the MUB-QCT protocol. We first explain the important experimental challenges for the implementation of the protocol. We then briefly review di↵erent high-dimensional encodings that have been demonstrated experimentally. We then propose a sketch of a possible high dimensional MUB-QCT protocol using spatial modes and finally we discuss the suitability of QCT key distribution protocol with coherent state encoding.

Implementation challenges for the MUB-QCT protocol

As observed in chapter 9, MUB-QCT protocol can o↵er important performance gains (like high tolerance to errors and improved reachable distance by sending multiple copies per channel use) when implemented in high dimension. However, operating high-dimensional encodings, communication, and detection is one of the major challenge in the implementation of the MUB-QCT protocol.

It will be challenging to generate a high-dimensional quantum state that can implement the MUBs. Using spatial modes encoding, the d-dimensional Hadamard basis can be generated from the computational basis using a combination of beam-splitters. Any other (one of the d-1) MUB can be generated by transforming the Hadamard basis using phase modulators (for example see Figure 11.1). The permutation of the modes can be done using the switches. However, as the dimension of the problem increases the circuit complexity also increases and will be very challenging to demonstrate it experimentally.

Review of di↵erent high dimensional encodings

To date, multiple high-dimensional quantum systems have been investigated, including positionmomentum [START_REF] Zhang | Secure quantum key distribution using continuous variables of single photons[END_REF], temporal-spectral [TBZG00, TAZG04, Qi06, NWS + 13, LZS + 14, AKBH07], and orbital angular momentum (OAM) [SBF + 17a, MMLO + 15a, MDG + 13]. Existing time or spectral encoding techniques indicate the possibility to operate with d as large as 10 3 and possibly 10 5

10 8 [ZZWS17] with existing or near-term technologies.

Initial security analysis by Cerf et al. for discrete large alphabet QKD showed improved resilience against noise and loss [START_REF] Cerf | Security of quantum key distribution using d -level systems[END_REF]. However, the proposed scheme with its two early proposals-one using OAM and another using temporal-spectral encoding-was challenging to demonstrate. The main di culty lies in the measurement of discrete high-dimensional states within at least two mutually unbiased bases. E cient implementation of the scheme for the two proposed degrees of freedom required single-photon detectors that scale with the dimensionality d -prohibiting the use of large d. Therefore, there has been a strong desire in developing HD QKD schemes with the ability to measure higher-order correlations using only a few single photon detectors. Ant Thus, MUB-QCT provides one solution to the problem as it requires only two detectors irrespective of the dimension of the encoding.

The development of temporal-spectral encoded HD QKD spurred record demonstrations of secret key capacity at 7.4 secret bits per detected photon [ZZH + 15] and secret key generation rates of 23Mbps [LBZ + 16b] and 26.2Mbps [ILC + 17] with d = 16 at 0.1 dB loss and d = 4 at 4 dB induced loss, respectively. Furthermore, a 43 km (12.7 dB loss) field demonstration between two di↵erent cities show a maximum secret key generation rate of 1.2Mbps [LBZ + 16b].

High-dimensional QKD with OAM has also witnessed rapid development due as it is directly compatible with free-space QKD systems [START_REF] Erhard | Twisted photons: new quantum perspectives in high dimensions[END_REF]. Since OAM modes rely on the preparation and the measurement of discrete highdimensional states, the security proofs extend directly from the work by Cerf et al. Recently, the security proof has also been successfully extended to include finite-key analysis for composable security [BMF + 16]. Moreover, MUB-QCT can be implemented with OAM.

A photon carrying an OAM information has a helical or twisted wave front with an azimuthal phase ' which wraps around `(helicity) times per wavelength. For the popular Laguerre-Gauss mode, a photon carrying an `~OAM can be described as Z ↵ = e i`' .`is an unbounded integer, which allows arbitrarily high encoding dimension, but practically one limits `2 [ L, L] to achieve a dimensionality d = 2L + 1. A mutually unbiased basis set can be constructed using a linear combination of OAM modes

| n X i = 1 p d L X `= L exp ✓ i 2⇡nd ◆ Z ↵ (11.14)
All d+1 sets of quantum states can be generated using a spatial light modulator (SLM) [START_REF] Ne↵ | Two-dimensional spatial light modulators: a tutorial[END_REF], a digital micro-mirror device (DMD) [START_REF] Blanche | Digital micromirror device as a di↵ractive reconfigurable optical switch for telecommunication[END_REF], or a tunable liquid crystal device known as q -plates [ZYC14, SMD + 11].

The first laboratory demonstration of high-dimensional OAM QKD achieved a secret key generation rate of 2.05 bits per sifted photon using a seven-dimensional alphabet (L = 3 and d = 7) [MMLO + 15b] More recently, a 300-m free-space field demonstration in Ottawa with four-dimensional quantum states achieved 0.65 bits per detected photon with an error rate of 11% : well below the QKD error rate threshold for d = 4 at 18% [SBF + 17b]. Although moderate turbulence was present during the experiment, going to longer distances will require active turbulence monitoring and compensation [RXH + 14].

OAM demonstrations involving SLM, DMD, and q -plates so far have required a time in the order of 1 ms to reconfigure limiting the QKD clock rate in the kHz regime. While q -plates can potentially be operated at GHz rates by using electrooptic tuning, these have yet to be demonstrated [KPN + 09]. One appealing new direction is the use of photonic integrated circuits (PICs), which may dramatically reduce the configuration time. Thermo-optically tuned on-chip ring resonators have demonstrated a switching time of 20µs [SCW + 14, CHZ + 16]. More recently, precise control of OAM mode generation has been demonstrated using a 16 ⇥ 16 optical phase array which allows for generation of higher fidelity OAM states [SML + 14]. Furthermore, large scale onchip MEMSactuation has also been demonstrated with a switching time of 2.5µs with the potential of application to OAM generation and control [HSQ + 15].

QCT with coherent state encoding

In chapter 9, we observed that under the restricted scenario MUB-QCT protocol allows sending m < d number of copies per channel use. In optical terms, it means we can send multiple photons per channel use. A multi-photon coherent state is easy to generate and operate on experimentally. Therefore, MUB-QCT protocol can have implementation benefits when operated with coherent state encoding.

A coherent state have photons distributed in the Poisson distribution, i.e., the probability of detecting n-photons in a coherent state is

P µ (n) =
µ n e µ n! (11.15)

Where, µ = |↵| 2 is the average number of photons. In the limit, where the mean photon number sent by Alice is very large, the Poisson distribution can be approximated to a Gaussian distribution with the mean of the distribution µ and the standard deviation p µ. The average number of photons that can hit the detector is then equal to the mean photon number of the coherent state.

