quant-ph/9711025
Unconditionally DAMTP/97-124 Secure All-Or-Nothing Disclosure of Secrets
Adrian Kent Department of Applied Mathematics and Theoretical Physics, University of Cambridge,
quant-ph/9711025 v2 20 Nov 1997
Silver Street, Cambridge CB3 9EW, U.K. Abstract Alice has n secrets which she regards as equally valuable. She is willing to sell any of them to Bob, but wants to ensure that if he pays for only one secret he cannot obtain any information about the others. Bob would like to buy one of the secrets from Alice, but wants to ensure that Alice can obtain no information about which of her secrets he has obtained. The aim of an all-or-nothing disclosure of secrets cryptographic protocol is to allow Alice and Bob to satisfy these supercially irreconcilable wishes. We show that such a protocol can be carried out securely by using quantum information. The protocol can be modied to implement oblivious transfers in which Bob receives a secret randomly chosen from the n. PACS numbers: 03.65.Bz, 42.50.Dv, 89.70.+c
Electronic address: [e-mail]
1. Introduction Carrying out cryptographic tasks using quantum states has the advantage that an attempt to extract information generally irreversibly disturbs a quantum state. Secure protocols for quantum key distribution[1,2] have been known for some time, and secure protocols for quantum bit commitment[3] and multi-party quantum computation[4] are also known. To illustrate another interesting cryptographic task, consider the following situation. Alice has n secrets which she regards as equally valuable: let us say that they are wellresearched predictions of the outlooks for various company stocks. She is willing to sell any of them to Bob, but wants to ensure that if he pays for only one secret he cannot obtain any information about the others. Bob would like to buy one of the secrets from Alice, but wants to ensure that Alice can obtain no information about which of her secrets he has obtained: he is interested in purchasing one of the stocks, and does not want it known which one. What cryptographers refer to as an unconditionally secure all-or-nothing disclosure of secrets protocol[5] allows Alice and Bob to satisfy these apparently irreconcilable wishes. Alice can be sure, with probability arbitrarily close to one, that Bob has obtained arbitrarily little information about any of the secrets other than the one he chose. Bob can be sure, with probability arbitrarily close to one, that Alice has obtained arbitrarily little information as to which secret he has obtained. We show that here that an unconditionally secure all-or-nothing disclosure of secrets protocol can be implemented by the exchange of quantum information. 2. All-or-nothing disclosure of secrets protocol To avoid any possibility of Alice misrepresenting the signicance of her secrets to Bob, let us suppose that they take the form of answers to well-dened questions: What will be the closing price of ABC Corp stock on Friday?, Who were the eight largest donors to the Cimmerian New Democracy Party last year?, What are the factors of (some xed large number) M ?, and so forth. The protocol works by exchange of qubits, for which Alice and Bob x a standard basis |0 , |1 . Bob chooses a positive integer r, and Alice a large positive integer N. Alice rst translates all of her secrets into binary numbers, using some agreed cipher (such as ASCII). She works out which is the longest, and makes all the others the same length, by using some agreed stop code and then adding zeroes.
They then carry out a sub-protocol, which will be repeated N times. Alice creates a string of qubits for each secret, redundantly coding each binary 0 and 1 into a sub-string of r qubits, all in state |0 or all in state |1 . She then encodes every qubit in each of the n secret strings, by applying independent random rotations chosen from the list I, U, U 2 , U 3 , where U=
1 2 1 2 1 2 1 2
.
(1)
She bit commits these rotations to Bob, using a secure quantum bit commitment protocol.[3] She repeats these operations a total of n times. She then sends Bob a block of the n2 encoded strings, in sub-blocks of n, labelled in sequence so that he knows which is string supposed to correspond to which secret. Bob randomly chooses some permutation of {1, . . . , n}. He carries out von Neumann measurements in the |0 , |1 basis on every qubit in the (i)-th string from the i-th subblock, for each i from 1 to n. He then applies independent random unitary operations, chosen from the list I, J, R, J R, where J= 1 0 0 1 , R= 0 1 1 0 , (2)
to every one of the measurement qubits, and to every qubit in each of the other strings. He bit commits to Alice the details of these operations: which strings he measured, what the results were, and which operations he applied to each qubit in each string. He then returns all the strings of qubits to Alice, again labelled in sequence. Alice and Bob repeat this part of the protocol N times, making independent random choices each time. Alice then chooses any N 1 of the blocks and asks Bob to unveil his bit commitments for these. She checks that all of the qubits returned to her from these blocks are in states consistent with Bobs claims, and that the measurement statistics Bob claims are consistent with the states she supplied. If Bobs claims fail these tests, she abandons the protocol, having given nothing away. If Bobs claims pass the tests, she accepts that Bob has been following the protocol faithfully, and in particular that he is carrying out measurements on precisely one string from each block or at least that his deviations from the protocol are so slight as to give him negligible illicit information. Her choice of N was such as to give her adequate statistical condence in these beliefs. If Alice is convinced that Bob is following the protocol, she then allows him to choose any one sub-block from the last remaining block. For that sub-block, she unveils all of
her bit committed rotations to Bob. If Bob wants to know the i-th secret, he chooses the 1 (i)-th sub-block. He then reads o the secret from his measurement results, being able to distinguish a 0 from a 1 very accurately, despite the fact that half of the qubits are rotated into states orthogonal to his measurement basis, because of the r-fold redundancy of the coding. Alice is unable to tell which secret Bob has obtained, since he does not reveal his random unitary operations on this last block. Whatever states she actually supplied to Bob even if she deviated from the protocol by sending entangled states the qubits returned to her give her no information. 3. Comments The protocol can easily be modied to implement the related cryptographic ...