Noisy-storage model

Last updated December 25, 2024

The noisy-storage model^[1] refers to a cryptographic model employed in quantum cryptography. It assumes that the quantum memory device of an attacker (adversary) trying to break the protocol is imperfect (noisy). The main goal of this model is to enable the secure implementation of two-party cryptographic primitives, such as bit commitment, oblivious transfer and secure identification.

Motivation

Quantum communication has proven to be extremely useful when it comes to distributing encryption keys. It allows two distant parties Alice and Bob to expand a small initial secret key into an arbitrarily long secret key by sending qubits (quantum bits) to each other. Most importantly, it can be shown that any eavesdropper trying to listen into their communication cannot intercept any information about the long key. This is known as quantum key distribution (QKD).

Yet, it has been shown that even quantum communication does not allow the secure implementation of many other two-party cryptographic tasks.^[2]^[3]^[4]^[5] These all form instances of secure function evaluation. An example is oblivious transfer. What sets these tasks apart from key distribution is that they aim to solve problems between two parties, Alice and Bob, who do not trust each other. That is, there is no outside party like an eavesdropper, only Alice and Bob. Intuitively, it is this lack of trust that makes the problem hard. Unlike in quantum key distribution, Alice and Bob cannot collaborate to try and detect any eavesdropping activity. Instead, each party has to fend for himself.

Since tasks like secure identification are of practical interest, one is willing to make assumptions on how powerful the adversary can be. Security then holds as long as these assumptions are satisfied. In classical cryptography, i.e., without the use of quantum tools, most of these are computational assumptions. Such assumptions consists of two parts. First, one assumes that a particular problem is difficult to solve. For example, one might assume that it is hard to factor a large integer into its prime factors (e.g. 15=5x3). Second, one assumes that the adversary has a limited amount of computing power, namely less than what is (thought to be) required to solve the chosen problem.

Bounded storage

In information theoretic cryptography physical assumptions appear, which do not rely on any hardness assumptions, but merely assume a limit on some other resource. In classical cryptography, the bounded-storage model introduced by Ueli Maurer assumes that the adversary can only store a certain number of classical bits.^[6]^[7] Protocols are known that do (in principle) allow the secure implementation of any cryptographic task as long as the adversary's storage is small. Very intuitively, security becomes possible under this assumption since the adversary has to make a choice which information to keep. That is, the protocol effectively overflows his memory device leading to an inevitable lack on information for the adversary. It was later discovered that any classical protocol which requires the honest parties to store $n$ bits in order to execute it successfully can be broken by an adversary that can store more than about $O(n^{2})$ bits.^[8] That is, the gap between what is required to execute the protocol, and what is required to break the security is relatively small.

Bounded quantum storage

This gap changes dramatically when using quantum communication ^[9] . That is, Alice and Bob can send qubits to each other as part of the protocol. Likewise, one now assumes that the adversary's quantum storage is limited to a certain number of qubits. There is no restriction on how many classical bits the adversary can store. This is known as the bounded-quantum-storage model.^[9]^[10] It was shown that there exist quantum protocols in which the honest parties need no quantum storage at all to execute them, but are nevertheless secure as long as Alice transmits more than twice the number of qubits than the adversary can store.

Noisy storage

More generally, security is possible as long as the amount of information that the adversary can store in his memory device is limited. This intuition is captured by the noisy-storage model,^[1] which includes the bounded-quantum-storage model as a special case.^[11] Such a limitation can, for example, come about if the memory device is extremely large, but very imperfect. In information theory such an imperfect memory device is also called a noisy channel. The motivation for this more general model is threefold. First, it allows one to make statements about much more general memory devices that the adversary may have available. Second, security statements could be made when the signals transmitted, or the storage device itself, uses continuous variables whose dimension is infinite and thus cannot be captured by a bounded storage assumption without additional constraints. Third, even if the dimension of the signals itself is small, the noisy-storage analysis allows security beyond the regime where bounded-storage itself can make any security statement. For example, if the storage channel is entanglement breaking, security is possible even if the storage device is arbitrarily large (i.e., not bounded in any way).