In chapter 9 we showed that the upper bound on the number of copies of the quantum state that Alice can send, such that Eve's accessible information on the secret key is less than the mutual information between Alice and Bob is m < d. This implies that, if a coherent state with the number of photons µ, for µ + 4 p µ < d, is prepared by Alice, then with very high probability (corresponding to the 4 confidence, i.e., 99.994%), Eve's accessible information on the secret key can be bounded to be less than the mutual information between Alice and Bob. As a result, MUB-QCT is well suited to be implemented with continuous variables, which make use of only standard telecommunication components that are manageable, cheaper, much more mature from a technological point of view, and most suitable candidates for long-range quantum communication. To explore QCT key distribution protocols using the continuous variable coherent state encodings and proving their security is an are of interest and a possible direction for the future work. We have proposed the MUB-QCT protocol for key distribution in a very theoretical and abstract way. Therefore, in this section we propose a sketch of a possible experimental implementation of high dimensional MUB-QCT protocol using spatial modes. Figure 11.1, presents a sketch of possible implementation of the 1 MUB QCT (1, 3) protocol, where one bit is encoded on a 2 3 dimensional quantum system. The modes considered are spatial modes. In the figure, for a single channel use, the value of di↵erent parameters considered are as following: x = 0, r = 1, ✓ = 1, and = 1. Alice encodes the state | 11 01 i (Equation 6.5 ) on a 2 3 dimensional state. To encode this state she chooses the state |i 01 i (for x = 0 and r = 1) in the computational basis. This state is represented by the column vector (0, 1, 0, 0, 0, 0, 0, 0). If Alice intends to choose the computational basis as the encoding basis she can directly send this state to the apply the permutation. However, if the chosen basis is one of the rest d MUBs then Alice first performs a Hadamard transformation using a series of beam spliters (BS) followed by a phase modulators (PM) on each mode. Phase modulation can be used to transform the state in Hadamard basis to a state in rest of the (d 1) MUB. The permutation of the modes is done using switches. In the figure 11.1, the same is represented for ✓ = 1 (Hadamard basis) and = 1. On receiving the quantum state from Alice, Bob, who knows the value of ✓ and performs the reverse operations as depicted in the figure 11.1. Finally she uses mode sorter to divide the d modes into a pair of d/2 modes and send each pair to one of the two detectors. A signal in either of the detector corresponds to the Bob's bit measurement value. Finding a practical way to implement experimentally the MUB-QCT protocol is an important direction for our future work.

Spatial mode high dimensional encoding

Similarly, the probability that there is click in the bad detectors due to dark counts is Let P right is the probability that there is a click in a detector and is correctly detected, while, P wrong the probability that there is a click in a detector and an error in detection. Then, the probability P right is then the sum of three di↵erent events P right =P [click due to signal in good detector and no click due to dark counts] + P [no click due to signal and there is click due to dark count in a good detector] + P [click due to signal in good detector and click due to dark count in a good detector]

= ⇣ m X i=1 C m i (T ⌘) i (1 T ⌘) m i .V i ⌘ (1 p dark ) d + (1 T ⌘) m p dark + ⇣ m X i=1 C m i (T ⌘) i (1 T ⌘) m i .V i ⌘ p dark (B.8)
Similarly, the probability p wrong is the sum of three di↵erent events

P
= ⇣ m X i=1 C m i (T ⌘) i (1 T ⌘) m i .(1 V i ) ⌘ (1 p dark ) d + (1 T ⌘) m (d 1)p dark + ⇣ m X i=1 C m i (T ⌘) i (1 T ⌘) m i .(1 V i ) ⌘ (d 1)p dark (B.9)
Let, p c be the probability that there is a correct detection given that there is a click in detector, and let, p e be the probability that there is a wrong detection given that there is a click in detector, then Abstract : Extending the functionality and overcoming the performance limitation of QKD requires either quantum repeaters or new security models. Investigating the latter option, we introduce the Quantum Computational Timelock (QCT) security model, assuming that computationally secure encryption may only be broken after time much longer than the coherence time of available quantum memories. These two assumptions, namely short-term computational security and noisy quantum storage, have so far already been considered in quantum cryptography, yet only disjointly. A practical lower bound on time, for which encryption is computationally secure, can be inferred from assumed long-term security of the AES256 encryption scheme (30 years) and the value of coherence time in experimental demonstrations of storage and then retrieval of optically encoded quantum information, at single-photon level range from a few nanoseconds to microseconds. Given the large gap between the upper bound on coherence time and lower bound on computational security time of an encryption scheme, the validity of the QCT security model can be assumed with a very high confidence today and also leaves a considerable margin for its validity in the future. Using the QCT security model, we pro-pose an explicit d-dimensional key agreement protocol that we call MUB-Quantum Computational Timelock (MUB-QCT), where a bit is encoded on a qudit state using a full set of mutually unbiased bases (MUBs) and a family of pair-wise independent permutations. Security is proved by showing that upper bound on Eve's information scales as O(1/d). We show MUB-QCT offers : high resilience to error (up to 50% for large d) with fixed hardware requirements ; MDI security as security is independent of channel monitoring and does not require to trust measurement devices. We also prove the security of the MUB-QCT protocol, with multiple photons per channel use, against non-adaptive attacks, in particular, proactive MUB measurement where eve measures each copy in a different MUB followed by post-measurement decoding. We prove that the MUB-QCT protocol allows secure key distribution with input states containing up to O(d) photons which implies a significant performance boost, characterized by an O(d) multiplication of key rate and a significant increase in the reachable distance. These results illustrate the power of the QCT security model to boost the performance of quantum cryptography while keeping a clear security advantage over classical cryptography.

IntroductionI

  From Quantum information to Quantum Cryptography 1 Quantum information and communication 1.1 Brief introduction to quantum mechanics . . . . . . . . . . . . . . . . . . . . . . . 1.1.1 Description of a quantum physical system . . . . . . . . . . . . . . . . . . . 1.1.2 Density operator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.3 Product system and purification . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Classical information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Quantum information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.1 Von Neumann entropy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.2 Encoding quantum information . . . . . . . . . . . . . . . . . . . . . . . . 1.3.3 Distance between quantum states . . . . . . . . . . . . . . . . . . . . . . 1.3.4 Distinguishability of quantum states . . . . . . . . . . . . . . . . . . . . . . 1.4 State discrimination with post-measurement information . . . . . . . . . . . . . . .

Figure 1 :

 1 Figure 1: Modèle de sécurité QCT : Hypothèse (a) : Chi↵rement sécurisé à court terme pendant le temps t comp , pendant lequel Alice et Bob peuvent échanger un secret classique éphémère S. Hypothèse (b) : Mémoire quantique limitée dans le temps, avec temps de cohérence t coh << t comp .

Figure

  ' sm e a s u r e m e n td e v i c e does not need to be trusted.

  du protocole MUB-QCT, Alice et Bob détiennent des variables aléatoires classiques X et Y , tandis qu'Eve détient une variable aléatoire classique Z et une mémoire quantique décohérée. La formule Csiszár et Körner [CK78a] R I(X; Y ) I(X; Z) peut donc être appliquée pour dériver la clé sécurisée taux. Prouver la sécurité du protocole MUB-QCT nécessite donc de borner les informations mutuelles d'Eve I(X; Z). Étant donné que II est la meilleure stratégie, nous pouvons utiliser la probabilité de deviner pour calculer une borne sur l'information mutuelle d'Eve. Nous prouvons que pour le protocole 1-MUB-QCT-(log d, log d) I(X; Z) ⇠ O(1/ p d), alors que pour -MUB-QCT-(1, log d) protocole I(X; Z) ⇠ O(1/d).

2.

