Solitude verification is arguably one of the simplest fundamental problems in distributed computing, where the goal is to verify that there is a unique contender in a network. This paper devises a quantum algorithm that exactly solves the problem on an anonymous network, which is known as a network model with minimal assumptions [Angluin, STOC'80]. The algorithm runs in @math rounds if every party initially has the common knowledge of an upper bound @math on the number of parties. This implies that all solvable problems can be solved in @math rounds on average without error (i.e., with zero-sided error) on the network. As a generalization, a quantum algorithm that works in @math rounds is obtained for the problem of exactly computing any symmetric Boolean function, over @math distributed input bits, which is constant over all the @math bits whose sum is larger than @math for @math . All these algorithms work with the bit complexities bounded by a polynomial in @math .
Pal, Singh, and Kumar @cite_19 and D'Hondt and Panangaden @cite_6 dealt with @math and the GHZ-state sharing problem in a different setting, where pre-shared entanglement is assumed but only classical communication is allowed. The relation between several network models that differ in available quantum resources has been discussed by Gavoille, Kosowski, and Markiewicz @cite_17 . Recently, @cite_13 proved that quantum communication cannot substantially speed up algorithms for some fundamental problems, such as the minimum spanning tree, compared to the classical setting. For fault-tolerant distributed quantum computing, the Byzantine agreement problem and the consensus problem were studied by Ben-Or and Hassidim @cite_28 and Chlebus, Kowalski, and Strojnowski @cite_8 , respectively. In the cryptographic context where there are cheating parties, Refs. @cite_21 @cite_15 devises quantum algorithms that elect a unique leader with a small bias. Some quantum distributed protocols were experimentally demonstrated by @cite_30 and @cite_3 .
@cite_30 @cite_8 @cite_28 @cite_21 @cite_6 @cite_3 @cite_19 @cite_15 @cite_13 @cite_17
1678454200 2157846543 1610449014 2953122989 2165923712 1518891070 1914859158 2128966718 2949754091 2611161794 2951572832 2078180782 2079729767 2163684974 2058750992 1864664928 2102879646 1985859985 2121957834 2205230658
It is well understood that the use of quantum entanglement significantly enhances the computational power of systems. Much of the attention has focused on Bell states and their multipartite generalizations. However, in the multipartite case it is known that there are several inequivalent classes of states, such as those represented by the W-state and the GHZ-state. Our main contribution is a demonstration of the special computational power of these states in the context of paradigmatic problems from classical distributed computing. Concretely, we show that the W-state is the only pure state that can be used to exactly solve the problem of leader election in anonymous quantum networks. Similarly we show that the GHZ-state is the only one that can be used to solve the problem of distributed consensus when no classical post-processing is considered. These results generalize to a family of W- and GHZ-like states. At the heart of the proofs of these impossibility results lie symmetry arguments. We study the problem of k-pair communication (or multiple unicast problem) of quantum information in networks of quantum channels. We consider the asymptotic rates of high fidelity quantum communication between specific sender-receiver pairs. Four scenarios of classical communication assistance (none, forward, backward, and two-way) are considered. (I) We obtain outer and inner bounds of the achievable rate regions in the most general directed networks. (II) For two particular networks (including the butterfly network), routing is proved optimal, and the free assisting classical communication can at best be used to modify the directions of quantum channels in the network. Consequently, the achievable rate regions are given by counting edge avoiding paths, and precise achievable rate regions in all four assisting scenarios can be obtained. (III) Optimality of routing can also be proved in classes of networks. The first class consists of directed unassisted networks in which (1) the receivers are information sinks, (2) the maximum distance from senders to receivers is small, and (3) a certain type of 4-cycles are absent, but without further constraints (such as on the number of communicating and intermediate parties). The second class consists of arbitrary backward-assisted networks with two sender-receiver pairs. (IV) Beyond the k-pair communication problem, observations are made on quantum multicasting and a static version of network communication related to the entanglement of assistance. In this paper we show that sufficient multi-partite quantum entanglement helps in fair and unbiased election of a leader in a distributed network of processors with only linear classical communication complexity. We show that a total of @math distinct multi-partite maximally entanglement sets (ebits) are capable of supporting such a protocol in the presence of nodes that may lie and thus be biased. Here, @math is the number of nodes in the network. We also demonstrate the difficulty of performing unbiased and fair election of a leader with linear classical communication complexity in the absence of quantum entanglement even if all nodes have perfect random bit generators. We show that the presence of a sufficient number @math of biased agents leads to a non-zero limiting probability of biased election of the leader, whereas, the presence of a smaller number @math of biased agents matters little. We define two new related complexity classes motivated by the our leader election problem and discuss a few open questions. We study shared randomness in the context of multi-party number-in-hand communication protocols in the simultaneous