Quantum cryptography in Minkowski space
CC Attribution - NonCommercial - NoDerivatives 2.5 Switzerland:
You are free to use, copy, distribute and transmit the work or content in unchanged form for any legal and non-commercial purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Kent, Adrian
Quantum theory and the relativistic no-signalling principle both give ways of controlling information, in the sense that someone who creates information somewhere in space-time can rely on strict limits both on how much information another party can extract and on where they can obtain it. An increasingly long list of interesting cryptographic applications exploit the power of the no-signalling principle as well as the properties of quantum information. I describe recent work in this area, including secure protocols for bit commitment, quantum tagging (quantum position authentication) and new intrinsically relativistic cryptographic tasks.
 Welcome back to the afternoon session. Our first speaker of the afternoon is going to be Adrian Kent, who will tell us about cryptography in Minkowski space. Thank you very much, Patrick. Thank you all for coming. Particularly thanks to Stephanie and the other organizers for creating this event. And it's always a pleasure and a privilege to be visiting CQT in Singapore. I'm very happy to be back here. So my title is quantum cryptography in Minkowski space. To many people that may seem like a sort of puzzling conflation of rather separate subjects. I want to try and persuade you that in fact there's an emerging and now quite significant research field and indeed technological field that combines the ideas from quantum cryptography and the power of the no signaling principle, the causal structure of Minkowski space. So I just sit here, what I should stress is very much a sort of personal perspective, a brief partial history of this field. It's something that I've been interested in for quite a long time. And in 1999 and onwards I was interested in classical schemes for bit commitment, a task I'm going to say more about later. That our in Minkowski space used the fact that the two parties Alice and Bob both have agents at separate sites. We have Alice here, but also an Alice agent here and nearby we have a Bob and another Bob. And uses sequential information exchanges to achieve indefinitely secure bit commitment, secure at least against proven to be sure secure at least against all classical attacks. And against the powerful Myers-Low-Chow quantum attacks that make non-relativistic quantum bit commitment possible. We've heard already quite a lot about device independent key distribution and again a lot of the research in that field began with a question. Someone proved quantum cryptography secure based on no signaling alone. Lucy and Hardy actually posed that question, John Barrett and he and I were able to show the answers. Yes, and much more recently as Roger mentioned the other day, we have a two device version of that scheme that's also unconditionally secure. And other people noticed that this proof applies directly is a device independent protocol. And produced other more practical or in other ways more interesting device independent quantum key distribution schemes. I've listed many of the people who've been pushing that field forward here. It's not a complete list, I apologize to those who I don't know. Another idea that I'm going to touch on a little in this talk is what's, I am co-authors called quantum tagging and others have called quantum position authentication. The idea of trying to locate an object somewhere out there by exchanging signals with it from different distance sites. And that's a specific task. There's a beautiful general field which Harry Boorman and Chandra and their collaborators have been developing position based quantum cryptography which exploits the more general tasks that involve the position of the object. A couple more things that I want to focus on today. New and new schemes and in some ways much simpler and much less Baroque schemes for bit commitment but intrinsically used quantum information that work because of the no sign principle because of the causal structure of Minkowski space. So there's a couple of schemes here and a discussion of implementations the last paper. Yeah, that I'm going to say more about. So of the stuff I've listed here, the ones highlighted in red are the ones I'm going to try and touch on in this talk. So I'm also going to try and give a general way of thinking about cryptographic and indeed other problems in Minkowski space. So this is from an article in April this year. The idea here is to think about tasks as arising from something that you might think of as oracles that have definite locations in space and time and at definite points they produce inputs. So here at point P1 we get an input I1 which can be classical quantum or most generally both and excuse me, I'm here free wind and at various other points we get other inputs and one way of defining a task, a general task is to require that a party who can have agents distributed throughout space and time, who can communicate with each other freely is able at specified output points, the Qs, Q1 for instance here, to produce specified classical and or quantum outputs, for instance J1 at Q1 that depend in some predetermined way that's known to everybody in advance on the inputs and perhaps also on the locations of the input points. So that's very general of course as phrased, but I'll try and persuade you. There are many interesting specific examples of these tasks and it's interesting certainly in many special cases to try to prove whether this task can or cannot be reliably implemented, assuming perfect technology. I'm also interested in a variation of this idea in which we have the same story about inputs and outputs but we have some sort of screening off, we have areas of space and time where the party who's trying to complete the task can't go, they can't locate agents. I'll say more about that when we start talking about tagging. To start with though I want to focus on bit commitment and I apologize for 95% of the audience who don't need this review, but let me just remind you, remind people of the classical definition of bit commitment. Alice wants to make an encrypted prediction and she wants to do it bit by bit. She wants basically to commit herself now to a zero or a one for the moment we're thinking about and she wants to commit herself by literally or otherwise handing stuff over to another party Bob who she doesn't trust. Because she doesn't trust him, she wants some sort of guarantee that he's not going to be able to decrypt her prediction. She wants to remain under her control unless and until she chooses to give him a way of decrypting it. He doesn't trust her either and so he wants a guarantee that she genuinely committed herself to a single prediction and can't change it. For instance, he wants a guarantee that there aren't two different keys she can hand over that will decrypt it to two different predictions that she decides on only later. And ideally, just as quantum key distribution is superior to classical schemes that are based on hardness and problem, ideally they'd rather not rely on problems being computationally hard, ideally they'd like these guarantees to be based on the laws of physics alone. So one has to be careful in Minkowski's space, even in defining what one means by secure bit commitment. This for example, you can write down a very simple classical protocol that superficially might appear to be secure in some sense. The protocol here is that Alice, at point P, takes whatever bit she wants to commit herself to, encodes it, for instance using one time pad, sending it to her agent at Q1, also encodes it using different one time pad to her agent at Q2, and they unveil here and here. Now, certainly it's certainly the case that if these agents have no correlation information other than the bit B, if the only thing that's relevant that they receive are these signals from the point B, then they haven't got a way of deciding to coordinate a cheating attack and unveiling something different from B. I'm sorry, I need to master this device still. So here again from the paper I mentioned in April is a description of this task. We have a formal input B, we have outputs, which are both copies of B at Q1 and Q2. I want to stress to you this is not a secure bit commitment protocol. One way to see that is to think what happens if Alice has two computers running, say here and here, feverishly trying to calculate a bit B that she doesn't actually know at the point P. They calculate here at this point Q2 prime. This computer is finished and it hands over the bit B to an agent to Alice is there. This one also finishes its calculation at this point Q1 prime, hands over its calculation of B to the agent there. They're propagated here and they're unveiled. So by this sort of scheme, although Alice had no idea what the bit was that she was supposed to be committing herself to at P, she could so to speak find out later, find out at light separated points here and here and unveil here and here, Q0 and Q1. So one should not regard this simple protocol as a secure bit commitment scheme. What we want and what the quantum schemes that I'm going to describe do provide is security defined in an appropriate sense for Minkowski space. So what we want is that if according to prescription of a scheme Alice validly unveils a bit B, at two points Q1 and Q2 and the schemes that I'm going to describe all have this feature of unveiling at two points. This guarantees that she already committed herself at P. In the sense I'm sorry, we have a little problem creating PDF files here. So this epsilon has moved. What they should say is her optimal unveiling probabilities for 0 and 1 of a P0 plus P1 less than 1 plus epsilon and later that arrives later cannot alter this. Okay, so here's one simple scheme. Bob is going to produce an unknown quantum state of dimension some agreed dimension D. Let's say it's a pure state. He's going to hand it over to Alice at P. She is going to securely transmit it either to her agent at Q0 if she wants to commit to a 0 or to her agent at Q1 if she wants to commit to a 1. Securely transmit could be done