Assumption

The assumption of the noisy-storage model is that during waiting times $\Delta t$ introduced into the protocol, the adversary can only store quantum information in his noisy memory device.^[11] Such a device is simply a quantum channel ${\mathcal {F}}:{\mathcal {S}}({\mathcal {H}}_{\rm {in}})\rightarrow {\mathcal {S}}({\mathcal {H}}_{\rm {out}})$ that takes input states $\rho _{\rm {in}}\in {\mathcal {S}}({\mathcal {H}}_{\rm {in}})$ to some noisy output states $\rho _{\rm {out}}\in {\mathcal {S}}({\mathcal {H}}_{\rm {out}})$ . Otherwise, the adversary is all powerful. For example, he can store an unlimited amount of classical information and perform any computation instantaneously.

During waiting times
D
t
{\displaystyle \Delta t}
the storage device has to be used. NoisyStorageModel.png — During waiting times $\Delta t$ the storage device has to be used.

The latter assumption also implies that he can perform any form of error correcting encoding before and after using the noisy memory device, even if it is computationally very difficult to do (i.e., it requires a long time). In this context, this is generally referred to as an encoding attack ${\mathcal {E}}$ and a decoding attack ${\mathcal {D}}$ . Since the adversary's classical memory can be arbitrarily large, the encoding ${\mathcal {E}}$ may not only generate some quantum state as input to the storage device ${\mathcal {F}}$ but also output classical information. The adversary's decoding attack ${\mathcal {D}}$ can make use of this extra classical information, as well as any additional information that the adversary may gain after the waiting time has passed.

In practise, one often considers storage devices that consist of $N$ memory cells, each of which is subject to noise. In information-theoretic terms, this means that the device has the form ${\mathcal {F}}={\mathcal {N}}^{\otimes N}$ , where ${\mathcal {N}}:S(\mathbb {C} ^{d})\rightarrow S(\mathbb {C} ^{d})$ is a noisy quantum channel acting on a memory cell of dimension $d$ .

Examples

The storage device consists of $N$ qubits, each of which is subject to depolarizing noise. That is, ${\mathcal {F}}={\mathcal {N}}^{\otimes N}$ , where ${\mathcal {N}}(\rho )=\lambda \rho +(1-\lambda ){\mathsf {id}}/2$ is the 2-dimensional depolarizing channel.
The storage device consists of $N$ qubits, which are noise-free. This corresponds to the special case of bounded-quantum-storage. That is, ${\mathcal {F}}={\mathsf {id}}^{\otimes N}$ , where ${\mathsf {id}}$ is the identity channel.

Protocols

Most protocols proceed in two steps. First, Alice and Bob exchange $n$ qubits encoded in two or three mutually unbiased bases. These are the same encodings which are used in the BB84 or six-state protocols of quantum key distribution. Typically, this takes the form of Alice sending such qubits to Bob, and Bob measuring them immediately on arrival. This has the advantage that Alice and Bob need no quantum storage to execute the protocol. It is furthermore experimentally relatively easy to create such qubits, making it possible to implement such protocols using currently available technology.^[12]

The second step is to perform classical post-processing of the measurement data obtained in step one. Techniques used depend on the protocol in question and include privacy amplification, error-correcting codes, min-entropy sampling, and interactive hashing.

General

To demonstrate that all two-party cryptographic tasks can be implemented securely, a common approach is to show that a simple cryptographic primitive can be implemented that is known to be universal for secure function evaluation. That is, once one manages to build a protocol for such a cryptographic primitive all other tasks can be implemented by using this primitive as a basic building block. One such primitive is oblivious transfer. In turn, oblivious transfer can be constructed from an even simpler building block known as weak string erasure in combination with cryptographic techniques such as privacy amplification.