message passing model. We show that with three or more players, shared randomness exhibits new interesting properties that have no direct analogues in the two-party case. First, we demonstrate a hierarchy of modes of shared randomness, with the usual shared randomness where all parties access the same random string as the strongest form in the hierarchy. We show exponential separations between its levels, and some of our bounds may be of independent interest. For example, we show that the equality function can be solved by a protocol of constant length using the weakest form of shared randomness, which we call "XOR-shared randomness." Second, we show that quantum communication cannot replace shared randomness in the k-party case, where k >= 3 is any constant. We demonstrate a promise function GP_k that can be computed by a classical protocol of constant length when (the strongest form of) shared randomness is available, but any quantum protocol without shared randomness must send n^Omega(1) qubits to compute it. Moreover, the quantum complexity of GP_k remains n^Omega(1) even if the "second strongest" mode of shared randomness is available. While a somewhat similar separation was already known in the two-party case, in the multi-party case our statement is qualitatively stronger: * In the two-party case, only a relational communication problem with similar properties is known. * In the two-party case, the gap between the two complexities of a problem can be at most exponential, as it is known that 2^(O(c)) log n qubits can always replace shared randomness in any c-bit protocol. Our bounds imply that with quantum communication alone, in general, it is not possible to simulate efficiently even a three-bit three-party classical protocol that uses shared randomness. Shor and Preskill (see Phys. Rev. Lett., vol.85, p.441, 2000) have provided a simple proof of security of the standard quantum key distribution scheme by Bennett and Brassard (1984) by demonstrating a connection between key distribution and entanglement purification protocols (EPPs) with one-way communications. Here, we provide proofs of security of standard quantum key distribution schemes, Bennett and Brassard and the six-state scheme, against the most general attack, by using the techniques of two-way entanglement purification. We demonstrate clearly the advantage of classical post-processing with two-way classical communications over classical post-processing with only one-way classical communications in quantum key distribution (QKD). This is done by the explicit construction of a new protocol for (the error correction detection and privacy amplification of) Bennett and Brassard that can tolerate a bit error rate of up to 18.9 , which is higher than what any Bennett and Brassard scheme with only one-way classical communications can possibly tolerate. Moreover, we demonstrate the advantage of the six-state scheme over Bennett and Brassard by showing that the six-state scheme can strictly tolerate a higher bit error rate than Bennett and Brassard. In particular, our six-state protocol can tolerate a bit error rate of 26.4 , which is higher than the upper bound of 25 bit error rate for any secure Bennett and Brassard protocol. Consequently, our protocols may allow higher key generation rate and remain secure over longer distances than previous protocols. Our investigation suggests that two-way entanglement purification is a useful tool in the study of advantage distillation, error correction, and privacy amplification protocols. After carrying out a protocol for quantum key agreement over a noisy quantum channel, the parties Alice and Bob must process the raw key in order to end up with identical keys about which the adversary has virtually no information. In principle, both classical and quantum protocols can be used for this processing. It is a natural question which type of protocols is more powerful. We show that the limits of tolerable noise are identical for classical and quantum protocols in many cases. More specifically, we prove that a quantum state between two parties is entangled if and only if the classical random variables resulting from optimal measurements provide some mutual classical information between the parties. In addition, we present evidence which strongly suggests that the potentials of classical and of quantum protocols are equal in every situation. An important consequence, in the purely classical regime, of such a correspondence would be the existence of a classical counterpart of so-called bound entanglement, namely "bound information" that cannot be used for generating a secret key by any protocol. This stands in sharp contrast to what was previously believed. We study a model of communication complexity that encompasses many well-studied problems, including classical and quantum communication complexity, the complexity of simulating distributions arising from bipartite measurements of shared quantum states, and XOR games. In this model, Alice gets an input x, Bob gets an input y, and their goal is to each produce an output a, b distributed according to some pre-specified joint distribution p(a, b|x, y). Our results apply to any non-signaling distribution, that is, those where Alice's marginal distribution does not depend on Bob's input, and vice versa. By taking a geometric view of the non-signaling distributions, we introduce a simple new technique based on affine combinations of lower-complexity distributions, and we give the first general technique to apply to all these settings, with elementary proofs and very intuitive interpretations. Specifically, we introduce two complexity measures, one which gives lower bounds on classical communication, and one for quantum communication. These measures can be expressed as convex optimization problems. We show that the dual formulations have a striking interpretation, since they coincide with maximum violations of Bell and Tsirelson inequalities. The dual expressions