in a variety of ways. Just to be, let's focus on one particular way, she's going to teleport the state either to Q0 or to Q1 using pre-distributed entanglement. She's not going to tell Bob which one she's teleporting it to and she's going to broadcast the classical teleportation information so that it's omnidirectional and Bob learns no information about which way the state is going from the teleportation information. There are other ways to implement this scheme and there's a discussion of various options in the paper with Serge Massard and Jonathan Silman. But let's focus on the teleportation implementation. Why is this secure? Well, it's secure against Bob because Alice gets something from Bob and then transmits it securely. Either because she actually controls these regions or simply as we've already discussed because she teleports. Secure against Alice by something that I'll talk about a little more later. This is what's called no summoning theorem. Another way of saying this is it's secure against Alice because of a combination of the no signaling principle and the no cloning theorem. To be able to break the scheme, roughly speaking, she would have to be able to produce a copy of Psi at Q0 and a copy of Psi at Q1 and then decide later which one is convenient for her to return. But we could draw a space like surface through Q0 and Q1. So if she were able to do that, she's effectively able to produce two independent copies of the unknown state Psi. In other words, she's able to clone Psi and the no cloning principle tells us that's impossible. And precisely, whatever quantum operations Alice implements, there must be some optimal states, row 0 and row 1, that she returns in the hope of persuading Bob that she's returned Psi at Q0 and Q1. So generally these will be mixed states rather than pure states. Generally they won't, neither of them will necessarily be the original state Psi. And the relevant quantity here is the probability that Bob accepts her unveilings. So the probability that accepts the unveiling at Q0 is just given by what happens if he measures row 0 in the basis defined by Psi, Psi row 0 Psi, similarly for Q1. And the point here is that some of these probabilities is bounded by something that is close to 1. And in fact, the gap between it and 1 is exponentially small than the number of qubits, which is the log of the dimension. So I'd given a one dimensional illustration of that, but it works in the real world, it works in 3 plus 1 dimensions. And in fact, in many ways it works rather nicely in the real world. You can imagine now Alice having a large number of agents located on like light rays somewhere in the future of P. And each possible light direction can code for a different data value. You can also imagine variations of the scheme in which Bob provides lots of states and Alice chooses permutation and sends one of the end states to each of one of these sites in order to code for more information. So the amount of data committed isn't necessarily a single bit, it's bounded in the end by how precisely Alice can transmit to this point rather than naming one and how precisely Bob can verify that she's done that. Don't get me wrong, those are important restrictions, but still one has some freedom. I mentioned already the Myers-No-Ciao, No-Go theorem for non-relativistic quantum bit commitment, and I just want to stress that I'm not attacking their celebrated result. It applies in the domain in which it was intended to apply non-relativistic quantum protocols. But there are some tacit assumptions in the proof, and if one looks at those tacit assumptions in the relativistic context, it becomes clear that they aren't necessarily valid, and in particular they aren't valid in the scheme I just described. Specifically, the Myers-No-Ciao proof assumes that if there is a unitary map taking the quantum state corresponding to a zero commitment to the quantum state corresponding to a one commitment, and if Alice knows what that map is, which one expects she does because she knows what the protocol is, then she should be able to implement that map physically. And if she can do that, she can create a zero map it to the state for a one and cheat by altering her commitments. So what goes wrong in our protocol? Well, she does know the relevant unitary. Here's the commitment to a zero, it's the state over here. Here's the commitment to one, it's the state over here, the unitary essentially speaking is just a translation, move the state across here. However, although she knows that, I'm sorry, she can't use that information, she can't implement that unitary physically because to move the state from here to here, that makes it cause a lot. So the Myers-No-Ciao cheating strategy isn't available, it doesn't apply here. Okay, I wanted to mention another bit commitments scheme. It puzzles even me why I've worried so much about bit commitment in relativity. I mean, it is an interesting task and it's an interesting setting. I think there's some sort of attempt to, some sort of belief somewhere out there that there is a platonic idea, the simplest possible way to do it. Maybe we're not even there yet, but I think this one is perhaps in some ways closer than the last one. It's perhaps a matter of taste. So the idea of this scheme is that Bob now sends Alice a sequence of states, which we can think of as BB84 states, some specified number N, and they sent rather quickly. So I'm going to idealize a little bit and say basically they all arrive at this point P. Actually, of course, there's a short time window in the states labeled and we have to allow for the time delays, but it doesn't make any essential difference. Alice carries out a measurement of these states in which she's honestly following the protocol. She carries out the measurement at the point P and she either measures in zero one basis or in the plus minus basis. She gets a series of classical results for her measurements and these she encrypts, let's say again using one time pads, and transmits them securely to Q0 and also to her agent at Q1. Notice it's worth thinking. What would happen if Q1 wasn't in the picture? I suppose she just did this to Q0. Then she could take the BB84 states, not measure them at P, but keep them as quantum states and propagate them along this line and carry out a measurement at any later point on the line and decide at any later point whether she wants to carry out the operation that's supposed to correspond to a commitment of zero or the operation that's supposed to correspond to commitment of one. And so if she were only required to unveil her information at one of these points, we wouldn't have security at all, she wouldn't be committed until she chooses to unveil. However, in the scheme she is required to unveil at both points. I want to touch on security and here I've already mentioned two of the relevant papers, one of which describes the scheme and the quantum tasks, two other relevant papers are one we're going to hear about next, I'm looking forward to that, and one by Sarah Croke and my self. So why is this secure against Bob? It's the same region as the last scheme and let me stress the sort of zenness of these schemes. Bob gets nothing. He gets nothing at all. It's not as though Alice hands him over a string of digits or a safe with something in it or anything corresponding to that. The all he sees is Alice sending secure communications which he can do nothing with to her agents. It's only when she hands over data here and here that he learns anything at all relevant to the bit. From relevant to his perspective. I'm sorry again about the alignment problems in the PDF here. Let me try and take you through this. Why is it secure against Alice? It's secure against Alice because if she has a nonzero probability P of being able to unveil both zero and one, which is what would follow if P zero plus P one, her probabilities for unveiling both of them were significantly greater than one, then she would be able to report credible measurement outcomes for each of the incoming states in both complementary bases. Since the measurements, her measurements are in the two BB84 bases, that means in particular she'd be able to identify each and every state correctly in its own basis. If you look at a single incoming state and ask what's the optimal probability of her producing a guess, and essentially she's got to give two BB84 states, so for instance this one and this one, and be sure that at least one of them is the correct one. What's her optimal probability of doing that for any given BB84 state? It's a half one plus one over root two, and it's obtained by carrying out a problem given by the positive operators that symmetrically aligned amongst the BB84 states like so. Does she get any advantage from collective operations? No she doesn't. She can apply any collective operation she likes to any given list of input states. Still, and we can think of the states as listed in an arbitrary order, it's just a matter of convenience which order. We list them, but let's say we're doing that, so there's state one, there's state two, there's state three and so on. Any collective operation, well if we just focus on one particular state, the end state, sorry that wasn't very well focusing, collective operation defines a positive operator on that state for each possible set of guesses on the first end states. You could think of it, if you just focus on that state, you could think well Alice is generating a list of guesses for all the states up to that one, and there's a positive operator corresponding to that. It's easy just, we're only working in two dimensions, so just list the possible positive operators. There is no positive operator that gives Alice greater confidence than one over two one plus one over root two in the guess of the end state. Whatever her guesses were, and in particular whatever the success rate for her guesses were for the first n minus one states, the nth guess has success probability bounded by the same bound, a half one plus one over root two, and so the overall success rate falls off exponentially, distinct to the end. Okay, I wanted to try to illustrate this perspective I'm trying to outline for you with some more general quantum tasks. So here's a more general quantum