All protocols proposed to date allow one of the parties (Alice) to have even an unlimited amount of noise-free quantum memory. I.e., the noisy-storage assumption is applied to only one of the parties (Bob). For storage devices of the form ${\mathcal {F}}={\mathcal {N}}^{\otimes N}$ it is known that any two-party cryptographic task can be implemented securely by means of weak string erasure and oblivious transfer whenever any of the following conditions hold.

For bounded-quantum-storage (i.e., ${\mathcal {N}}={\mathsf {id}}$ ), security can be achieved using a protocol in which Alice sends $n>2N$ BB84 encoded qubits.^[11] That is, security can be achieved when Alice sends more than twice the number of qubits than Bob can store. One can also look at this from Bob's perspective and say that security can be achieved when Bob can store strictly less than half of the qubits that Alice sent, i.e., $N<n/2$ .
For bounded-quantum-storage using higher-dimensional memory cells (i.e., each cell is not a qubit, but a qudit), security can be achieved in a protocol in which Alice sends $n$ higher-dimensional qudits encoded one of the possible mutually unbiased bases. In the limit of large dimensions, security can be achieved whenever $n\gtrapprox N$ . That is, security can always be achieved as long as Bob cannot store any constant fraction of the transmitted signals.^[13] This is optimal for the protocols considered since for $n=N$ a dishonest Bob can store all qudits sent by Alice. It is not known whether the same is possible using merely BB84 encoded qubits.

For noisy-storage and devices of the form ${\mathcal {F}}={\mathcal {N}}^{\otimes N}$ security can be achieved using a protocol in which Alice sends $n$ BB84 encoded qubits if

$n>2\cdot N\cdot C({\mathcal {N}})$ ,^[11] where $C({\mathcal {N}})$ is the classical capacity of the quantum channel ${\mathcal {N}}$ , and ${\mathcal {N}}$ obeys the so-called strong converse property,^[14] or, if

$n>2\cdot N\cdot E_{C}({\mathcal {N}})$ ,^[15] where $E_{C}({\mathcal {N}})$ is the entanglement cost of the quantum channel ${\mathcal {N}}$ . This is generally much better than the condition on the classical capacity, however it is harder to evaluate $E_{C}({\mathcal {N}})$ .

For noisy-storage and devices of the form ${\mathcal {F}}={\mathcal {N}}^{\otimes N}$ security can be achieved using a protocol in which Alice sends $n$ qubits encoded in one of the three mutually unbiased bases per qubit, if

$n>Q({\mathcal {N}})N$ ,^[16] where $Q$ is the quantum capacity of ${\mathcal {N}}$ , and the strong converse parameter of ${\mathcal {N}}$ is not too small.

The three mutually unbiased bases are the same encodings as in the six-state protocol of quantum key distribution. The last condition does form the best known condition for most channels, yet the quantum capacity as well as the strong converse parameter are generally not easy to determine.

Specific tasks

Using such basic primitives as building blocks is not always the most efficient way to solve a cryptographic task. Specialized protocols targeted to solve specific problems are generally more efficient. Examples of known protocols are

Bit commitment in the noisy-storage model,^[11]^[13] and in the case of bounded-quantum-storage^[10]
Oblivious transfer in the noisy-storage model,^[11] and in the case of bounded-quantum-storage^[9]^[10]
Secure identification in the bounded-quantum-storage model^[17]^[18]

Noisy-storage and QKD

The assumption of bounded-quantum-storage has also been applied outside the realm of secure function evaluation. In particular, it has been shown that if the eavesdropper in quantum key distribution is memory bounded, higher bit error rates can be tolerated in an experimental implementation.^[10]

Related Research Articles

A quantum computer is a computer that exploits quantum mechanical phenomena. On small scales, physical matter exhibits properties of both particles and waves, and quantum computing leverages this behavior using specialized hardware. Classical physics cannot explain the operation of these quantum devices, and a scalable quantum computer could perform some calculations exponentially faster than any modern "classical" computer. Theoretically a large-scale quantum computer could break some widely used encryption schemes and aid physicists in performing physical simulations; however, the current state of the art is largely experimental and impractical, with several obstacles to useful applications.