  Mesure MUB proactive : où Eve mesure de manière proactive chaque copie séparément sur une base di↵érente, choisie parmi l'ensemble complet de MUB, suivie d'un décodage postmesure après le temps t comp . Nous prouvons que pour le protocole m-MUB-QCT-(1, log d), la mesure MUB proactive est plus e cace que la stratégie d'attaque individuelle. Dans le cas d'une stratégie d'attaque individuelle, les informations mutuelles d'Eve peuvent être limitées comme I Fix (X; Z) m  O ⇣ p m d ⌘ , tandis que pour la mesure MUB proactive, les informations mutuelles d'Eve augmentent linéairement avec m comme I Pro (X; Z) ⇠ O(m/j). Pour le protocole m-MUB-QCT-(log d, log d), nous prouvons que la stratégie d'attaque individuelle est plus e cace que la mesure MUB proactive. Dans le cas d'une stratégie d'attaque individuelle, les informations mutuelles d'Eve peuvent être limitées comme I Fix (X; Z) m  O ⇣ p m p d ⌘ , tandis que pour la mesure MUB proactive, les informations mutuelles d'Eve augmentent linéairement avec m comme I Pro (X; Z) ⇠ O(m/j). Le protocole MUB-QCT o↵re les avantages suivants :

  Il permet néanmoins une distribution sécurisée des clés avec des états d'entrée contenant jusqu'à O(d) photons, ce qui implique une augmentation significative des performances, caractérisée par une O(d)-multiplication des taux de clé comme indiqué dans la figure 9.3. La possibilité d'envoyer plusieurs copies de l'état quantique par utilisation de canal peut en outre être exploitée pour réaliser distribution de clé multipartite. En principe, Alice peut transmettre m copies à jusqu'à m Bobs autorisés, leur permettant de distiller la même clé.

Figure 2 :

 2 Figure 2: Key rate per channel use as a function of distance, for proactive MUB measurement strategy. The key rates are maximized against the photon number m. The parameters assumed in the plots are: Loss 0.2dB/Km; P dark = 10 6 ; e ciency of detectors ⌘ = 25%; visibility V = 98%. Since MUB-QCT can be implemented with 2 detection modes (2-single photon detectors) we also plot 2-modes PLOB bound [PLOB17a] as a benchmark..

  while for the proactive MUB measurement, Eve's mutual information increases linearly with m as I Pro (X; Z) ⇠ O(m/d). For for m-MUB-QCT-(log d, log d) protocol, we prove that the individual attack strategy is more e cient than the proactive MUB measurement. In the case of individual attack strategy Eve's mutual information can be upper bounded as as I Fix (X; Z) m  O ⇣ p m p d ⌘ , while for the proactive MUB measurement, Eve's mutual information increases linearly with m as I Pro (X; Z) ⇠ O(m/d).

  1.23) which corresponds to the Shannon entropy arising from measuring ⇢ in the given basis {|xihx|}. Theorem 1.3.1 (Properties of von Neumann entropy) Following are the properties of S: 1. S(⇢) 0, with equality if and only if ⇢ is pure. 2. In a finite dimensional Hilbert space H of dimension d, S(⇢)  log 2 d, with equality if and only if ⇢ = H /d. 3. S is invariant under unitary operation: for any unitary U , S(U⇢U † ) = S(⇢).

  1.26) and the quantum mutual information between systems A and B is S(A : B) = S(A) + S(B) S(A, B) = S(A) S(A|B) = S(B) S(B|A). (1.27) An important di↵erence with the classical setting is that the conditional von Neumann entropy can be negative. A non trivial property of the von Neumann entropy is given by the following theorem: Theorem 1.3.2 (Strong subadditivity.) For any three quantum system, A, B and C, one has: S(A, B, C) + S(B)  S(A, B) + S(B, C) (1.28)

Figure 1 . 1 :

 11 Figure1.1: Problem of state discrimination with and without using post-measurement information as depicted in[START_REF] Gopal | Using postmeasurement information in state discrimination[END_REF]

3.

  Apply to each block B j = b 1 b 2 b 3 b 4 b 5 b 6 a substitution S j . These substitutions are specified by S boxes, which describes the substitution as a look-up table. The output of the substitution cipher is 48 bit string C j , which results in a 32 bit string C 1 . . . C 8 . 4. Apply a fixed 32-bit permutation P to C 1 . . . C 8 and output the result f K i (R).

Figure 2

 2 Figure 2.1: The AES S-box, which is a function S : {0, 1} 8 ! {0, 1} 8 specified by the following list. All values in hexadecimal. The meaning is: S(00) = 63, S(01) = 7c, . . . , S(ff) = 16

Figure 2

 2 Figure 2.2: Shannon's model for a secrecy system.

Figure 2

 2 Figure 2.3: Wiretap channel model.

Figure 2

 2 Figure 2.4: Maurer's broadcast channel without a public channel.

Figure 2

 2 Figure 2.5: Maurer's broadcast channel with a public channel.

  R ✏The next result provides an upper and a lower bound for the secret key rate. Theorem 2.6.8 The secret key rate S(X; Y ||Z) verifies • S(X; Y ||Z)  min[I(X; Y ), I(X; Y |Z)]; • S(X; Y ||Z) max[I(Y ; X) I(Z; X), I(X; Y ) I(Z; Y )].

Figure 2

 2 Figure 2.6: A general setting for key establishment protocol between two authorized parties Alice and Bob, and an unauthorized party Eve.

Figure 3

 3 Figure 3.2: Details of experimental setups for CV-QKD based on a Gaussian coherent state alphabet. A CW telecom laser at 1550nm is transformed into 1 nsec pulses with a repetition rate of 100MHz using an amplitude modulator (AM). The Gaussian distributed signal is produced with a pair of modulators (AM and PM), and its brightness is controlled with a variable optical attenuator (VOA). Phase synchronization signals are produced in the modulators that are time-multiplexed with the quantum signal, either regularly as in (a) and (b) or randomly as in (c). The signals are injected into the channel and measured with a locally generated local oscillator at Bob. An AM produces local oscillator pulses while a PM randomly switches their phases by ⇡ to allow for a random quadrature measurement. Phase and frequency synchronization between LO and signal is attained through DSP of the data produced by the interference between the LO and the reference pulses. Taken from Ref. [HHL + 15].

Figure 3 . 3 :

 33 Figure 3.3: Basic setup of a MDI-QKD protocol. Alice and Bob prepare phase randomized weak coherent pulses (WCPs) in a di↵erent BB84 polarization state which is selected, independently and at random for each signal, by means of a polarization modulator (Pol-M). Decoy states are generated using an intensity modulator (Decoy-IM). Inside the measurement device, signals from Alice and Bob interfere at a 50:50 beam splitter (BS) that has on each end a polarizing beam splitter (PBS) projecting the input photons into either horizontal (H) or vertical (V ) polarization states. Four single-photon detectors are employed to detect the photons and the detection results are publicly announced. A successful Bell state measurement corresponds to the observation of precisely two detectors (associated to orthogonal polarization) being triggered. Alice's and Bob's laboratories are well shielded from the eavesdropper, while the measurement device can be untrusted.

K

  photon sources of Alice and Bob. Y 11 rect gives the gain, while e 11 diag is the QBER when Alice and Bob correctly send single-photon pulses. The function H 2 (•) is the binary Shannon entropy. The gain G rect and the QBER Q rect account for the case where the parties send more than one photon.

Figure 3

 3 Figure 3.4: Plot showing secret-key rate (bits per channel use) versus Alice-Bob's distance (km). Theoretical bounds (lines) and experimental results (symbols) are shown for di↵erent fiber-based quantum schemes. The secret-key capacity of PLOB [PLOB17a] bound: blue line, the ideal implementations of CV protocols: red dashed line, DV-QKD protocol BB84 with single-photon sources: green dotted dashed line. All the experiments represented are numbered in chronological order. The correspondence between numbers and references (following in square brackets) is: 1! [HLW + 15], 2! [CFL + 14], 3! [JKJL + 13], 4! [CLF + 16], 5! [YDD + 09], 6! [SHF + 14], 7 ! [NTH + 11],8! [LCW + 10],9! [SWV + 09], 10! [TNZ + 07], 11! [FLD + 17], 12! [YCY + 16], 13! [BBR + 18].