task, you're getting inputs in the form of classical information, let's call it s, and quantum information, let's call it psi, at points let's call them p, that it will label by i. So here's an input, here's another input, and you don't know in advance any of this stuff. You don't know that it's going to arrive at the point p i, it's just going to appear and you better be ready for it, and you don't know what's going to come, but you better be ready to deal with it. What are you going to be asked to do, you're going to be asked, again let me take you through this because it's misaligned, you're going to be asked at points q i that can depend on these inputs to produce outputs in the form of more classical information, s i prime and psi i prime, but also in general depend on these inputs. And as I tried to stress earlier, we might also chain you a little bit more by saying you can have agents in many places in space time, but there are some regional regions where your agents are excluded. Okay, so now let me get a bit more concrete. Your task in fact is going to be returning an unknown state, something we've already used here for bit commitment, but I want to do something different with it now. You're going to get an input, this unknown quantum state in some dimension, some Hilbert space dimension that you know it wants, let's say it arrives at the origin. And then at some later point, it's separated in space by a fixed distance l, and at some point in time t that you don't know in advance, you're going to get an input saying, hello, I want that state back, please. And you're not going to be asked to give it back instantly, you're going to be asked to give it back at this point, minus l t plus 2l. Psi has got to be produced there. Okay, that could happen, but here's another thing that could happen, it could happen on the other side. You're going to get an input at l t, requesting the return of psi, and you're going to be asked for it at the symmetric point, displaced by time 2l in the future on that side. You're not going to be asked for it in both places, that would be impossible. You're only going to get one request, but you don't know when it's going to come and you don't know which side it's going to come. Okay, that's not so tough. Here's one obvious way to comply with this task. You just keep the state at the origin, keep it, keep it, keep it, keep it. When a request comes in, you just send classically the information that the request has come into the origin, and if the signal comes from the left saying, I've got a request over here, at this point, you take the state and you transmit it at light speed to the left, and if it came from the right, you send the state to the right. For instance, the state could follow this transmission path in purple, held, held, held, held, held, the request came in from the right, fine, we send it off to the right, returned, good, we won. Okay, so to make life a little more difficult, we can start playing these exclusion games. Suppose now you're excluded from this region that covers exactly that line where you were holding the state, covers the origin at all times. Now you can't follow this strategy. You can't hold the state here because you're not allowed to be here. Okay, well, you could hold it to the right over here. That's fine if a request comes in on the right, but it's obviously disastrous if a request comes in from the left because it's going to take too long. If you're holding it here, you're not going to learn until here that the request has come in from the left and now you've got to reply, comply, okay, you may be able to teleport across the region, but still the state's got to go to the left and it's not going to get there until there and that's too late, it's supposed to be there. So you've got a problem, but it's a problem to which I think many people here ahead of me, you've seen this already, but it's a problem to which there turns out to be theoretically, if not technologically, simple solution. Here's one thing you can do. You can take the state, send it across to this point on the left, teleport it across to the symmetric point on the right. In other words, you have entanglement, in fact, lots of entanglement shared between minus L and L, but these teleportations, and you can teleport it back and forth with pretty short time intervals, but you're going to do that without waiting for the classical information about the teleportation. So you're just going to carry out the bell measurement, you're certainly going to record the classical information and you are going to transmit it, but your next teleportation is going to go ahead before the previous classical information came across. So bell measurement here, bell measurement here, bell measurement here, bell measurement here and so on. Classical information is streaming back and forth, but time lacked compared to the quantum information. And what happens when a request comes in? Well, it's been teleported, teleported, teleported, teleported. Now you get a request over here. Now you stop teleporting. You hold on to the state, you say, I know I'm going to need it on this side, and you wait for the classical information for all the teleportations from the other side to come, and then you apply all the corrections from that side or from your own side in the right sequence, produce the state here, and return it just in the nick of time at the required point here. Okay. So what are we learning from this? So we started with this idea of complying with the task by taking a quantum state and making it follow a particular path. And the point of the stress is this elementary one. You don't necessarily have to do things that way. And what's happened here is that the quantum information is being effectively delocalized by the teleportations, and doing that allows you to complying with this task just as though you were holding the state at some point in the excluded zone. So this, one way to think about this is, if you weren't aware of this strategy, is that these requests are a way of testing whether somebody is really holding states in the excluded zone. There are ways, in other words, of authenticating the position of whatever contains the state, the tag. And these teleportations are breaking this scheme. They're showing that there's a way to break at least this particular type of quantum tagging, quantum position authentication scheme. Even though naively, it looks as though it's secure, it looks as though the test was indeed approved that the state was being held in the right place. So this is a question with quite still very much actively being pushed forward, with a lot of history. The idea of position authentication was independently invented by these authors, and Chandranthal, and Malayne. These tagging schemes were proposed, and in particular Chandranthal and Malayne in 2009, 2010, claim to approve in their scheme secure. Tim Munro, sorry, Tim Spiller, Bill Munro and I showed how to break those specific schemes by teleportation attacks. We proposed some other schemes, but just left us with no question whether they were actually secure or not. We didn't know. We also proposed some other schemes of ejection they were secure. I'll come back to this one. For the relevant model for this bit of the discussion, for tags that just hold quantum, for the original model for this discussion, a beautiful general no-go theorem that applies to the schemes we proposed in Lowell and Lowell's and a much larger class shows that all such schemes are provably insecure, provided that one has arbitrarily large amounts of entanglement and is able to teleport with perfect efficiency. This is Boorman, Chandran, Fair and co-authors. I think it's a really very beautiful no-go theorem, which itself relies on very beautiful early ideas by Lev Weidman on local quantum measurements and their implementation. I have a list of references here. The thing I wanted to come back to is that because I think it's not as yet as much appreciated it should be, is that this result, this no-go theorem, very much crucially depends on the details of the security model. If you think of a very slightly different question, can I authenticate the position of a tag that's some sort of object out there that is able to keep hold some classical data stream and keep that secure? If that data stream is shared by the verifiers who are sitting remotely and exchanging information, then it changes things completely. One can have secure quantum tagging. One can have it, in fact, quite easily. The security follows directly from the security of quantum key distribution and the no-superluminal signaling principle. This is a very plausibly the basis of a useful future technology, to my mind. I've ordered this information in one of a number of possible ways because I wanted to focus first on the cryptographic problem. Let me, let's remember the original question was in this discussion about authentication of position, was whether we can verify whether a state lies in a particular region using remote queries, and the original protocol we tried failed to get a reliable way of verifying that. We saw that the state could be, so to speak, delocalized around the region by teleportations. That's a problem for such schemes, at least in principle. It's a problem that produces beautiful theoretical results, and we shouldn't be too unhappy. It also raises a general question, what are the constraints on producing an unknown state when it's requested? Although it's not directly cryptographic, I think you'll agree it already turned out to be very cryptographically relevant. I wanted to just review a very simple example of a constraint on the possibility of producing an unknown state. What I mentioned earlier, the no-summoning theorem. So I, what is this thing called summoning? It's a task involving two agencies, Alice and Bob. So again, Alice has many representatives. They're all collaborating, they all trust each other, they distribute you space and time. Bob, likewise. Alice, let's say, prepares a state that Bob doesn't know and hands it over to him at a point P. At some point Q, and it's going to be in the course of future of P otherwise, it's clear that Bob has no chance. Alice is going to summon the state. She's going to ask him to return