Quantum information is the information of the state of a quantum system. It is the basic entity of study in quantum information theory, and can be manipulated using quantum information processing techniques. Quantum information refers to both the technical definition in terms of Von Neumann entropy and the general computational term.

Quantum teleportation is a technique for transferring quantum information from a sender at one location to a receiver some distance away. While teleportation is commonly portrayed in science fiction as a means to transfer physical objects from one location to the next, quantum teleportation only transfers quantum information. The sender does not have to know the particular quantum state being transferred. Moreover, the location of the recipient can be unknown, but to complete the quantum teleportation, classical information needs to be sent from sender to receiver. Because classical information needs to be sent, quantum teleportation cannot occur faster than the speed of light.

Quantum key distribution (QKD) is a secure communication method that implements a cryptographic protocol involving components of quantum mechanics. It enables two parties to produce a shared random secret key known only to them, which then can be used to encrypt and decrypt messages. The process of quantum key distribution is not to be confused with quantum cryptography, as it is the best-known example of a quantum-cryptographic task.

In physics, the CHSH inequality can be used in the proof of Bell's theorem, which states that certain consequences of entanglement in quantum mechanics cannot be reproduced by local hidden-variable theories. Experimental verification of the inequality being violated is seen as confirmation that nature cannot be described by such theories. CHSH stands for John Clauser, Michael Horne, Abner Shimony, and Richard Holt, who described it in a much-cited paper published in 1969. They derived the CHSH inequality, which, as with John Stewart Bell's original inequality, is a constraint—on the statistical occurrence of "coincidences" in a Bell test—which is necessarily true if an underlying local hidden-variable theory exists. In practice, the inequality is routinely violated by modern experiments in quantum mechanics.

A cryptosystem is considered to have information-theoretic security if the system is secure against adversaries with unlimited computing resources and time. In contrast, a system which depends on the computational cost of cryptanalysis to be secure is called computationally secure or conditionally secure.

Quantum error correction (QEC) is a set of techniques used in quantum computing to protect quantum information from errors due to decoherence and other quantum noise. Quantum error correction is theorised as essential to achieve fault tolerant quantum computing that can reduce the effects of noise on stored quantum information, faulty quantum gates, faulty quantum state preparation, and faulty measurements. Effective quantum error correction would allow quantum computers with low qubit fidelity to execute algorithms of higher complexity or greater circuit depth.

Quantum networks form an important element of quantum computing and quantum communication systems. Quantum networks facilitate the transmission of information in the form of quantum bits, also called qubits, between physically separated quantum processors. A quantum processor is a machine able to perform quantum circuits on a certain number of qubits. Quantum networks work in a similar way to classical networks. The main difference is that quantum networking, like quantum computing, is better at solving certain problems, such as modeling quantum systems.

BB84 is a quantum key distribution scheme developed by Charles Bennett and Gilles Brassard in 1984. It is the first quantum cryptography protocol. The protocol is provably secure assuming a perfect implementation, relying on two conditions: (1) the quantum property that information gain is only possible at the expense of disturbing the signal if the two states one is trying to distinguish are not orthogonal ; and (2) the existence of an authenticated public classical channel. It is usually explained as a method of securely communicating a private key from one party to another for use in one-time pad encryption. The proof of BB84 depends on a perfect implementation. Side channel attacks exist, taking advantage of non-quantum sources of information. Since this information is non-quantum, it can be intercepted without measuring or cloning quantum particles.