Figure 3 . 5 :

 35 Figure 3.5: Setup to implement TF-QKD. The light sources (LS) generate pulses whose intensities µ a,b are randomly varied by the intensity modulators (IM) to implement the decoy-state technique. Phase modulators (PM) are combined with random number generators (RNG) to encode each light pulse with phases ' a,b , which include the random phases ⇢ a,b . The variable optical attenuators (VOA) set the average output intensity of the pulses to bright (classical regime) or dim (quantum regime).

Figure 3 . 6 :

 36 Figure 3.6: Schematic of FL-QKD under Eve's optimum collective attack. Photons generated by Alice's broadband source are marked in black color line; photons generated by Alice's photon-pair source are marked by red color line; photons emitted by Eve's entanglement source are marked as a blue color line, and the thick purple line marks photons emitted by Bob's amplifier.

  of k observables, one can always find a state ⇢ such that H [M j (⇢)] = 0 for a given j. Therefore the constant c M in Equation (4.1) is at least larger than 1 1 k log 2 d. An entropic uncertainty relation that saturates this bound is said to be maximally strong. An almost maximally strong entropic uncertainty relation is obtained for a maximal choice of k = d+1 mutually unbiased observables, in which case the constant c M in Equation (4.1) equals log 2 d+1 2 [Sá93].

  1) log d} (4.33) compared with its classical capacity C = (1 p) log d and the private capacity P = (1 2p) log d.

Figure 5

 5 Figure 5.1: QCT security model: Assumption (a): Short-term secure encryption during time t comp , during which Alice and Bob can exchange an ephemeral classical secret S. Assumption (b): Timelimited quantum memory, with coherence time t coh << t comp .

Figure 6 . 2 :

 62 Figure 6.2: Reduction to wiretap channel setting: Eve has full access to the classical and quantum channel, and as at the end of the MUB-QCT protocol Alice and Bob hold classical random variables X and Y , while Eve holds a classical random variable Z. Moreover, Eve has no knowledge of the random variable X other than her knowledge of Z, thus, following I. Csiszár, J. Körner [CK78a] the setting reduces that of a classical wiretap channel. As a result, a positive key rate can be obtained as R I(X; Y ) I(X; Z)

•

  In section 6.3.3, we propose MUB-QCT protocol with multiple copies per channel use, namely m-MUB-QCT-(log d, log d) and m-MUB-QCT-(1, log d) protocol.

Figure 7 . 1 :

 71 Figure 7.1: Plot of P guess as a function for d for from Equation (7.19) and Table [7.1]. The fitted curve satisfies P guess = 1.129 p d . This shows that our numerical calculations match the analytic result and for large value of d P guess / O ⇣

  1 p e ) log(1 p e ) p e log ⇣ p e

  Extractors were first defined by Nisan and Zuckerman [NZ96]. Definition 7.3.1 (✏-close) Let X and Y be random variables defined on the same sample space S with probability distributions p X and p Y , respectively. X and Y are ✏-close in the trace distance (Definition 1.34) i↵ D(X, Y )  ✏ (7.25) Definition 7.3.2 (Extractor) A (k, ✏)-extractor is a function Ext : {0, 1} n ⇥ {0, 1} d ! {0, 1} m (7.26) such that for every distribution X on {0, 1} n with H min (X) k the distribution Ext(X, Y ) (where Y is uniformly distributed in {0, 1} d ) is ✏-close to the uniform distribution on {0, 1} m

  Definition 7.3.3 (Strong extractor) A (k, ✏)-extractor is a functionExt : {0, 1} n ⇥ {0, 1} d ! {0, 1} m (7.27) such that for every distribution X on {0, 1} n with H min (X) k the distribution Y Ext(X, Y ) 1 (where Y is uniformly distributed in {0, 1} d ) is ✏-close to the uniform distribution on {0, 1} m

  p e = T ⌘(1 V ) + p dark T ⌘ + 2p dark (7.48) For single copy of the quantum state sent per channel use the key rates per channel use 7.46 as a function of the distance is plotted in the figure 7.2.

Figure 7 . 2 :

 72 Figure 7.2: Key rate per channel use as a function of distance. The parameters assumed in the plots are: Loss 0.2dB/Km; P dark = 10 6 ; e ciency of detectors ⌘ = 25%; visibility V = 98%. Since MUB-QCT can be implemented with 2 detection modes (2-single photon detectors) we also plot 2-modes PLOB bound [PLOB17a] as a benchmark..

P

  guess (m) = P (1, m) + P (2, m) + . . . + P (m 1, m) + P (m, m) (8.11) Success probability of guessing s copies correctly, when m copies are sent, is described by the Binomial distribution, P (s, m) = m! (m s)!.s! (P guess ) s

Figure 9 . 1 :

 91 Figure 9.1: Key rate per channel use for the MUB-QCT protocol as a function of error rate for di↵erent values of d.

  ' sm e a s u r e m e n td e v i c e does not need to be trusted. Table 9.1: Comparison of the prepare and measure HD-QKD with the MUB-QCT protocol.

Figure 9

 9 Figure 9.2: (a)The MUB-QCT protocol's detectors requirement remains fixed, i.e., two detectors (to distinguish a bit), irrespective of d. This, significantly relaxes resource requirements compared to (b) HD-QKD schemes [LPD + 13, LBZ + 16a], which requires d-single-photon detectors.

Figure 9 . 3 :

 93 Figure 9.3: Key rate per channel use as a function of distance, for proactive MUB measurement strategy. The key rates are maximized against the photon number m. The parameters assumed in the plots are: Loss 0.2dB/Km; P dark = 10 6 ; e ciency of detectors ⌘ = 25%; visibility V = 98%. Since MUB-QCT can be implemented with 2 detection modes (2-single photon detectors) we also plot 2-modes PLOB bound [PLOB17a] as a benchmark..

  Figure 9.4: Plot of key rate per channel use as a function for distance(Km) for superconducting nanowire single-photon detectors (SNSPDs) with p dark = 10 8 , ⌘ = 66%, and V = 98%. The plots for d = 10 6 , 10 5 , 10 4 , 10 3 , 100, 10 are optimized by maximizing the key rate as a function of distance for di↵erent value of m.

Figure ( 9

 9 Figure (9.5), presents the trust assumptions required on hardware to prove security in (a) prepare and measure QKD, (b) MDI QKD, and (c) MUB-QCT. In general, hardware in Alice and Bob's labs comprise classical storage, a classical processing device and a device to perform quantum operations. This hardware may require some trust factor depending on their utility in the protocol. For instance,

Figure 9

 9 Figure 9.6: Multiparty MUB-QCT: m copies of the state | xr✓ i generated can be sent to m authorized parties (Bob) simultaneously, allowing them to distill same key together.