it to her. One of the reasons I find this an interesting task is that it distinguishes between relativistic quantum mechanics and other theories. So if we were talking about quantum mechanics in Galilean space time, it's very easy to see Bob can comply. If we were talking about classical mechanics in Mckowski space time, it's very easy to see Bob can comply. But in the case we're actually interested in, what's pretty much the real world, quantum states in Mckowski space time, he can't. So just to review that, classical theories in Mckowski space, it's given an unknown classical state. Well, he could just broadcast the information about that state everywhere. So when he's asked for it back at Q, he returns it at Q. Non-religious quantum mechanics, he could just hold the state here, use the fact that there's no bound on signal speed. So when he's asked for it at Q, he sends a classical signal saying, I need it over at Q, instantaneously, and he can send the quantum state instantaneously back to Q. In relativistic quantum theory, he can't do the first because he'd have to clone the state, and he can't do the second because he'd have to send information superluminally between these two points. So neither of those strategies works, and more generally, I don't think I really need even to convince you, no signaling, cloning plus no signaling allows you to prove very simply that whatever strategy he follows, in general he's not going to be able to satisfy with a summons if he has no information in advance about the point at which the summons is going to be made. You might just for a moment at least contemplate the possibility that this is a feature of the idealization of the task. We've asked that Bob receive a summons and instantaneously return the state. That's pretty unreasonable in the real world. You should maybe give him a little bit of time and space to do it. You might also give him a little bit of a margin of error, say that it's going to be okay if he returns something that's very nearly at the state. That's fidelity one minus epsilon to the state. In the cases non-relativistic quantum mechanics or relativistic classical mechanics, that means not just that ideally he can comply, but realistically with the reasonable technology he could comply. But it doesn't change the picture in relativistic quantum mechanics. There are non-trivial bounds on the fidelity of approximate cloning. And even when we talk about realistic implementations rather than idealizations, the conclusion that he survives, there's not even an approximate summoning is not possible in relativistic quantum theory for any reasonable degree of approximation. We can quantify that. But the bounds really follow directly from the bounds of the approximate cloning. I'm going to skip that and wind up here. So I do very much appreciate being able to talk to you about this. I think perhaps for a long time relativistic quantum cryptography was seen by many people as a somewhat esoteric sort of niche subject of intellectual interest, but not necessarily practical interest. But I believe it is now developing into a major field, and so right. We have direct applications that I've already reviewed, to bit commitment, to quantum tagging and possession authentication, the beautiful general subject of position-based quantum cryptography that Boorman, Chandram and collaborators have been developing. A slightly weird task called location oblivious quantum data transfer, which I haven't talked about, which maybe is useful for something. Secure coin tossing protocols, including coin tossings in which the users are allowed to vary the biases within prescribed limits. But Roger Colbert and I described some time ago. There's also been a direct interplay and flow of ideas from relativistic quantum cryptographic protocols to the field of device-independent quantum cryptography, starting with the whole idea of a basic key distribution on the no signaling principle. I'm becoming more and more confident that we will see future technologies being built using quite a few of these ideas. And I'm also certain this is still a very much an underexplored field. I've given a personal perspective and I've given some tasks that I've taken a personal interest in, but I think there's a great deal out there awaiting discovery. I think even the framework that I've set out, although I find it useful and maybe is adequate, is not necessarily the only interesting way of thinking about relativistic quantum cryptography, and there's a lot of scope for other ideas there also. And in short, there's a wealth, I think, of new cryptographic ideas awaiting discovery along with new perspectives. Just sorry, let me just go back one. Indeed, as I understand it, the next talk is going to give a different perspective on some of the ideas that I've touched on here. Richard Feynman always used to stress that you don't really understand the subject if you only have one way of thinking about it. You learn much more. The more different ways you have of thinking about it, the more different languages, different mathematics, different ways of doing calculations, and I'm sure that's true here, so I'm very much looking forward to the next presentation. And with that, I wanted to close. Thank you very much for your attention. We have about five minutes for questions, and so if anyone has any questions, this is the last one. Hi. So in reality, you sort of only have a small diameter in which Alice and Bob can move about if we're going to try and use this bit commitment scheme. And so is there some way, it seems possible a priori, that you could do a commitment that only gets revealed in say a year, even though you're only allowed to move around in a space region that has a diameter of like one second. Do you know if such schemes exist, or is it known to be possible, impossible? So I'm not sure I've understood. Is your idea something like this, that Alice and Bob are constrained to the surface of the earth or something like that? Yeah, yeah, so it seems like clearly they can do a commitment that gets revealed in half a second or whatever, or 100th of a second, but can they do one that gets revealed in a year? Yes, that's a good question. The natural thing to try would be to chain together sequences of these commitments. When you do that, at least naively, you risk, you may produce something that's theoretically secure but blows up the amount of information each time you add another step to the chain. You need more and more committed information because each commitment is committing data from previous commitment. So there are ways that you could try to deal with that problem as well. There was an analogous problem actually in the classical schemes that I described earlier, and it turns out there you can get away with a constant information exchange rather than exponentially growing one. But these are questions that I haven't resolved. They're things I'm interested in exploring, so I can't give you a straight answer right now. Thank you. Other questions? I actually have a quick one. For the bit commitment scheme that you proposed involving the BB84 states, have you thought at all about if someone actually wanted to build this thing, what kinds of tolerances and what kinds of distances over which one would need to build this apparatus would be necessary? I thought a little. The best thing to say I think is the Geneva Group are trying to implement this scheme and believe they should be able to do it. They hope they should be able to do it within the next year. So I look forward with interest to seeing the results of that. Yes, I'm not an engineer, so I'm giving you precise figures is probably going beyond my remit here. My question will clearly prove that I did not understand your scheme. I ideally wish I would, but let me ask anyways. The bit commitment scheme, is it of a fixed duration or can it be open at any time in the future that Alice chooses? It can be open at any points on the light. She has to unveil at two points on different light rays. She could choose those points on the light ray. But of course the light ray is not. Does she need to choose these points in advance or does it require these agents to move at the speed of light? Well, you don't have to think of the agents moving at the speed of light. She could have a network of agents already in place and send information. No, she doesn't have to choose in advance the points on the light ray. At the time she commits, she does not, at that time, need to know when she will open it, right? Right. But at the same time, let me stress, she's obviously strongly constrained by the geometry, the geometry rather. She's only able to open it at a point where she has an agent on the light ray. She could have a long chain of agents on the light ray and they could decide. And Bob need not know where these points are. Well he's got to be able to receive the data from her pretty much. So that you don't, pretty quickly, to ensure that. So, he, so, so, roughly speaking, he, sorry, Bob needs to have an agent near each of Alice's agents. Roughly speaking. Yes. I'll get in now. Thank you. All right, I think we're out of time for this presentation. So let's thank Adrian again and move on to the next talk.