In theoretical physics, quantum nonlocality refers to the phenomenon by which the measurement statistics of a multipartite quantum system do not allow an interpretation with local realism. Quantum nonlocality has been experimentally verified under a variety of physical assumptions.

SARG04 is a 2004 quantum cryptography protocol derived from the first protocol of that kind, BB84.

Entanglement distillation is the transformation of N copies of an arbitrary entangled state $into some number of approximately pure Bell pairs, using only local operations and classical communication. Entanglement distillation can overcome the degenerative influence of noisy quantum channels by transforming previously shared, less-entangled pairs into a smaller number of maximally-entangled pairs.$

Quantum block codes are useful in quantum computing and in quantum communications. The encoding circuit for a large block code typically has a high complexity although those for modern codes do have lower complexity.

Quantum cryptography is the science of exploiting quantum mechanical properties to perform cryptographic tasks. The best known example of quantum cryptography is quantum key distribution, which offers an information-theoretically secure solution to the key exchange problem. The advantage of quantum cryptography lies in the fact that it allows the completion of various cryptographic tasks that are proven or conjectured to be impossible using only classical communication. For example, it is impossible to copy data encoded in a quantum state. If one attempts to read the encoded data, the quantum state will be changed due to wave function collapse. This could be used to detect eavesdropping in quantum key distribution (QKD).

A quantum cryptographic protocol is device-independent if its security does not rely on trusting that the quantum devices used are truthful. Thus the security analysis of such a protocol needs to consider scenarios of imperfect or even malicious devices. Several important problems have been shown to admit unconditional secure and device-independent protocols. A closely related topic is measurement-device independent quantum key distribution.

The six-state protocol (SSP) is the quantum cryptography protocol that is the version of BB84 that uses a six-state polarization scheme on three orthogonal bases.

Consider two remote players, connected by a channel, that don't trust each other. The problem of them agreeing on a random bit by exchanging messages over this channel, without relying on any trusted third party, is called the coin flipping problem in cryptography. Quantum coin flipping uses the principles of quantum mechanics to encrypt messages for secure communication. It is a cryptographic primitive which can be used to construct more complex and useful cryptographic protocols, e.g. Quantum Byzantine agreement.

Relativistic quantum cryptography is a sub-field of quantum cryptography, in which in addition to exploiting the principles of quantum physics, the no-superluminal signalling principle of relativity theory stating that information cannot travel faster than light is exploited too. Technically speaking, relativistic quantum cryptography is a sub-field of relativistic cryptography, in which cryptographic protocols exploit the no-superluminal signalling principle, independently of whether quantum properties are used or not. However, in practice, the term relativistic quantum cryptography is used for relativistic cryptography too.

The Hidden Matching Problem is a computation complexity problem that can be solved using quantum protocols: Let $be a positive even integer. In the Hidden Matching Problem, Alice is given and Bob is given (denotes the family of all possible perfect matchings on nodes). Their goal is to output a tuple such that the edge belongs to the matching and .$

This glossary of quantum computing is a list of definitions of terms and concepts used in quantum computing, its sub-disciplines, and related fields.