are closely related to the winning probability of XOR games. Despite their apparent simplicity, these lower bounds subsume many known communication complexity lower bound methods, most notably the recent lower bounds of Linial and Shraibman for the special case of Boolean functions. We show that as in the case of Boolean functions, the gap between the quantum and classical lower bounds is at most linear in the size of the support of the distribution, and does not depend on the size of the inputs. This translates into a bound on the gap between maximal Bell and Tsirelson inequality violations, which was previously known only for the case of distributions with Boolean outcomes and uniform marginals. It also allows us to show that for some distributions, information theoretic methods are necessary to prove strong lower bounds. Finally, we give an exponential upper bound on quantum and classical communication complexity in the simultaneous messages model, for any non-signaling distribution. One consequence of this is a simple proof that any quantum distribution can be approximated with a constant number of bits of communication. Recent advances in theoretical and experimental quantum computing bring us closer to scalable quantum computing devices. This makes the need for protocols that verify the correct functionality of quantum operations timely and has led to the field of quantum verification. In this paper we address key challenges to make quantum verification protocols applicable to experimental implementations. We prove the robustness of the single server verifiable universal blind quantum computing protocol of Fitzsimons and Kashefi (2012 arXiv:1203.5217) in the most general scenario. This includes the case where the purification of the deviated input state is in the hands of an adversarial server. The proved robustness property allows the composition of this protocol with a device-independent state tomography protocol that we give, which is based on the rigidity of CHSH games as proposed by (2013 Nature 496 456–60). The resulting composite protocol has lower round complexity for the verification of entangled quantum servers with a classical verifier and, as we show, can be made fault tolerant. We consider the scenario where Alice wants to send a secret (classical) @math -bit message to Bob using a classical key, and where only one-way transmission from Alice to Bob is possible. In this case, quantum communication cannot help to obtain perfect secrecy with key length smaller then @math . We study the question of whether there might still be fundamental differences between the case where quantum as opposed to classical communication is used. In this direction, we show that there exist ciphers with perfect security producing quantum ciphertext where, even if an adversary knows the plaintext and applies an optimal measurement on the ciphertext, his Shannon uncertainty about the key used is almost maximal. This is in contrast to the classical case where the adversary always learns @math bits of information on the key in a known plaintext attack. We also show that there is a limit to how different the classical and quantum cases can be: the most probable key, given matching plain- and ciphertexts, has the same probability in both the quantum and the classical cases. We suggest an application of our results in the case where only a short secret key is available and the message is much longer. Although a quantum state requires exponentially many classical bits to describe, the laws of quantum mechanics impose severe restrictions on how that state can be accessed. This paper shows in three settings that quantum messages have only limited advantages over classical ones. First, we show that BQP qpoly is contained in PP poly, where BQP qpoly is the class of problems solvable in quantum polynomial time, given a polynomial-size "quantum advice state" that depends only on the input length. This resolves a question of Buhrman, and means that we should not hope for an unrelativized separation between quantum and classical advice. Underlying our complexity result is a general new relation between deterministic and quantum one-way communication complexities, which applies to partial as well as total functions. Second, we construct an oracle relative to which NP is not contained in BQP qpoly. To do so, we use the polynomial method to give the first correct proof of a direct product theorem for quantum search. This theorem has other applications; for example, it can be used to fix a flawed result of Klauck about quantum time-space tradeoffs for sorting. Third, we introduce a new trace distance method for proving lower bounds on quantum one-way communication complexity. Using this method, we obtain optimal quantum lower bounds for two problems of Ambainis, for which no nontrivial lower bounds were previously known even for classical randomized protocols. Due to Shor's algorithm, quantum computers are a severe threat for public key cryptography. This motivated the cryptographic community to search for quantum-safe solutions. On the other hand, the impact of quantum computing on secret key cryptography is much less understood. In this paper, we consider attacks where an adversary can query an oracle implementing a cryptographic primitive in a quantum superposition of different states. This model gives a lot of power to the adversary, but recent results show that it is nonetheless possible to build secure cryptosystems in it. We study applications of a quantum procedure called Simon's algorithm (the simplest quantum period finding algorithm) in order to attack symmetric cryptosystems in this model. Following previous works in this direction, we show that several classical attacks based on finding collisions can be dramatically sped up using Simon's algorithm: finding a collision requires @math queries in the classical setting, but when collisions happen with some hidden periodicity, they can be found with only @math