•

  Csiszár and 141 Körner formula [CK78b]: R I(X; Y ) I(X; Z) H min (X|Z) H(X|Y ) (10.1) This allows to make several observations, regarding the properties of 1-MUB-QCT protocol • High noise tolerance for large d : Similarly to high-dimensional QKD [CBKG02a], 1-MUB-QCT protocol allows high resilience to noise by o↵ering tolerable error rate of up to 50% for large d Fixed resource requirements: The 1-MUB-QCT (1, log d) protocol can be implemented with only two detectors, irrespectively of d . This relaxes resource requirements compared to HD-QKD schemes, requiring d-single-photon detectors [DBD + 17].

  z n where z l = x i l x j l . -Partial Matching Problem Using the notations above, we can define the following -Partial Matching ( P M ) problem Alice input x 2 R {0, 1} n Bob input -matching M 2 R M n and ! 2 {0, 1} n Promise on the Alice-Bob input: There is a bit b such that ! = Mx b n (equivalently, we have either Mx ⌘ z = ! or Mx = ! ). Communication model Classical or Quantum one-way communication between A and B Goal Bob evaluates b Theorem 11.1.1 Let 2 (0, 1/4]. The classical bounded-error one-way communication complexity of the -Partial Matching problem is R 1 ( P M ) = ⇥( p n/ ), while the quantum bounded-error one-way complexity is Q 1 ( P M ) = O(log(n)/ ) QCT-HM key distribution: Alice and Bob can communication with short-term security over a classical channel using computational encryption E k (short-term secure key k, can either be a public or secret key, and has been previously shared with another, out-of-band channel). Alice generates an instance x, M of the 1 4 -Partial Matching Problem and sends M, ! to Bob (with short-term security) with ! = Mx b n/4 . Alice wants to send information about b to Bob, with long-term (everlasting) security against Eve. Alice uses one-way quantum communication (over a quantum channel of transmission T = t 2 ) to send the encrypted mode coherent state |↵i x (see below) with mean photon number |↵ 2 | to Bob. Bob measures according to the partial matching, leading to a mutual information I(A : B) ⇠ T |↵ 2 | (in the high loss-no error regime). Because of the QCT security model, Eve's best strategy to learn information about b is to measure |↵i x immediately, i.e. before knowing anything about M . Using the mapping introduced in [AL14], Eve's accessible information scales like O (|↵| 2 log n) bits. Using theorem 11.1.1, this leads to a vanishingly (in n ) small upper bound on I(A : E), provided the total number of photons sent by Alice is o( p n).

  [n]) by the factor ⇢ |S| . It is easy to see

r

  |i ar ihi ar | ⌘ (B z U u ) † (11.12) for a vector state |i ar i 2 H with i ar = n 2 ⇥ a + r and r 2 [n/2] Alice sends this state ⇢ a to Bob on a insecure quantum channel. Knowing u and z Bob decodes the bit by performing a projective measurement M uz b on ⇢ a and obtains an outcomeb 2 {0, 1}. Bob's measurement is defined by two-outcome POVM {M uz b } b2{0,1} as Protocol based on Khot-Vishnoi Game Input: Alice:(a 2 {0, 1}, u 2 [2 n ], z 2 [2 n ], r 2 [n/2]), Bob: (Enc(u, z), Dec, ⇢ a ).Output: Alice: a 2 {0, 1}, Bob: b 2 {0, 1}.The protocol:I Data generation:• Alice chooses a 2 {0, 1}, u 2 [2 n ], z 2 [2 n],, and r 2 [n/2], uniformly at random. II Time lock:

•

  Measurement: Bob measures each quantum state using a POVM, M uz b (11.13), and outputs the result b 2 {0, 1}. After k channel use Alice and Bob outputs: (a k 2 {0, 1} k , b n 2 {0, 1} k

◆

  Defining the the set V d,n of unitary transformations on n qudits byV d,n := {V = V u 1 ⌦ • • • ⌦ V un |u i 2 {0, .. . , d}}. P denotes a family of pair-wise independent permutations.Theorem 11.2.1 LetA = A 1 A 2 with |A| = d n , |A 1 | = d ⇠n , |A 2 | = d (1 ⇠)n, and d a prime power.

Figure 11 .

 11 Figure 11.1: A sketch of possible implementation of the 1 MUB QCT (1, 3) protocol, for single channel use. The value of di↵erent parameters considered are as following: x = 0, r = 1, ✓ = 1, and = 1. The modes considered are spatial modes. Acronyms used in the figure are, BS: Beam Splitter, PM: Phase Modulator.

P

  [click in bad detector due to dark count] = (d)p dark d 1 (d) = (d 1).p dark . (B.6) IV Probability that there is a click in the detector is P [click] = P [click due to signal] ⇥ P [click in a detector due to dark count]

  P wrong P [click] (B.11) 3.2 Details of experimental setups for CV-QKD based on a Gaussian coherent state alphabet. A CW telecom laser at 1550nm is transformed into 1 nsec pulses with a repetition rate of 100MHz using an amplitude modulator (AM). The Gaussian distributed signal is produced with a pair of modulators (AM and PM), and its brightness is controlled with a variable optical attenuator (VOA). Phase synchronization signals are produced in the modulators that are time-multiplexed with the quantum signal, either regularly as in (a) and (b) or randomly as in (c). The signals are injected into the channel and measured with a locally generated local oscillator at Bob. An AM produces local oscillator pulses while a PM randomly switches their phases by ⇡ to allow for a random quadrature measurement. Phase and frequency synchronization between LO and signal is attained through DSP of the data produced by the interference between the LO and the reference pulses. Taken from Ref. [HHL + 15]. 65 3.3 Basic setup of a MDI-QKD protocol. Alice and Bob prepare phase randomized weak coherent pulses (WCPs) in a di↵erent BB84 polarization state which is selected, independently and at random for each signal, by means of a polarization modulator (Pol-M). Decoy states are generated using an intensity modulator (Decoy-IM). Inside the measurement device, signals from Alice and Bob interfere at a 50:50 beam splitter (BS) that has on each end a polarizing beam splitter (PBS) projecting the input photons into either horizontal (H) or vertical (V ) polarization states. Four single-photon detectors are employed to detect the photons and the detection results are publicly announced. A successful Bell state measurement corresponds to the observation of precisely two detectors (associated to orthogonal polarization) being triggered. Alice's and Bob's laboratories are well shielded from the eavesdropper, while the measurement device can be untrusted. . . . . . . . . . . . . . . . . . . . 70 3.4 Plot showing secret-key rate (bits per channel use) versus Alice-Bob's distance (km). Theoretical bounds (lines) and experimental results (symbols) are shown for di↵erent fiber-based quantum schemes. The secret-key capacity of PLOB [PLOB17a] bound: blue line, the ideal implementations of CV protocols: red dashed line, DV-QKD protocol BB84 with single-photon sources: green dotted dashed line. All the experiments represented are numbered in chronological order. The correspondence between numbers and references (following in square brackets) is: 1! [HLW + 15], 2! [CFL + 14], 3! [JKJL + 13], 4! [CLF + 16], 5! [YDD + 09], 6! [SHF + 14], 7 ! [NTH + 11],8! [LCW + 10],9! [SWV + 09], 10! [TNZ + 07], 11! [FLD + 17], 12! [YCY + 16], 13! [BBR + 18]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 3.5 Setup to implement TF-QKD. The light sources (LS) generate pulses whose intensities µ a,b are randomly varied by the intensity modulators (IM) to implement the decoy-state technique. Phase modulators (PM) are combined with random number generators (RNG) to encode each light pulse with phases ' a,b , which include the random phases ⇢ a,b . The variable optical attenuators (VOA) set the average output intensity of the pulses to bright (classical regime) or dim (quantum regime). . . .