References

1 2 Wehner, S.; C. Schaffner; B. Terhal (2008). "Cryptography from noisy-storage". Physical Review Letters. 100 (22): 220502. arXiv: 0711.2895 . Bibcode:2008PhRvL.100v0502W. doi:10.1103/PhysRevLett.100.220502. PMID 18643410. S2CID 2974264.
↑ Lo, H.; H. Chau (1997). "Is quantum bit commitment really possible?". Physical Review Letters. 78 (17): 3410. arXiv: quant-ph/9603004 . Bibcode:1997PhRvL..78.3410L. doi:10.1103/PhysRevLett.78.3410. S2CID 3264257.
↑ Lo, H (1997). "Insecurity of Quantum Secure Computations". Physical Review A. 56 (2): 1154–1162. arXiv: quant-ph/9611031 . Bibcode:1997PhRvA..56.1154L. doi:10.1103/PhysRevA.56.1154. S2CID 17813922.
↑ Mayers, D. (1997). "Unconditionally Secure Quantum Bit Commitment is Impossible". Physical Review Letters. 78 (17): 3414––3417. arXiv: quant-ph/9605044 . Bibcode:1997PhRvL..78.3414M. doi:10.1103/PhysRevLett.78.3414. S2CID 14522232.
↑ D'Ariano, G.; D. Kretschmann; D. Schlingemann; R.F. Werner (2007). "Quantum Bit Commitment Revisited: the Possible and the Impossible". Physical Review A. 76 (3): 032328. arXiv: quant-ph/0605224 . Bibcode:2007PhRvA..76c2328D. doi:10.1103/PhysRevA.76.032328. S2CID 119340261.
↑ Maurer, U. (1992). "Conditionally-Perfect Secrecy and a Provably-Secure Randomized Cipher". Journal of Cryptology. 5 (1): 53––66. doi: 10.1007/bf00191321 . S2CID 12079602.
↑ Cachin, C.; U. Maurer (1997). "Unconditional Security Against Memory-Bounded Adversaries". Proceedings of CRYPTO 1997: 292–306.
↑ Dziembowski, S.; U. Maurer (2004). "On Generating the Initial Key in the Bounded-Storage Model". Proceedings of EUROCRYPT: 126–137.
1 2 3 I., Damgaard; S. Fehr; L. Salvail; C. Schaffner (2005). "Cryptography in the Bounded Quantum-Storage Model". 46th Annual IEEE Symposium on Foundations of Computer Science (FOCS'05). pp. 449–458. arXiv: quant-ph/0508222 . Bibcode:2005quant.ph..8222D. doi:10.1109/SFCS.2005.30. ISBN 978-0-7695-2468-9. S2CID 174322.
1 2 3 4 Damgaard, I.; S. Fehr; R. Renner; L. Salvail; C. Schaffner (2007). "A Tight High-Order Entropic Quantum Uncertainty Relation with Applications". Advances in Cryptology - CRYPTO 2007. Lecture Notes in Computer Science. Vol. 4622. pp. 360––378. arXiv: quant-ph/0612014 . Bibcode:2006quant.ph.12014D. doi:10.1007/978-3-540-74143-5_20. ISBN 978-3-540-74142-8. S2CID 2557603.
1 2 3 4 5 6 Koenig, Robert; S. Wehner; J. Wullschleger (2009). "Unconditional security from noisy quantum storage". IEEE Transactions on Information Theory. 58 (3): 1962–1984. arXiv: 0906.1030 . Bibcode:2009arXiv0906.1030K. doi:10.1109/TIT.2011.2177772. S2CID 12500084.
↑ Wehner, S.; M. Curty; C. Schaffner; H. Lo (2010). "Implementation of two-party protocols in the noisy-storage model". Physical Review A. 81 (5): 052336. arXiv: 0911.2302 . Bibcode:2010PhRvA..81e2336W. doi:10.1103/PhysRevA.81.052336. S2CID 6187112.
1 2 Mandayam, P.; S. Wehner (2011). "Achieving the physical limits of the bounded-storage model". Physical Review A. 83 (2): 022329. arXiv: 1009.1596 . Bibcode:2011PhRvA..83b2329M. doi:10.1103/PhysRevA.83.022329. S2CID 11753298.
↑ Koenig, R.; S. Wehner (2009). "A Strong Converse for Classical Channel Coding Using Entangled Inputs". Physical Review Letters. 103 (7): 070504. arXiv: 0903.2838 . Bibcode:2009PhRvL.103g0504K. doi:10.1103/PhysRevLett.103.070504. PMID 19792627. S2CID 25002853.
↑ Berta, M.; F. Brandao; M. Christandl; S. Wehner (2013). "Entanglement cost of quantum channels". IEEE Transactions on Information Theory. 59 (10): 6779–6795. arXiv: 1108.5357 . Bibcode:2011arXiv1108.5357B. doi:10.1109/TIT.2013.2268533. S2CID 322613.
↑ Berta, M.; O. Fawzi; S. Wehner (2014). "Quantum to classical randomness extractors". IEEE Transactions on Information Theory. 60 (2): 1168–1192. arXiv: 1111.2026 . Bibcode:2011arXiv1111.2026B. doi:10.1109/TIT.2013.2291780. S2CID 10018325.
↑ Damgaard, I.; S. Fehr; L. Salvail; C. Schaffner (2007). "Secure Identification and QKD in the Bounded-Quantum-Storage Model". Advances in Cryptology - CRYPTO 2007. Lecture Notes in Computer Science. Vol. 4622. pp. 342––359. arXiv: 0708.2557 . Bibcode:2007arXiv0708.2557D. doi:10.1007/978-3-540-74143-5_19. ISBN 978-3-540-74142-8. S2CID 97510.
↑ Bouman, N.; S. Fehr; C. Gonzales-Guillen; C. Schaffner (2011). "An All-But-One Entropic Uncertainty Relations, and Application to Password-based Identification". arXiv: 1105.6212 . Bibcode:2011arXiv1105.6212B.{{cite journal}}: Cite journal requires |journal= (help)