 Welcome back to the afternoon session.  Our first speaker of the afternoon is going to be Adrian Kent, who will tell us about  cryptography in Minkowski space.  Thank you very much, Patrick.  Thank you all for coming.  Particularly thanks to Stephanie and the other organizers for creating this event.  And it's always a pleasure and a privilege to be visiting CQT in Singapore.  I'm very happy to be back here.  So my title is quantum cryptography in Minkowski space.  To many people that may seem like a sort of puzzling conflation of rather separate subjects.  I want to try and persuade you that in fact there's an emerging and now quite significant  research field and indeed technological field that combines the ideas from quantum cryptography  and the power of the no signaling principle, the causal structure of Minkowski space.  So I just sit here, what I should stress is very much a sort of personal perspective,  a brief partial history of this field.  It's something that I've been interested in for quite a long time.  And in 1999 and onwards I was interested in classical schemes for bit commitment, a task  I'm going to say more about later.  That our in Minkowski space used the fact that the two parties Alice and Bob both have  agents at separate sites.  We have Alice here, but also an Alice agent here and nearby we have a Bob and another Bob.  And uses sequential information exchanges to achieve indefinitely secure bit commitment,  secure at least against proven to be sure secure at least against all classical attacks.  And against the powerful Myers-Low-Chow quantum attacks that make non-relativistic quantum  bit commitment possible.  We've heard already quite a lot about device independent key distribution and again a lot  of the research in that field began with a question.  Someone proved quantum cryptography secure based on no signaling alone.  Lucy and Hardy actually posed that question, John Barrett and he and I were able to show  the answers.  Yes, and much more recently as Roger mentioned the other day, we have a two device version  of that scheme that's also unconditionally secure.  And other people noticed that this proof applies directly is a device independent protocol.  And produced other more practical or in other ways more interesting device independent quantum  key distribution schemes.  I've listed many of the people who've been pushing that field forward here.  It's not a complete list, I apologize to those who I don't know.  Another idea that I'm going to touch on a little in this talk is what's, I am co-authors  called quantum tagging and others have called quantum position authentication.  The idea of trying to locate an object somewhere out there by exchanging signals with it from  different distance sites.  And that's a specific task.  There's a beautiful general field which Harry Boorman and Chandra and their collaborators  have been developing position based quantum cryptography which exploits the more general  tasks that involve the position of the object.  A couple more things that I want to focus on today.  New and new schemes and in some ways much simpler and much less Baroque schemes for  bit commitment but intrinsically used quantum information that work because of the no sign  principle because of the causal structure of Minkowski space.  So there's a couple of schemes here and a discussion of implementations the last paper.  Yeah, that I'm going to say more about.  So of the stuff I've listed here, the ones highlighted in red are the ones I'm going  to try and touch on in this talk.  So I'm also going to try and give a general way of thinking about cryptographic and indeed  other problems in Minkowski space.  So this is from an article in April this year.  The idea here is to think about tasks as arising from something that you might think of as  oracles that have definite locations in space and time and at definite points they produce  inputs.  So here at point P1 we get an input I1 which can be classical quantum or most generally  both and excuse me, I'm here free wind and at various other points we get other inputs  and one way of defining a task, a general task is to require that a party who can have  agents distributed throughout space and time, who can communicate with each other freely  is able at specified output points, the Qs, Q1 for instance here, to produce specified  classical and or quantum outputs, for instance J1 at Q1 that depend in some predetermined  way that's known to everybody in advance on the inputs and perhaps also on the locations  of the input points.  So that's very general of course as phrased, but I'll try and persuade you.  There are many interesting specific examples of these tasks and it's interesting certainly  in many special cases to try to prove whether this task can or cannot be reliably implemented,  assuming perfect technology.  I'm also interested in a variation of this idea in which we have the same story about  inputs and outputs but we have some sort of screening off, we have areas of space and time  where the party who's trying to complete the task can't go, they can't locate agents.  I'll say more about that when we start talking about tagging.  To start with though I want to focus on bit commitment and I apologize for 95% of the  audience who don't need this review, but let me just remind you, remind people of the classical  definition of bit commitment.  Alice wants to make an encrypted prediction and she wants to do it bit by bit.  She wants basically to commit herself now to a zero or a one for the moment we're thinking  about and she wants to commit herself by literally or otherwise handing stuff over to another  party Bob who she doesn't trust.  Because she doesn't trust him, she wants some sort of guarantee that he's not going to be  able to decrypt her prediction.  She wants to remain under her control unless and until she chooses to give him a way of  decrypting it.  He doesn't trust her either and so he wants a guarantee that she genuinely committed herself  to a single prediction and can't change it.  For instance, he wants a guarantee that there aren't two different keys she can hand over  that will decrypt it to two different predictions that she decides on only later.  And ideally, just as quantum key distribution is superior to classical schemes that are  based on hardness and problem, ideally they'd rather not rely on problems being computationally  hard, ideally they'd like these guarantees to be based on the laws of physics alone.  So one has to be careful in Minkowski's space, even in defining what one means by secure bit  commitment.  This for example, you can write down a very simple classical protocol that superficially  might appear to be secure in some sense.  The protocol here is that Alice, at point P, takes whatever bit she wants to commit herself  to, encodes it, for instance using one time pad, sending it to her agent at Q1, also encodes  it using different one time pad to her agent at Q2, and they unveil here and here.  Now, certainly it's certainly the case that if these agents have no correlation information  other than the bit B, if the only thing that's relevant that they receive are these signals  from the point B, then they haven't got a way of deciding to coordinate a cheating attack  and unveiling something different from B.  I'm sorry, I need to master this device still.  So here again from the paper I mentioned in April is a description of this task.  We have a formal input B, we have outputs, which are both copies of B at Q1 and Q2.  I want to stress to you this is not a secure bit commitment protocol.  One way to see that is to think what happens if Alice has two computers running, say here  and here, feverishly trying to calculate a bit B that she doesn't actually know at the  point P. They calculate here at this point Q2 prime.  This computer is finished and it hands over the bit B to an agent to Alice is there.  This one also finishes its calculation at this point Q1 prime, hands over its calculation  of B to the agent there.  They're propagated here and they're unveiled.  So by this sort of scheme, although Alice had no idea what the bit was that she was  supposed to be committing herself to at P, she could so to speak find out later, find  out at light separated points here and here and unveil here and here, Q0 and Q1.  So one should not regard this simple protocol as a secure bit commitment scheme.  What we want and what the quantum schemes that I'm going to describe do provide is security  defined in an appropriate sense for Minkowski space.  So what we want is that if according to prescription of a scheme Alice validly unveils a bit B,  at two points Q1 and Q2 and the schemes that I'm going to describe all have this feature  of unveiling at two points.  This guarantees that she already committed herself at P. In the sense I'm sorry, we have  a little problem creating PDF files here.  So this epsilon has moved.  What they should say is her optimal unveiling probabilities for 0 and 1 of a P0 plus P1 less  than 1 plus epsilon and later that arrives later cannot alter this.  Okay, so here's one simple scheme.  Bob is going to produce an unknown quantum state of dimension some agreed dimension D.  Let's say it's a pure state.  He's going to hand it over to Alice at P. She is going to securely transmit it either  to her agent at Q0 if she wants to commit to a 0 or to her agent at Q1 if she wants  to commit to a 1.  Securely transmit could be done in a variety of ways.  Just to be, let's focus on one particular way, she's going to teleport the state either  to Q0 or to Q1 using pre-distributed entanglement.  She's not going to tell Bob which one she's teleporting it to and she's going to broadcast  the classical teleportation information so that it's omnidirectional and Bob learns  no information about which way the state is going from the teleportation information.  There are other ways to implement this scheme and there's a discussion of various options  in the paper with Serge Massard and Jonathan Silman.  But let's focus on the teleportation implementation.  Why is this secure?  Well, it's secure against Bob because Alice gets something from Bob and then transmits  it securely.  Either because she actually controls these regions or simply as we've already discussed  because she teleports.  Secure against Alice by something that I'll talk about a little more later.  This is what's called no summoning theorem.  Another way of saying this is it's secure against Alice because of a combination of  the no signaling principle and the no cloning theorem.  To be able to break the scheme, roughly speaking, she would have to be able to produce a copy  of Psi at Q0 and a copy of Psi at Q1 and then decide later which one is convenient for her  to return.  But we could draw a space like surface through Q0 and Q1.  So if she were able to do that, she's effectively able to produce two independent copies of  the unknown state Psi.  In other words, she's able to clone Psi and the no cloning principle tells us that's  impossible.  And precisely, whatever quantum operations Alice implements, there must be some optimal  states, row 0 and row 1, that she returns in the hope of persuading Bob that she's returned  Psi at Q0 and Q1.  So generally these will be mixed states rather than pure states.  