7. 2

 2 Key rate per channel use as a function of distance. The parameters assumed in the plots are: Loss 0.2dB/Km; P dark = 10 6 ; e ciency of detectors ⌘ = 25%; visibility V = 98%. Since MUB-QCT can be implemented with 2 detection modes (2-single photon detectors) we also plot 2-modes PLOB bound[START_REF] Pirandola | Fundamental limits of repeaterless quantum communications[END_REF] as a benchmark.. 9.1 Key rate per channel use for the MUB-QCT protocol as a function of error rate for di↵erent values of d. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2 (a)The MUB-QCT protocol's detectors requirement remains fixed, i.e., two detectors (to distinguish a bit), irrespective of d. This, significantly relaxes resource requirements compared to (b) HD-QKD schemes [LPD + 13, LBZ + 16a], which requires d-single-photon detectors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Titre : Cryptographie quantique dans un mod èle de s écurit é hybride Mots cl és : Quantum Computational Timelock, Everlasting Security, Quantum cryptography, Quantum information theory, Quantum Key Distribution R ésum é : L'extension des fonctionnalit és et le d épassement des limitations de performances de QKD n écessitent soit des r ép éteurs quantiques, soit de nouveaux mod èles de s écurit é. En étudiant cette derni ère option, nous introduisons le mod èle de s écurit é Quantum Computational Timelock (QCT), en supposant que le cryptage s écuris é informatiquement ne peut être rompu qu'apr ès un temps beaucoup plus long que le temps de coh érence des m émoires quantiques disponibles. Ces deux hypoth èses, à savoir la s écurit é informatique à court terme et le stockage quantique bruit é, ont jusqu' à pr ésent d éj à ét é prises en compte en cryptographie quantique, mais seulement de mani ère disjointe. Une limite inf érieure pratique du temps, pour laquelle le cryptage est s écuris é du point de vue informatique, peut être d éduite de la s écurit é à long terme suppos ée du sch éma de cryptage AES256 (30 ans) et de la valeur du temps de coh érence dans les d émonstrations exp érimentales de stockage puis de r écup ération de quantum optiquement cod é. l'information, au niveau d'un seul photon, va de quelques nanosecondes à quelques microsecondes. Compte tenu du grand écart entre la borne sup érieure du temps de coh érence et la borne inf érieure du temps de s écurit é de calcul d'un sch éma de chiffrement, la validit é du mod èle de s écurit é QCT peut être suppos ée avec une tr ès grande confiance aujourd'hui et laisse également une marge consid érable pour sa validit é dans le futur. En utilisant le mod èle de s écurit é QCT, nous pro-posons un protocole d'accord de cl é explicite à dimension d que nous appelons MUB-Quantum Computational Timelock (MUB-QCT), o ù un bit est cod é sur un état qudit en utilisant un ensemble complet de bases mutuellement impartiales (MUB ) et une famille de permutations ind épendantes par paires. La s écurit é est prouv ée en montrant que la borne sup érieure sur les échelles d'information d'Eve est O(1/d). Nous montrons que MUB-QCT offre : une haute r ésilience aux erreurs (jusqu' à 50 % pour les grands d) avec des exigences mat érielles fixes ; La s écurit é MDI car la s écurit é est ind épendante de la surveillance des canaux et ne n écessite pas de faire confiance aux appareils de mesure. Nous prouvons également la s écurit é du protocole MUB-QCT, avec plusieurs photons par utilisation de canal, contre les attaques non adaptatives, en particulier la mesure MUB proactive o ù eve mesure chaque copie dans un MUB diff érent suivi d'un d écodage postmesure. Nous prouvons que le protocole MUB-QCT permet une distribution s écuris ée des cl és avec des états d'entr ée contenant jusqu' à O(d) photons, ce qui implique une am élioration significative des performances, caract éris ée par une multiplication O(d) du taux de cl é et une augmentation significative de la distance accessible. Ces r ésultats illustrent la puissance du mod èle de s écurit é QCT pour augmenter les performances de la cryptographie quantique tout en gardant un net avantage de s écurit é par rapport à la cryptographie classique. Institut Polytechnique de Paris 91120 Palaiseau, France Title : Quantum cryptography in a hybrid security model Keywords : Quantum Computational Timelock, Everlasting Security, Quantum cryptography, Quantum information theory, Quantum Key Distribution

  Probabilistic algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.3 Models of adversary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 Perfect secrecy and its limitation . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.1 Perfect secrecy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.2 One-time pad (Vernam's cipher) . . . . . . . . . . . . . . . . . . . . . . . . 2.3.3 Limitations of perfect secrecy . . . . . . . . . . . . . . . . . . . . . . . . . 2.4 A computational approach to cryptography . . . . . . . . . . . . . . . . . . . . . . 2.5 One-way and trapdoor functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5.1 One-way functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2 Cryptography 2.1 Secure communication: a short summary . . . . . . . . . . . . . . . . . . . . . . . 2.2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.1 Complexity classes and standard definitions . . . . . . . . . . . . . . . . . . 2.2.2 2.5.2 Trapdoor functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5.3 Block ciphers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5.4 Limitations of computational security . . . . . . . . . . . . . . . . . . . . . 2.6 Information-theoretic security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii

  CONTENTS • (I) Eve stocke l'état quantique d'entrée ⇢ x dans son stockage quantique et e↵ectue ensuite une mesure au temps t comp , connaissant le secret s, pour obtenir z 2 Z. • (II) Eve e↵ectue une mesure immédiate sur l'état d'entrée ⇢ x et obtient un résultat classique !. Au temps t comp , elle e↵ectue un décodage classique post-mesure en utilisant s et ! pour obtenir z 2 Z. La sécurité des protocoles est prouvée en démontrant que sous les hypothèses QCT, la stratégie d'attaque optimale pour la partie non autorisée Eve consiste en une mesure immédiate suivie d'un post-traitement classique sur les données de mesure, c'est-à-dire la stratégie II. Cette stratégie est connue sous le nom de discrimination d'état avec des informations post-mesure comme décrit dans [GW10]. Pour les protocoles 1-MUB-QCT-(log d, log d) et 1-MUB-QCT-(1, log d), nous prouvons que la stratégie d'écoute optimale est II. Pour le 1-MUB-QCT-(log d, log d), nous prouvons que la probabilité de deviner pour Eve si elle exécute la stratégie II est O

	La sécurité des protocoles :
	⇣
	1 p d

  The set of operators, {E i }, can be used, instead of {M i }, to estimate the probability of various measurement outcomes.

	Postulate 4; Dynamics: The state vector | i obeys the Schrödinger equation
	i~d dt	| (t)i = H| (t)i	(1.5)

  Xn (x 1 , . . . , x n ) log 2 P X 1 ,...,Xn (x 1 , . . . , x n ) , . . . , X n )  H(X 1 ) + . . . + H(X n ), with equality if and only if the X i are independent.3. If X is finite, H(X)  log 2 |X | with equality if and only if X is uniformly distributed over X .

	(1.11)
	From this definition, one can immediately deduce the following properties:
	Theorem 1.2.2 (Properties of the entropy) following are the basic properties of the Shannon
	entropy,
	1. H(X) 0, with equality if and only if X is certain.
	2. H is subadditive: H(X 1

  Similar to the Shannon entropy, the von Neumann entropy of a quantum state ⇢ x is given by

	1.3 Quantum information
	1.3.1 Von Neumann entropy

  Let B ✓ 1 = {|e ✓ 1 0 i, . . . , |e ✓ 1 d 1 i} and B ✓ 2 = {|e ✓ 2 0 i, . . . ,|e ✓ 2 d 1 i} be two orthonormal bases in a d dimensional Hilbert space. Then, ✓ 1 and ✓ 2 are mutually unbiased if and only if

	.32)
	The basis vectors in Eq. (1.29) are eigen states of the Pauli matrix z , referred as "Z basis".
	Similarly states in Eq. (3.3) are eigenstates of x , known as "X basis" and states in Eq. (3.4) are
	eigenstates of y , referred as "Y basis". It is worth noting that each of these pairs of eigenstates
	forms a basis which are mutually unbiased to one another, referred to as mutually unbiased bases
	(MUB). Formally defined as,
	Definition 1.3.3 (Mutually Unbiased Bases)

  .1. We formally define this problem again here. Let X and B be finite sets and and let P X,⇥ = {p x✓ } be a probability distribution over X ⇥ B. Consider an ensemble of quantum state E = {p x✓ , ⇢ x✓ }. We assume that X , B, E and P X,⇥ are known to both Alice and Bob. Suppose now that Alice chooses xy 2 X ⇥ B according to the probability distribution P X,⇥ , and sends the state ⇢ x✓ to Bob. We can then define the tasks: It is the following task for Bob. Given the state ⇢ x✓ , determine x, by performing any measurement on ⇢ x✓ immediately upon receipt.