queries in the quantum model. We obtain attacks with very strong implications. First, we show that the most widely used modes of operation for authentication and authenticated encryption e.g. CBC-MAC, PMAC, GMAC, GCM, and OCB) are completely broken in this security model. Our attacks are also applicable to many CAESAR candidates: CLOC, AEZ, COPA, OTR, POET, OMD, and Minalpher. This is quite surprising compared to the situation with encryption modes: show that standard modes are secure with a quantum-secure PRF. Second, we show that Simon's algorithm can also be applied to slide attacks, leading to an exponential speed-up of a classical symmetric cryptanalysis technique in the quantum model. Future quantum information networks will likely consist of quantum and classical agents, who have the ability to communicate in a variety of ways with trusted and untrusted parties and securely delegate computational tasks to untrusted large-scale quantum computing servers. Multipartite quantum entanglement is a fundamental resource for such a network and hence it is imperative to study the possibility of verifying a multipartite entanglement source in a way that is efficient and provides strong guarantees even in the presence of multiple dishonest parties. In this work, we show how an agent of a quantum network can perform a distributed verification of a multipartite entangled source with minimal resources, which is, nevertheless, resistant against any number of dishonest parties. Moreover, we provide a tight tradeoff between the level of security and the distance between the state produced by the source and the ideal maximally entangled state. Last, by adding the resource of a trusted common random source, we can further provide security guarantees for all honest parties in the quantum network simultaneously. We investigate a general class of quantum key distribution (QKD) protocols using one-way classical communication. We show that full security can be proven by considering only collective attacks. We derive computable lower and upper bounds on the secret-key rate of those QKD protocols involving only entropies of two-qubit density operators. As an illustration of our results, we determine new bounds for the Bennett-Brassard 1984, the 6-state, and the Bennett 1992 protocols. We show that in all these cases the first classical processing that the legitimate partners should apply consists in adding noise. We show that any number of parties can coherently exchange any one pure quantum state for another, without communication, given prior shared entanglement. Two applications of this fact to the study of multi-prover quantum interactive proof systems are given. First, we prove that there exists a one-round two-prover quantum interactive proof system for which no finite amount of shared entanglement allows the provers to implement an optimal strategy. More specifically, for every fixed input string, there exists a sequence of strategies for the provers, with each strategy requiring more entanglement than the last, for which the probability for the provers to convince the verifier to accept approaches 1. It is not possible, however, for the provers to convince the verifier to accept with certainty with a finite amount of shared entanglement. The second application is a simple proof that multi-prover quantum interactive proofs can be transformed to have near-perfect completeness by the addition of one round of communication. In this paper, we investigate the convergence of the state of a quantum network to a consensus (symmetric) state. The state evolution of the quantum network with continuous-time swapping operators can be described by a Lindblad master equation, which also introduces an underlying interaction graph for the network. For a fixed quantum interaction graph, we prove that the state of a quantum network with continuous-time Markovian dynamics converges to a consensus state, with convergence rate given by the smallest nonzero eigenvalue of a matrix serving as the Laplacian of the quantum interaction graph. We show that this convergence rate can be optimized via standard convex programming given a fixed amount of edge weights. For switching quantum interaction graphs, we establish necessary and sufficient conditions for exponential quantum consensus and asymptotic quantum consensus, respectively. The convergence analysis is based on a bridge built between the proposed quantum consensus scheme and classical consensus dynamics, in that quantum consensus of n qubits naturally defines a consensus process on an induced classical graph with 22n nodes. Existing consensus results on classical networks can thus be adopted to establish the quantum consensus convergence. Quantum information theory is a multidisciplinary field whose objective is to understand what happens when information is stored in the state of a quantum system. Quantum mechanics provides us with a new resource, called quantum entanglement, which can be exploited to achieve novel tasks such as teleportation and superdense coding. Current technologies allow the transmission of entangled photon pairs across distances up to roughly 100 kilometers. For longer distances, noise arising from various sources degrade the transmission of entanglement to the point that it becomes impossible to use the entanglement as a resource for future tasks. One strategy for dealing with this difficulty is to employ quantum repeaters, stations intermediate between the sender and receiver that can participate in the process of entanglement distillation, thereby improving on what the sender and receiver could do on their own. Motivated by the problem of designing quantum repeaters, we study entanglement distillation between two parties, Alice and Bob, starting from a mixed state and with the help of repeater stations. We extend the notion of entanglement of assistance to arbitrary tripartite states and exhibit a protocol, based on a random coding strategy, for extracting