Generally they won't, neither of them will necessarily be the original state Psi.  And the relevant quantity here is the probability that Bob accepts her unveilings.  So the probability that accepts the unveiling at Q0 is just given by what happens if he  measures row 0 in the basis defined by Psi, Psi row 0 Psi, similarly for Q1.  And the point here is that some of these probabilities is bounded by something that is close to 1.  And in fact, the gap between it and 1 is exponentially small than the number of qubits, which is  the log of the dimension.  So I'd given a one dimensional illustration of that, but it works in the real world, it  works in 3 plus 1 dimensions.  And in fact, in many ways it works rather nicely in the real world.  You can imagine now Alice having a large number of agents located on like light rays somewhere  in the future of P. And each possible light direction can code for a different data value.  You can also imagine variations of the scheme in which Bob provides lots of states and Alice  chooses permutation and sends one of the end states to each of one of these sites in order  to code for more information.  So the amount of data committed isn't necessarily a single bit, it's bounded in the end by  how precisely Alice can transmit to this point rather than naming one and how precisely  Bob can verify that she's done that.  Don't get me wrong, those are important restrictions, but still one has some freedom.  I mentioned already the Myers-No-Ciao, No-Go theorem for non-relativistic quantum bit commitment,  and I just want to stress that I'm not attacking their celebrated result.  It applies in the domain in which it was intended to apply non-relativistic quantum protocols.  But there are some tacit assumptions in the proof, and if one looks at those tacit assumptions  in the relativistic context, it becomes clear that they aren't necessarily valid, and in  particular they aren't valid in the scheme I just described.  Specifically, the Myers-No-Ciao proof assumes that if there is a unitary map taking the  quantum state corresponding to a zero commitment to the quantum state corresponding to a one  commitment, and if Alice knows what that map is, which one expects she does because  she knows what the protocol is, then she should be able to implement that map physically.  And if she can do that, she can create a zero map it to the state for a one and cheat by  altering her commitments.  So what goes wrong in our protocol?  Well, she does know the relevant unitary.  Here's the commitment to a zero, it's the state over here.  Here's the commitment to one, it's the state over here, the unitary essentially speaking  is just a translation, move the state across here.  However, although she knows that, I'm sorry, she can't use that information, she can't  implement that unitary physically because to move the state from here to here, that makes  it cause a lot.  So the Myers-No-Ciao cheating strategy isn't available, it doesn't apply here.  Okay, I wanted to mention another bit commitments scheme.  It puzzles even me why I've worried so much about bit commitment in relativity.  I mean, it is an interesting task and it's an interesting setting.  I think there's some sort of attempt to, some sort of belief somewhere out there that there  is a platonic idea, the simplest possible way to do it.  Maybe we're not even there yet, but I think this one is perhaps in some ways closer than  the last one.  It's perhaps a matter of taste.  So the idea of this scheme is that Bob now sends Alice a sequence of states, which we  can think of as BB84 states, some specified number N, and they sent rather quickly.  So I'm going to idealize a little bit and say basically they all arrive at this point  P. Actually, of course, there's a short time window in the states labeled and we have to  allow for the time delays, but it doesn't make any essential difference.  Alice carries out a measurement of these states in which she's honestly following the protocol.  She carries out the measurement at the point P and she either measures in zero one basis  or in the plus minus basis.  She gets a series of classical results for her measurements and these she encrypts, let's  say again using one time pads, and transmits them securely to Q0 and also to her agent  at Q1.  Notice it's worth thinking.  What would happen if Q1 wasn't in the picture?  I suppose she just did this to Q0.  Then she could take the BB84 states, not measure them at P, but keep them as quantum states  and propagate them along this line and carry out a measurement at any later point on the  line and decide at any later point whether she wants to carry out the operation that's  supposed to correspond to a commitment of zero or the operation that's supposed to  correspond to commitment of one.  And so if she were only required to unveil her information at one of these points, we  wouldn't have security at all, she wouldn't be committed until she chooses to unveil.  However, in the scheme she is required to unveil at both points.  I want to touch on security and here I've already mentioned two of the relevant papers,  one of which describes the scheme and the quantum tasks, two other relevant papers are  one we're going to hear about next, I'm looking forward to that, and one by Sarah Croke and  my self.  So why is this secure against Bob?  It's the same region as the last scheme and let me stress the sort of zenness of these  schemes.  Bob gets nothing.  He gets nothing at all.  It's not as though Alice hands him over a string of digits or a safe with something  in it or anything corresponding to that.  The all he sees is Alice sending secure communications which he can do nothing with to her agents.  It's only when she hands over data here and here that he learns anything at all relevant  to the bit.  From relevant to his perspective.  I'm sorry again about the alignment problems in the PDF here.  Let me try and take you through this.  Why is it secure against Alice?  It's secure against Alice because if she has a nonzero probability P of being able to unveil  both zero and one, which is what would follow if P zero plus P one, her probabilities for  unveiling both of them were significantly greater than one, then she would be able to  report credible measurement outcomes for each of the incoming states in both complementary  bases.  Since the measurements, her measurements are in the two BB84 bases, that means in particular  she'd be able to identify each and every state correctly in its own basis.  If you look at a single incoming state and ask what's the optimal probability of her  producing a guess, and essentially she's got to give two BB84 states, so for instance  this one and this one, and be sure that at least one of them is the correct one.  What's her optimal probability of doing that for any given BB84 state?  It's a half one plus one over root two, and it's obtained by carrying out a problem given  by the positive operators that symmetrically aligned amongst the BB84 states like so.  Does she get any advantage from collective operations?  No she doesn't.  She can apply any collective operation she likes to any given list of input states.  Still, and we can think of the states as listed in an arbitrary order, it's just a matter  of convenience which order.  We list them, but let's say we're doing that, so there's state one, there's state two, there's  state three and so on.  Any collective operation, well if we just focus on one particular state, the end state,  sorry that wasn't very well focusing, collective operation defines a positive operator on that  state for each possible set of guesses on the first end states.  You could think of it, if you just focus on that state, you could think well Alice is  generating a list of guesses for all the states up to that one, and there's a positive operator  corresponding to that.  It's easy just, we're only working in two dimensions, so just list the possible positive  operators.  There is no positive operator that gives Alice greater confidence than one over two one plus  one over root two in the guess of the end state.  Whatever her guesses were, and in particular whatever the success rate for her guesses  were for the first n minus one states, the nth guess has success probability bounded by  the same bound, a half one plus one over root two, and so the overall success rate falls  off exponentially, distinct to the end.  Okay, I wanted to try to illustrate this perspective I'm trying to outline for you with some more  general quantum tasks.  So here's a more general quantum task, you're getting inputs in the form of classical information,  let's call it s, and quantum information, let's call it psi, at points let's call them  p, that it will label by i.  So here's an input, here's another input, and you don't know in advance any of this  stuff.  You don't know that it's going to arrive at the point p i, it's just going to appear  and you better be ready for it, and you don't know what's going to come, but you better  be ready to deal with it.  What are you going to be asked to do, you're going to be asked, again let me take you through  this because it's misaligned, you're going to be asked at points q i that can depend  on these inputs to produce outputs in the form of more classical information, s i prime  and psi i prime, but also in general depend on these inputs.  And as I tried to stress earlier, we might also chain you a little bit more by saying  you can have agents in many places in space time, but there are some regional regions  where your agents are excluded.  Okay, so now let me get a bit more concrete.  Your task in fact is going to be returning an unknown state, something we've already  used here for bit commitment, but I want to do something different with it now.  You're going to get an input, this unknown quantum state in some dimension, some Hilbert  space dimension that you know it wants, let's say it arrives at the origin.  And then at some later point, it's separated in space by a fixed distance l, and at some  point in time t that you don't know in advance, you're going to get an input saying, hello,  I want that state back, please.  And you're not going to be asked to give it back instantly, you're going to be asked  to give it back at this point, minus l t plus 2l.  