	1.4. STATE DISCRIMINATION WITH POST-MEASUREMENT INFORMATION
	3. Then, Bob performs post-measurement decoding by using the measurement outcome ⌦ and
	✓ to obtain an outcome z as a guess of x.
	Definition 1.4.1 (State discrimination) Definition 1.4.2 (State discrimination using post-measurement information) It is the fol-
	lowing task for Bob. Given the state ⇢ x✓ , determine x, by using the following source of information
	in succession.
	1. He can perform any measurement on ⇢ x✓ immediately upon reception and obtain an outcome
	⌦. Afterward, he can stores the measurement outcome ⌦ in unlimited classical storage.
	2. After Bob's measurement, Alice announces ✓.

  which finally implies I acc (X; E) . ✏ log d n The minimum value of K for which Q x ( ) is close enough to its average for all x and | i can be obtained by applying suitable concentration inequalities[START_REF] Ahlswede | Strong converse for identification via quantum channels[END_REF][START_REF] Pirandola | Direct and reverse secret-key capacities of a quantum channel[END_REF]. For n large enough and if ✏ decreases sublinearly with n, we have obtained the following condition on K [LL15c],

	1 n	log K & max{log , log d	}	(4.30)
	where = 1 n log M is the communication rate, and
	n

Table 5

 5

.1: Quantum storage time of di↵erent state of the art quantum memory systems. For the comparison, we considered experimentally demonstrated quantum memories which have shown storage of optically encoded quantum light, and are at single-photon level.

Table 7 .

 7 7.1].Plotting P guess as a function for d, from Equation (8.13) and Table7.1, in Figure7.1, shows that our numerical calculations matches the analytic result and for large value of d, P guess / O 1: P guess for di↵erent values of d as calculated numerically by SDP

	⇣	⌘
	1 p d	.

  Eve stores the input quantum state ⇢ x in her quantum storage and later performs a measurement at time t comp given the information (✓, ) that will then be revealed to her, and she obtains z 2 {0, 1}.II Eve performs an immediate measurement on input state ⇢ x and obtains a classical outcome !. At time t comp , she performs post-measurement classical decoding using (✓, ) and ! to obtain z 2 {0, 1}. If Eve follows the strategy I, her success probability to guess the bit x correctly can be upper bounded usung tfollowing property that if 1 2 N t coh (⇢ x ) I d For strategy II, the guessing probability to guess the key bit is P II guess

	7.3. SECURITY OF 1-MUB-QCT-(1, LOG D) PROTOCOL		123
	I Lemma 7.3.1 For strategy I, the guessing probability to guess the key bit is P I ⇣ ⌘ guess (X|E)  1 2 + o 1 d .
	Proof: d 1 1 2 + ✏, as presented in [WWQ + 19] and proved in [Ren08]. Given the decoherence model described  ✏ then P guess is not larger than in Equation (5.2), the guessing probability is then,
	P I guess (X|E) 	1 2	+ o	⇣	1 d	⌘	.	(7.37)
								⇤
	Lemma 7.3.2
								36)
	7.3.2 Reduction of optimal eavesdropping attack strategy to QC-extractor
	Optimal attack strategy Due to the QCT security model, Eve strategy is restricted to two
	alternatives:

  and H min (A|E) log 2 |A 2 | = log 2 d 1. Putting all these value in the expression of ", we get At the end of the MUB-QCT protocol Alice and Bob hold classical random variables X and Y , while Eve holds a classical random variable Z and decohered quantum memory. Moreover, Eve does not know the random variable X other than her knowledge of Z, thus, following I. Csiszár, J. Körner[START_REF] Csiszár | Broadcast channels with confidential messages[END_REF] the MUB-QCT setting reduces to an e↵ective wiretap scenario, as shown in figure (6.2).Very notably, the upper bound on Eve information can be achieved by only considering the input state and not Bob measurement's results. For I(X; Y ) = 1 h 2 (p e ), this implies a positive key rate can be distilled if the estimated bit error rate p e < 1

		" 	2 d(d + 1) p	.		(7.43)
	The success probability to guess the key bit is then
	P II guess (X|Z) 	1 2	+	1 d(d + 1) p	⇠	1 2	+ O	⇣	1 d	⌘	(7.44)
	Equation (7.44) proves the matching upper bound for guessing probability as in Equation (7.38).
	Indicating that measurement in a fixed MUB is essentially the optimal immediate measurement
	strategy strategy. Following Equation (7.38) and (7.44) we have
		P II guess (X|Z) 	1 2	+ ⌦	⇣	1 d	⌘	(7.45)
												⇤
	Proposition 7.3.1 (Optimal attack strategy) Strategy II is the optimal attack strategy for Eve
	to guess the key bit.
	Proof: The proof follows from Lemma 7.3.1 and Lemma 7.3.2.	⇤
	7.3.3 Security of the protocol
	As a result, a positive key rate can be obtained as
		R I(X; Y ) I(X; Z),	(7.46)
	which requires to bound Eve's information I(X; Z). Following guessing probability (7.45) Eve's
	mutual information is bounded as	I(X; Z) ⇠ ⌦	⇣	1 d	⌘	(7.47)
									2		c p d for a constant c > 1.

  now analyze the case when Alice send m copies of the quantum state per channel use. She prepares m copies of the qudit state, P U ✓ |i xr ihi xr |(P U ✓ ) † , using same basis ✓ and local randomness r. She send the state ⇢

	(m)
	x

Table 10 .

 10 1: Overview of di↵erent quantum-based key distribution protocols in high dimension. In the table, d is the dimension of the system, T is the transmittance of the channel, and m is the number of photons that are sent per channel use.

	Protocol	Security Model	Secure Key Rate per	Performance
			channel use
	QKD: d dimension	Information Theoretic Sec.	⇠ T log 2 (d)	-Less than one photon per chan-nel use (m < 1).
				-For fixed detection technology
	(p Flood Light QKD [ZZD + 16, Information Theoretic Sec. ⇠ mT [1 h 2 ( e mT 2 ) T m 2 d log 2 m+d -O(m)-fold secret key rate in-crease w.r.t. QKD. m ] -no distance increase w.r.t.
	ZZWS17]			QKD.
				-Security proven for restricted
				attacks [ZZD + 16, ZZLS18].
	Quantum Data Locking	Time-limited Q memory	⇠ T log 2 (d)	-Security is independent of chan-nel monitoring.
	Discrete			-m = 1 (encoding on single pho-
	Variable			tons).
	[LL14]
	Quantum	Time-limited Q	Direct Reconciliation	-Security is independent of chan-
	Data Locking	memory	DR = 1+log(T /(1 T )),	nel monitoring.
	Continuous		Reverse Reconciliation	-Constructions based on random
	Variable		RR = 1 + log(1/(1 T ))	codes.
	[LL15a]
	Q. Comp. Timelock	Time-limited Q memory	⇠ mT log 2 (d/m)	-O(m)-fold secret key rate in-crease w.r.t. QKD.
	MUB-QCT	Short-term sec.		-Security is independent of chan-
	[our work]	encryption		nel monitoring.

d ) and T = 10 L/50 , L max < 25 log(1/p d ).