pure entanglement. We use these results to find achievable rates for the more general scenario, where many spatially separated repeaters help two recipients distill entanglement. We also study multiparty quantum communication protocols in a more general context. We give a new protocol for the task of multiparty state merging. The previous multiparty state merging protocol required the use of time-sharing, an impossible strategy when a single copy of the input state is available to the parties. Our protocol does not require time-sharing for distributed compression of two senders. In the one-shot regime, we can achieve multiparty state merging with entanglement costs not restricted to corner points of the entanglement cost region. Our analysis of the entanglement cost is performed using (smooth) min- and max-entropies. We illustrate the benefits of our approach by looking at different examples. We revisit the classic problem of spreading a piece of information in a group of @math n fully connected processors. By suitably adding a small dose of randomness to the protocol of Gasieniec and Pelc (Parallel Comput 22:903---912, 1996), we derive for the first time protocols that (i) use a linear number of messages, (ii) are correct even when an arbitrary number of adversarially chosen processors does not participate in the process, and (iii) with high probability have the asymptotically optimal runtime of @math O(logn) when at least an arbitrarily small constant fraction of the processors are working. In addition, our protocols do not require that the system is synchronized nor that all processors are simultaneously woken up at time zero, they are fully based on push-operations, and they do not need an a priori estimate on the number of failed nodes. Our protocols thus overcome the typical disadvantages of the two known approaches, algorithms based on random gossip (typically needing a large number of messages due to their unorganized nature) and algorithms based on fair workload splitting (which are either not time-efficient or require intricate preprocessing steps plus synchronization). We introduce a new quantum protocol for solving detectable Byzantine agreement (also called detectable broadcast) between three parties, and also for solving the detectable liar detection problem. The protocol is suggested by the properties of a four-qubit entangled state, and the classical part of the protocol is simpler than that of previous proposals. In addition, we present an experimental implementation of the protocol using four-photon entanglement. Standard security proofs of quantum-key-distribution (QKD) protocols often rely on symmetry arguments. In this paper, we prove the security of a three-state protocol that does not possess rotational symmetry. The three-state QKD protocol we consider involves three qubit states, where the first two states @math and @math can contribute to key generation, and the third state @math is for channel estimation. This protocol has been proposed and implemented experimentally in some frequency-based QKD systems where the three states can be prepared easily. Thus, by founding on the security of this three-state protocol, we prove that these QKD schemes are, in fact, unconditionally secure against any attacks allowed by quantum mechanics. The main task in our proof is to upper bound the phase error rate of the qubits given the bit error rates observed. Unconditional security can then be proved not only for the ideal case of a single-photon source and perfect detectors, but also for the realistic case of a phase-randomized weak coherent light source and imperfect threshold detectors. Our result in the phase error rate upper bound is independent of the loss in the channel. Also, we compare the three-state protocol with the Bennett-Brassard 1984 (BB84) protocol. For the single-photon source case, our result proves that the BB84 protocol strictly tolerates a higher quantum bit error rate than the three-state protocol, while for the coherent-source case, the BB84 protocol achieves a higher key generation rate and secure distance than the three-state protocol when a decoy-state method is used. Consider a two-party quantum communication protocol for computing some function f : 0, 1 sup n spl times 0, 1 sup n spl rarr Z. We show that the first message of P can be compressed to 0(k) classical bits using prior entanglement if it carries at most k bits of information about the sender's input. This implies a general direct sum result for one-round and simultaneous quantum protocols. It also implies a new round elimination lemma in quantum communication, which allows us to extend recent classical lower bounds on the cell probe complexity of some data structure problems, e.g. approximate nearest neighbor searching on the Hamming cube 0, 1 sup n , to the quantum setting. We then show an optimal tradeoff between the privacy losses of Alice and Bob in computing f in terms of the one-round quantum communication complexity of f with prior entanglement. This tradeoff is independent of the number of rounds of communication. The above message compression and privacy tradeoff results use a lot of qubits of prior entanglement, leading one to wonder how much prior entanglement is really required by a quantum protocol. We show that Newman's [1991] technique of reducing the number of public coins in a classical protocol cannot be lifted to the quantum setting. We do this by defining a general notion of black-box reduction of prior entanglement that subsumes Newman's technique. Intuitively, a black-box reduction does not change the unitary transforms of Alice and Bob; it only decreases the amount of entanglement of the prior entangled state. We prove that such a black-box reduction is impossible for quantum protocols by exhibiting a particular one-round quantum protocol for the equality function where the black-box technique fails to reduce the amount of prior entanglement by more than a constant factor.