Psi has got to be produced there.  Okay, that could happen, but here's another thing that could happen, it could happen on  the other side.  You're going to get an input at l t, requesting the return of psi, and you're going to be  asked for it at the symmetric point, displaced by time 2l in the future on that side.  You're not going to be asked for it in both places, that would be impossible.  You're only going to get one request, but you don't know when it's going to come and  you don't know which side it's going to come.  Okay, that's not so tough.  Here's one obvious way to comply with this task.  You just keep the state at the origin, keep it, keep it, keep it, keep it.  When a request comes in, you just send classically the information that the request has come  into the origin, and if the signal comes from the left saying, I've got a request over here,  at this point, you take the state and you transmit it at light speed to the left, and  if it came from the right, you send the state to the right.  For instance, the state could follow this transmission path in purple, held, held, held,  held, held, the request came in from the right, fine, we send it off to the right, returned,  good, we won.  Okay, so to make life a little more difficult, we can start playing these exclusion games.  Suppose now you're excluded from this region that covers exactly that line where you were  holding the state, covers the origin at all times.  Now you can't follow this strategy.  You can't hold the state here because you're not allowed to be here.  Okay, well, you could hold it to the right over here.  That's fine if a request comes in on the right, but it's obviously disastrous if a request  comes in from the left because it's going to take too long.  If you're holding it here, you're not going to learn until here that the request has come  in from the left and now you've got to reply, comply, okay, you may be able to teleport across  the region, but still the state's got to go to the left and it's not going to get there  until there and that's too late, it's supposed to be there.  So you've got a problem, but it's a problem to which I think many people here ahead of  me, you've seen this already, but it's a problem to which there turns out to be theoretically,  if not technologically, simple solution.  Here's one thing you can do.  You can take the state, send it across to this point on the left, teleport it across  to the symmetric point on the right.  In other words, you have entanglement, in fact, lots of entanglement shared between  minus L and L, but these teleportations, and you can teleport it back and forth with pretty  short time intervals, but you're going to do that without waiting for the classical information  about the teleportation.  So you're just going to carry out the bell measurement, you're certainly going to record  the classical information and you are going to transmit it, but your next teleportation  is going to go ahead before the previous classical information came across.  So bell measurement here, bell measurement here, bell measurement here, bell measurement  here and so on.  Classical information is streaming back and forth, but time lacked compared to the quantum  information.  And what happens when a request comes in?  Well, it's been teleported, teleported, teleported, teleported.  Now you get a request over here.  Now you stop teleporting.  You hold on to the state, you say, I know I'm going to need it on this side, and you  wait for the classical information for all the teleportations from the other side to come,  and then you apply all the corrections from that side or from your own side in the right  sequence, produce the state here, and return it just in the nick of time at the required  point here.  Okay.  So what are we learning from this?  So we started with this idea of complying with the task by taking a quantum state and  making it follow a particular path.  And the point of the stress is this elementary one.  You don't necessarily have to do things that way.  And what's happened here is that the quantum information is being effectively delocalized  by the teleportations, and doing that allows you to complying with this task just as though  you were holding the state at some point in the excluded zone.  So this, one way to think about this is, if you weren't aware of this strategy, is that  these requests are a way of testing whether somebody is really holding states in the excluded  zone.  There are ways, in other words, of authenticating the position of whatever contains the state,  the tag.  And these teleportations are breaking this scheme.  They're showing that there's a way to break at least this particular type of quantum tagging,  quantum position authentication scheme.  Even though naively, it looks as though it's secure, it looks as though the test was indeed  approved that the state was being held in the right place.  So this is a question with quite still very much actively being pushed forward, with a  lot of history.  The idea of position authentication was independently invented by these authors, and Chandranthal,  and Malayne.  These tagging schemes were proposed, and in particular Chandranthal and Malayne in 2009,  2010, claim to approve in their scheme secure.  Tim Munro, sorry, Tim Spiller, Bill Munro and I showed how to break those specific schemes  by teleportation attacks.  We proposed some other schemes, but just left us with no question whether they were actually  secure or not.  We didn't know.  We also proposed some other schemes of ejection they were secure.  I'll come back to this one.  For the relevant model for this bit of the discussion, for tags that just hold quantum,  for the original model for this discussion, a beautiful general no-go theorem that applies  to the schemes we proposed in Lowell and Lowell's and a much larger class shows that all such  schemes are provably insecure, provided that one has arbitrarily large amounts of entanglement  and is able to teleport with perfect efficiency.  This is Boorman, Chandran, Fair and co-authors.  I think it's a really very beautiful no-go theorem, which itself relies on very beautiful  early ideas by Lev Weidman on local quantum measurements and their implementation.  I have a list of references here.  The thing I wanted to come back to is that because I think it's not as yet as much appreciated  it should be, is that this result, this no-go theorem, very much crucially depends on the  details of the security model.  If you think of a very slightly different question, can I authenticate the position of  a tag that's some sort of object out there that is able to keep hold some classical data  stream and keep that secure?  If that data stream is shared by the verifiers who are sitting remotely and exchanging information,  then it changes things completely.  One can have secure quantum tagging.  One can have it, in fact, quite easily.  The security follows directly from the security of quantum key distribution and the no-superluminal  signaling principle.  This is a very plausibly the basis of a useful future technology, to my mind.  I've ordered this information in one of a number of possible ways because I wanted to  focus first on the cryptographic problem.  Let me, let's remember the original question was in this discussion about authentication  of position, was whether we can verify whether a state lies in a particular region using  remote queries, and the original protocol we tried failed to get a reliable way of verifying  that.  We saw that the state could be, so to speak, delocalized around the region by teleportations.  That's a problem for such schemes, at least in principle.  It's a problem that produces beautiful theoretical results, and we shouldn't be too unhappy.  It also raises a general question, what are the constraints on producing an unknown state  when it's requested?  Although it's not directly cryptographic, I think you'll agree it already turned out  to be very cryptographically relevant.  I wanted to just review a very simple example of a constraint on the possibility of producing  an unknown state.  What I mentioned earlier, the no-summoning theorem.  So I, what is this thing called summoning?  It's a task involving two agencies, Alice and Bob.  So again, Alice has many representatives.  They're all collaborating, they all trust each other, they distribute you space and  time.  Bob, likewise.  Alice, let's say, prepares a state that Bob doesn't know and hands it over to him at  a point P. At some point Q, and it's going to be in the course of future of P otherwise,  it's clear that Bob has no chance.  Alice is going to summon the state.  She's going to ask him to return it to her.  One of the reasons I find this an interesting task is that it distinguishes between relativistic  quantum mechanics and other theories.  So if we were talking about quantum mechanics in Galilean space time, it's very easy to  see Bob can comply.  If we were talking about classical mechanics in Mckowski space time, it's very easy to  see Bob can comply.  But in the case we're actually interested in, what's pretty much the real world, quantum  states in Mckowski space time, he can't.  So just to review that, classical theories in Mckowski space, it's given an unknown  classical state.  Well, he could just broadcast the information about that state everywhere.  So when he's asked for it back at Q, he returns it at Q.  Non-religious quantum mechanics, he could just hold the state here, use the fact that  there's no bound on signal speed.  So when he's asked for it at Q, he sends a classical signal saying, I need it over  at Q, instantaneously, and he can send the quantum state instantaneously back to Q.  In relativistic quantum theory, he can't do the first because he'd have to clone the  state, and he can't do the second because he'd have to send information superluminally  between these two points.  So neither of those strategies works, and more generally, I don't think I really need  even to convince you, no signaling, cloning plus no signaling allows you to prove very  simply that whatever strategy he follows, in general he's not going to be able to satisfy  with a summons if he has no information in advance about the point at which the summons  is going to be made.  