  wrong =P [click due to signal in bad detector and no click due to dark counts] + P [no click due to signal and there is click due to dark count in bad detectors] + P [click due to signal in bad detector and click due to dark count in bad detectors]

  . 74 3.6 Schematic of FL-QKD under Eve's optimum collective attack. Photons generated by Alice's broadband source are marked in black color line; photons generated by Alice's photon-pair source are marked by red color line; photons emitted by Eve's entanglement source are marked as a blue color line, and the thick purple line marks photons emitted by Bob's amplifier. . . . . . . . . . . . . . . . . . . . . . . . . . 75 5.1 QCT security model: Assumption (a): Short-term secure encryption during time t comp , during which Alice and Bob can exchange an ephemeral classical secret S. Assumption (b): Time-limited quantum memory, with coherence time t coh << t comp 5.2 Validity of QCT security model with respect to existing computational hardness assumption for AES and demonstrated quantum storage coherence time at single photon level. For example, assuming t comp > 10 5 sec, seems safe. . . . . . . . . . 6.1 A general protocol describing QCT construction in QCT security model. Protocol is defined between authorized parties Alice and Bob, and an unauthorized party Eve. Alice encodes the classical message x on a quantum state ⇢ x , using the secret s, and send it over the quantum channel. Objective for both Bob and Eve is to guess x given ⇢ x and Enc(s). Bob measure it immediately using the measurement operator M s y , obtaining the outcome y. However, assumptions of QCT security model forces Eve to measure the quantum state ⇢ x before t coh using the POVM ⇧ ! to obtain classical outcome ! and perform post-measurement classical decoding at time t t comp to guess z. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2 Reduction to wiretap channel setting: Eve has full access to the classical and quantum channel, and as at the end of the MUB-QCT protocol Alice and Bob hold classical random variables X and Y , while Eve holds a classical random variable Z. Moreover, Eve has no knowledge of the random variable X other than her knowledge of Z, thus, following I. Csiszár, J. Körner [CK78a] the setting reduces that of a classical wiretap channel. As a result, a positive key rate can be obtained as R I(X; Y ) I(X; Z) 6.3 A general overview of MUB-QCT protocol. Communication between authorized Alice and Bob (in green). Technologically limited Eve (in yellow) cannot break timelocked encryption before t comp and can only store quantum state in quantum memory during time t coh < t comp . As a result, forcing Eve to measure ⇢ x immediately. At a later at time, after t comp , time-locked encryption elapses, and Eve learns (✓, ) and performs classical decoding to obtain z. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1 Plot of P guess as a function for d for from Equation (7.19) and Table [7.1]. The fitted curve satisfies P guess = 1.129 p d . This shows that our numerical calculations match the analytic result and for large value of d P guess / O

	⇣
	1 p d

⌘

. . . . . . . . . . . . . . .

The key-generation algorithm Gen works by choosing a string from K = {0, 1} l according to the uniform distribution (i.e., each of the 2 l strings in the space is chosen as the key with probability 2 l .)

Acknowledgements

from the QCT security model: If an adversary Eve chooses to store the extra photons in her quantum storage, then she cannot store them for the time more than t coh . At the time t comp , encoding basis information is revealed for Eve to measure her stored quantum states. However, according to the QCT security model t coh < t comp i.e., quantum storage decoheres before the basis information is revealed. Moreover, as proved in Section 7.2.1 the optimal measurement for the Eve is to measure the quantum state immediately upon receiving instead of storing the state in the quantum storage and measure at t comp . Thus, it is impossible to implement a successful PNS attack in the QCT security model. Implying multiple copies with identical encoding can be sent in the MUB-QCT protocol.

Chapter 7

Security of MUB-QCT protocol

In this chapter we present the security of the MUB-QCT protocols. The security of the protocols is proved by demonstrating that under the QCT assumptions, the optimal attack strategy for nonauthorized party Eve consists in an immediate measurement followed by classical post-processing on measurement data. This strategy is known as state discrimination with post measurement information as described in [START_REF] Gopal | Using postmeasurement information in state discrimination[END_REF]. For this state discrimination problem, we determine the maximum success probability or the guessing probability for Eve to retrieve the key, to calculate a bound on Eve's information.

Security definition

The security of the MUB-QCT protocol is o↵ered by the QCT security model e↵ects, and requires to prove two things: correctness and secretness.

• The protocol is correct if Alice and Bob's output bits di↵ers with negligible probability.

As described in Section 6.2.2, at the end of the MUB-QCT primitive, Eve learns a classical random variable Z. She does not know the random variable X, other than her knowledge of Z. This setting is similar to the one for classical secret key agreement by a public discussion on a broadcasting channel [START_REF] Maurer | Secret key agreement by public discussion from common information[END_REF]. Eve's input channel can then be considered a wiretap channel, where wire-tapper Eve's received message is direct input from Alice's source and is thus not necessarily a degraded version of the message. Moreover, if Eve's mutual information I(X; Z) is less than Alice and Bob's mutual information I(X; Y ) [START_REF] Csiszár | Broadcast channels with confidential messages[END_REF], then the security of such a setting is guaranteed.

• To complete the secrecy proof of QCT construction, the principle idea is to bind Eve's mutual information I(X; Z) and to show that I(X; Z) < I(X; Y ).

It hence di↵ers QKD, where Eve has access to a perfect quantum memory and security definition uses trace distance.

Following the security definition 2.6.5, for the key agreement from a correlated classical data, as defined in the Section 2.6.3, the over all security criterion of the MUB-QCT protocol is defined as Definition 7.1.1 (Security definition) A cryptographic protocol for key distribution in the QCT security model is secure if it satisfies following properties:

Appendix A Bounding the norm of sum of l rank-1 projector Following inequality holds for the sum of l rank-1 projectors acting on an arbitrary finite dimensional Hilbert space

Proof: Let us introduce an an auxiliary Hilbert space C l , and define a standard basis |ii, i = 1, . . . , l, for this space. Consider then an operator Q acting on

which is a block matrix with the first blockrow containing the projectors O i . Using the fact that

where denotes addition modulo l. This decomposition amounts to writing Q † Q as a block diagonal matrix plus a sum of l 1 matrices, each with a block structure and containing only displaced diagonals (i.e. have the structure of a block permutation matrix).

The first term of the right had side of the above equation has operator norm

APPENDIX A. BOUNDING THE NORM OF SUM OF L RANK-1 PROJECTOR since the operator norm of a block diagonal operator is the maximal operator norm of any block, which in our case is unity. For each of the remaining terms we can use the fact that the operator norm, being equal to the largest singular value, is invariant under the transformation Q ! UQV where U and V are unitary operators. Choosing U = ⌦ and V j = P i |i ji ⌦ , we see that

and thus

again due to the block structure of the transformed matrix. Since

cos , we can place the same bound cos on each of the l 1 terms. Finally by using repeatedly the triangle inequality we obtain

Calculation for threshold error probability

Consider a lossy channel, with T the transmittance of the channel, defined as T = 10 ↵L/10 , ↵ = 0.2dB/km. Let there be d detectors, with ⌘ be the detector e ciency, V be the visibility of the detection and p dark the dark-count probability per detector then, I When sending m-copies, the probability that at-least one copy reaches one of the detector is

) and the probability that no signal reaches the detector is

II The probability that there is click due to signal in a detector is

The probability that the signal is detected correctly in a good detector is

Similarly, the probability that the signal is detected correctly in the bad detectors

III Since there are d detectors the probability of click in k detectors due to dark counts is In the table, d is the dimension of the system, T is the transmittance of the channel, and m is the number of photons that are sent per channel use. . . . . . . . . . . .