This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.

[initial-1] 1 2 Wehner, S.; C. Schaffner; B. Terhal (2008). "Cryptography from noisy-storage". Physical Review Letters. 100 (22): 220502. arXiv: 0711.2895 . Bibcode:2008PhRvL.100v0502W. doi:10.1103/PhysRevLett.100.220502. PMID 18643410. S2CID 2974264.

[bitcom1-2] Lo, H.; H. Chau (1997). "Is quantum bit commitment really possible?". Physical Review Letters. 78 (17): 3410. arXiv: quant-ph/9603004 . Bibcode:1997PhRvL..78.3410L. doi:10.1103/PhysRevLett.78.3410. S2CID 3264257.

[lo2-3] Lo, H (1997). "Insecurity of Quantum Secure Computations". Physical Review A. 56 (2): 1154–1162. arXiv: quant-ph/9611031 . Bibcode:1997PhRvA..56.1154L. doi:10.1103/PhysRevA.56.1154. S2CID 17813922.

[mayers2-4] Mayers, D. (1997). "Unconditionally Secure Quantum Bit Commitment is Impossible". Physical Review Letters. 78 (17): 3414––3417. arXiv: quant-ph/9605044 . Bibcode:1997PhRvL..78.3414M. doi:10.1103/PhysRevLett.78.3414. S2CID 14522232.

[qbc-5] D'Ariano, G.; D. Kretschmann; D. Schlingemann; R.F. Werner (2007). "Quantum Bit Commitment Revisited: the Possible and the Impossible". Physical Review A. 76 (3): 032328. arXiv: quant-ph/0605224 . Bibcode:2007PhRvA..76c2328D. doi:10.1103/PhysRevA.76.032328. S2CID 119340261.

[maurer92-6] Maurer, U. (1992). "Conditionally-Perfect Secrecy and a Provably-Secure Randomized Cipher". Journal of Cryptology. 5 (1): 53––66. doi: 10.1007/bf00191321 . S2CID 12079602.

[maurer97-7] Cachin, C.; U. Maurer (1997). "Unconditional Security Against Memory-Bounded Adversaries". Proceedings of CRYPTO 1997: 292–306.

[maurerimposs-8] Dziembowski, S.; U. Maurer (2004). "On Generating the Initial Key in the Bounded-Storage Model". Proceedings of EUROCRYPT: 126–137.