You might just for a moment at least contemplate the possibility that this is a feature of the  idealization of the task.  We've asked that Bob receive a summons and instantaneously return the state.  That's pretty unreasonable in the real world.  You should maybe give him a little bit of time and space to do it.  You might also give him a little bit of a margin of error, say that it's going to be  okay if he returns something that's very nearly at the state.  That's fidelity one minus epsilon to the state.  In the cases non-relativistic quantum mechanics or relativistic classical mechanics, that  means not just that ideally he can comply, but realistically with the reasonable technology  he could comply.  But it doesn't change the picture in relativistic quantum mechanics.  There are non-trivial bounds on the fidelity of approximate cloning.  And even when we talk about realistic implementations rather than idealizations, the conclusion  that he survives, there's not even an approximate summoning is not possible in relativistic  quantum theory for any reasonable degree of approximation.  We can quantify that.  But the bounds really follow directly from the bounds of the approximate cloning.  I'm going to skip that and wind up here.  So I do very much appreciate being able to talk to you about this.  I think perhaps for a long time relativistic quantum cryptography was seen by many people  as a somewhat esoteric sort of niche subject of intellectual interest, but not necessarily  practical interest.  But I believe it is now developing into a major field, and so right.  We have direct applications that I've already reviewed, to bit commitment, to quantum tagging  and possession authentication, the beautiful general subject of position-based quantum  cryptography that Boorman, Chandram and collaborators have been developing.  A slightly weird task called location oblivious quantum data transfer, which I haven't talked  about, which maybe is useful for something.  Secure coin tossing protocols, including coin tossings in which the users are allowed  to vary the biases within prescribed limits.  But Roger Colbert and I described some time ago.  There's also been a direct interplay and flow of ideas from relativistic quantum cryptographic  protocols to the field of device-independent quantum cryptography, starting with the whole  idea of a basic key distribution on the no signaling principle.  I'm becoming more and more confident that we will see future technologies being built  using quite a few of these ideas.  And I'm also certain this is still a very much an underexplored field.  I've given a personal perspective and I've given some tasks that I've taken a personal  interest in, but I think there's a great deal out there awaiting discovery.  I think even the framework that I've set out, although I find it useful and maybe is adequate,  is not necessarily the only interesting way of thinking about relativistic quantum cryptography,  and there's a lot of scope for other ideas there also.  And in short, there's a wealth, I think, of new cryptographic ideas awaiting discovery  along with new perspectives.  Just sorry, let me just go back one.  Indeed, as I understand it, the next talk is going to give a different perspective on  some of the ideas that I've touched on here.  Richard Feynman always used to stress that you don't really understand the subject if  you only have one way of thinking about it.  You learn much more.  The more different ways you have of thinking about it, the more different languages, different  mathematics, different ways of doing calculations, and I'm sure that's true here, so I'm very  much looking forward to the next presentation.  And with that, I wanted to close.  Thank you very much for your attention.  We have about five minutes for questions, and so if anyone has any questions, this is  the last one.  Hi.  So in reality, you sort of only have a small diameter in which Alice and Bob can move about  if we're going to try and use this bit commitment scheme.  And so is there some way, it seems possible a priori, that you could do a commitment that  only gets revealed in say a year, even though you're only allowed to move around in a space  region that has a diameter of like one second.  Do you know if such schemes exist, or is it known to be possible, impossible?  So I'm not sure I've understood.  Is your idea something like this, that Alice and Bob are constrained to the surface of the  earth or something like that?  Yeah, yeah, so it seems like clearly they can do a commitment that gets revealed in half  a second or whatever, or 100th of a second, but can they do one that gets revealed in  a year?  Yes, that's a good question.  The natural thing to try would be to chain together sequences of these commitments.  When you do that, at least naively, you risk, you may produce something that's theoretically  secure but blows up the amount of information each time you add another step to the chain.  You need more and more committed information because each commitment is committing data  from previous commitment.  So there are ways that you could try to deal with that problem as well.  There was an analogous problem actually in the classical schemes that I described earlier,  and it turns out there you can get away with a constant information exchange rather than  exponentially growing one.  But these are questions that I haven't resolved.  They're things I'm interested in exploring, so I can't give you a straight answer right  now.  Thank you.  Other questions?  I actually have a quick one.  For the bit commitment scheme that you proposed involving the BB84 states, have you thought  at all about if someone actually wanted to build this thing, what kinds of tolerances  and what kinds of distances over which one would need to build this apparatus would be  necessary?  I thought a little.  The best thing to say I think is the Geneva Group are trying to implement this scheme  and believe they should be able to do it.  They hope they should be able to do it within the next year.  So I look forward with interest to seeing the results of that.  Yes, I'm not an engineer, so I'm giving you precise figures is probably going beyond my  remit here.  My question will clearly prove that I did not understand your scheme.  I ideally wish I would, but let me ask anyways.  The bit commitment scheme, is it of a fixed duration or can it be open at any time in  the future that Alice chooses?  It can be open at any points on the light.  She has to unveil at two points on different light rays.  She could choose those points on the light ray.  But of course the light ray is not.  Does she need to choose these points in advance or does it require these agents to move at  the speed of light?  Well, you don't have to think of the agents moving at the speed of light.  She could have a network of agents already in place and send information.  No, she doesn't have to choose in advance the points on the light ray.  At the time she commits, she does not, at that time, need to know when she will open  it, right?  Right.  But at the same time, let me stress, she's obviously strongly constrained by the geometry,  the geometry rather.  She's only able to open it at a point where she has an agent on the light ray.  She could have a long chain of agents on the light ray and they could decide.  And Bob need not know where these points are.  Well he's got to be able to receive the data from her pretty much.  So that you don't, pretty quickly, to ensure that.  So, he, so, so, roughly speaking, he, sorry, Bob needs to have an agent near each of Alice's  agents.  Roughly speaking.  Yes.  I'll get in now.  Thank you.  All right, I think we're out of time for this presentation.  So let's thank Adrian again and move on to the next talk.
Quantum_cryptography_in_Minkowski_space_0_359.png Quantum_cryptography_in_Minkowski_space_360_683.png Quantum_cryptography_in_Minkowski_space_684_887.png Quantum_cryptography_in_Minkowski_space_888_1295.png Quantum_cryptography_in_Minkowski_space_1296_5615.png Quantum_cryptography_in_Minkowski_space_5616_6395.png Quantum_cryptography_in_Minkowski_space_6396_6647.png Quantum_cryptography_in_Minkowski_space_6648_8459.png Quantum_cryptography_in_Minkowski_space_8460_9731.png Quantum_cryptography_in_Minkowski_space_9732_10163.png Quantum_cryptography_in_Minkowski_space_10164_11531.png Quantum_cryptography_in_Minkowski_space_11532_12131.png Quantum_cryptography_in_Minkowski_space_12132_12695.png Quantum_cryptography_in_Minkowski_space_12696_17123.png Quantum_cryptography_in_Minkowski_space_17124_20303.png Quantum_cryptography_in_Minkowski_space_20304_22847.png Quantum_cryptography_in_Minkowski_space_22848_24011.png Quantum_cryptography_in_Minkowski_space_24012_26891.png Quantum_cryptography_in_Minkowski_space_26892_27167.png Quantum_cryptography_in_Minkowski_space_27168_37835.png Quantum_cryptography_in_Minkowski_space_37836_40247.png Quantum_cryptography_in_Minkowski_space_40248_41555.png Quantum_cryptography_in_Minkowski_space_41556_41639.png Quantum_cryptography_in_Minkowski_space_41640_42899.png Quantum_cryptography_in_Minkowski_space_42900_43127.png Quantum_cryptography_in_Minkowski_space_43128_48599.png Quantum_cryptography_in_Minkowski_space_48600_51203.png Quantum_cryptography_in_Minkowski_space_51204_51803.png Quantum_cryptography_in_Minkowski_space_51804_52859.png Quantum_cryptography_in_Minkowski_space_52860_56423.png Quantum_cryptography_in_Minkowski_space_56424_62975.png Quantum_cryptography_in_Minkowski_space_62976_63083.png Quantum_cryptography_in_Minkowski_space_63084_63203.png Quantum_cryptography_in_Minkowski_space_63204_66539.png Quantum_cryptography_in_Minkowski_space_66540_67523.png Quantum_cryptography_in_Minkowski_space_67524_68195.png Quantum_cryptography_in_Minkowski_space_68196_69035.png Quantum_cryptography_in_Minkowski_space_69036_70355.png Quantum_cryptography_in_Minkowski_space_70356_70583.png Quantum_cryptography_in_Minkowski_space_70584_72431.png Quantum_cryptography_in_Minkowski_space_72432_72875.png Quantum_cryptography_in_Minkowski_space_72876_73115.png Quantum_cryptography_in_Minkowski_space_73116_75023.png Quantum_cryptography_in_Minkowski_space_75024_75403.png