[bounded-9] 1 2 3 I., Damgaard; S. Fehr; L. Salvail; C. Schaffner (2005). "Cryptography in the Bounded Quantum-Storage Model". 46th Annual IEEE Symposium on Foundations of Computer Science (FOCS'05). pp. 449–458. arXiv: quant-ph/0508222 . Bibcode:2005quant.ph..8222D. doi:10.1109/SFCS.2005.30. ISBN 978-0-7695-2468-9. S2CID 174322.

[damgardHighOrder-10] 1 2 3 4 Damgaard, I.; S. Fehr; R. Renner; L. Salvail; C. Schaffner (2007). "A Tight High-Order Entropic Quantum Uncertainty Relation with Applications". Advances in Cryptology - CRYPTO 2007. Lecture Notes in Computer Science. Vol. 4622. pp. 360––378. arXiv: quant-ph/0612014 . Bibcode:2006quant.ph.12014D. doi:10.1007/978-3-540-74143-5_20. ISBN 978-3-540-74142-8. S2CID 2557603.

[unconditional-11] 1 2 3 4 5 6 Koenig, Robert; S. Wehner; J. Wullschleger (2009). "Unconditional security from noisy quantum storage". IEEE Transactions on Information Theory. 58 (3): 1962–1984. arXiv: 0906.1030 . Bibcode:2009arXiv0906.1030K. doi:10.1109/TIT.2011.2177772. S2CID 12500084.

[curty-12] Wehner, S.; M. Curty; C. Schaffner; H. Lo (2010). "Implementation of two-party protocols in the noisy-storage model". Physical Review A. 81 (5): 052336. arXiv: 0911.2302 . Bibcode:2010PhRvA..81e2336W. doi:10.1103/PhysRevA.81.052336. S2CID 6187112.

[limits-13] 1 2 Mandayam, P.; S. Wehner (2011). "Achieving the physical limits of the bounded-storage model". Physical Review A. 83 (2): 022329. arXiv: 1009.1596 . Bibcode:2011PhRvA..83b2329M. doi:10.1103/PhysRevA.83.022329. S2CID 11753298.

[converse-14] Koenig, R.; S. Wehner (2009). "A Strong Converse for Classical Channel Coding Using Entangled Inputs". Physical Review Letters. 103 (7): 070504. arXiv: 0903.2838 . Bibcode:2009PhRvL.103g0504K. doi:10.1103/PhysRevLett.103.070504. PMID 19792627. S2CID 25002853.

[entanglementcost-15] Berta, M.; F. Brandao; M. Christandl; S. Wehner (2013). "Entanglement cost of quantum channels". IEEE Transactions on Information Theory. 59 (10): 6779–6795. arXiv: 1108.5357 . Bibcode:2011arXiv1108.5357B. doi:10.1109/TIT.2013.2268533. S2CID 322613.

[qcap-16] Berta, M.; O. Fawzi; S. Wehner (2014). "Quantum to classical randomness extractors". IEEE Transactions on Information Theory. 60 (2): 1168–1192. arXiv: 1111.2026 . Bibcode:2011arXiv1111.2026B. doi:10.1109/TIT.2013.2291780. S2CID 10018325.

[secureid-17] Damgaard, I.; S. Fehr; L. Salvail; C. Schaffner (2007). "Secure Identification and QKD in the Bounded-Quantum-Storage Model". Advances in Cryptology - CRYPTO 2007. Lecture Notes in Computer Science. Vol. 4622. pp. 342––359. arXiv: 0708.2557 . Bibcode:2007arXiv0708.2557D. doi:10.1007/978-3-540-74143-5_19. ISBN 978-3-540-74142-8. S2CID 97510.

[id2-18] Bouman, N.; S. Fehr; C. Gonzales-Guillen; C. Schaffner (2011). "An All-But-One Entropic Uncertainty Relations, and Application to Password-based Identification". arXiv: 1105.6212 . Bibcode:2011arXiv1105.6212B.{{cite journal}}: Cite journal requires |journal= (help)

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

[16]

[17]

[18]