02172nas a2200133 4500008004100000245008500041210006900126260001500195520173200210100002401942700001701966700001801983856003702001 2023 eng d00aEvaluating the security of CRYSTALS-Dilithium in the quantum random oracle model0 aEvaluating the security of CRYSTALSDilithium in the quantum rand c12/17/20233 a

In the wake of recent progress on quantum computing hardware, the National Institute of Standards and Technology (NIST) is standardizing cryptographic protocols that are resistant to attacks by quantum adversaries. The primary digital signature scheme that NIST has chosen is CRYSTALS-Dilithium. The hardness of this scheme is based on the hardness of three computational problems: Module Learning with Errors (MLWE), Module Short Integer Solution (MSIS), and SelfTargetMSIS. MLWE and MSIS have been well-studied and are widely believed to be secure. However, SelfTargetMSIS is novel and, though classically as hard as MSIS, its quantum hardness is unclear. In this paper, we provide the first proof of the hardness of SelfTargetMSIS via a reduction from MLWE in the Quantum Random Oracle Model (QROM). Our proof uses recently developed techniques in quantum reprogramming and rewinding. A central part of our approach is a proof that a certain hash function, derived from the MSIS problem, is collapsing. From this approach, we deduce a new security proof for Dilithium under appropriate parameter settings. Compared to the only other rigorous security proof for a variant of Dilithium, Dilithium-QROM, our proof has the advantage of being applicable under the condition q = 1 mod 2n, where q denotes the modulus and n the dimension of the underlying algebraic ring. This condition is part of the original Dilithium proposal and is crucial for the efficient implementation of the scheme. We provide new secure parameter sets for Dilithium under the condition q = 1 mod 2n, finding that our public key sizes and signature sizes are about 2.5 to 2.8 times larger than those of Dilithium-QROM for the same security levels.

1 aJackson, Kelsey, A.1 aMiller, Carl1 aWang, Daochen uhttps://arxiv.org/abs/2312.1661901505nas a2200205 4500008004100000245006200041210006100103260001500164520083500179653003801014653003401052653004301086653002701129653003101156100002301187700001701210700001701227700001801244856003701262 2022 eng d00aLattice-Based Quantum Advantage from Rotated Measurements0 aLatticeBased Quantum Advantage from Rotated Measurements c10/18/20223 a

Trapdoor claw-free functions (TCFs) are immensely valuable in cryptographic interactions between a classical client and a quantum server. Typically, a protocol has the quantum server prepare a superposition of two-bit strings of a claw and then measure it using Pauli-X or Z measurements. In this paper, we demonstrate a new technique that uses the entire range of qubit measurements from the XY-plane. We show the advantage of this approach in two applications. First, building on (Brakerski et al. 2018, Kalai et al. 2022), we show an optimized two-round proof of quantumness whose security can be expressed directly in terms of the hardness of the LWE (learning with errors) problem. Second, we construct a one-round protocol for blind remote preparation of an arbitrary state on the XY-plane up to a Pauli-Z correction.

10aCryptography and Security (cs.CR)10aEmerging Technologies (cs.ET)10aFOS: Computer and information sciences10aFOS: Physical sciences10aQuantum Physics (quant-ph)1 aAlnawakhtha, Yusuf1 aMantri, Atul1 aMiller, Carl1 aWang, Daochen uhttps://arxiv.org/abs/2210.1014300379nas a2200133 4500008004100000022001400041245004500055210004000100260001200140300001400152490000700166100001700173856005500190 2022 eng d a0002-992000aThe Mathematics of Quantum Coin-Flipping0 aMathematics of Quantum CoinFlipping c12/2022 a1908-19170 v691 aMiller, Carl uhttps://www.ams.org/notices/202211/rnoti-p1908.pdf02774nas a2200241 4500008004100000245009900041210006900140260001100209520197600220100001902196700001702215700001802232700001602250700001602266700001702282700002202299700001702321700001802338700001802356700001702374700002102391856012002412 2022 eng d00aStatus Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process0 aStatus Report on the Third Round of the NIST PostQuantum Cryptog c7/20223 a

The National Institute of Standards and Technology is in the process of selecting publickey cryptographic algorithms through a public, competition-like process. The new publickey cryptography standards will specify additional digital signature, public-key encryption, and key-establishment algorithms to augment Federal Information Processing Standard (FIPS) 186-4, Digital Signature Standard (DSS), as well as NIST Special Publication (SP) 800-56A Revision 3, Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography, and SP 800-56B Revision 2, Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography. It is intended that these algorithms will be capable of protecting sensitive information well into the foreseeable future, including after the advent of quantum computers.

This report describes the evaluation and selection process of the NIST Post-Quantum Cryptography Standardization process third-round candidates based on public feedback and internal review. The report summarizes each of the 15 third-round candidate algorithms and identifies those selected for standardization, as well as those that will continue to be evaluated in a fourth round of analysis. The public-key encryption and key-establishment algorithm that will be standardized is CRYSTALS–KYBER. The digital signatures that will be standardized are CRYSTALS–Dilithium, FALCON, and SPHINCS+. While there are multiple signature algorithms selected, NIST recommends CRYSTALS–Dilithium as the primary algorithm to be implemented. In addition, four of the alternate key-establishment candidate algorithms will advance to a fourth round of evaluation: BIKE, Classic McEliece, HQC, and SIKE. These candidates are still being considered for future standardization. NIST will also issue a new Call for Proposals for public-key digital signature algorithms to augment and diversify its signature portfolio.

1 aAlagic, Gorjan1 aApon, Daniel1 aCooper, David1 aDang, Quynh1 aDang, Thinh1 aKelsey, John1 aLichtinger, Jacob1 aMiller, Carl1 aMoody, Dustin1 aPeralta, Rene1 aPerlner, Ray1 aRobinson, Angela uhttps://quics.umd.edu/publications/status-report-third-round-nist-post-quantum-cryptography-standardization-process00560nas a2200133 4500008004100000022001400041245003000055210003000085260001400115520019700129100002300326700001700349856006000366 2022 eng d a1745-247300aWhere we are with quantum0 aWhere we are with quantum c4/28/20223 a

A theoretical analysis shows how a person’s location in space could be verified by the transmission of single photons. A vital application of quantum networks may be within reach.

1 aAlnawakhtha, Yusuf1 aMiller, Carl uhttps://quics.umd.edu/publications/where-we-are-quantum01577nas a2200133 4500008004100000245008200041210006900123260001400192520114500206100001601351700001701367700002201384856003701406 2021 eng d00aThe membership problem for constant-sized quantum correlations is undecidable0 amembership problem for constantsized quantum correlations is und c1/26/20213 a

When two spatially separated parties make measurements on an unknown entangled quantum state, what correlations can they achieve? How difficult is it to determine whether a given correlation is a quantum correlation? These questions are central to problems in quantum communication and computation. Previous work has shown that the general membership problem for quantum correlations is computationally undecidable. In the current work we show something stronger: there is a family of constant-sized correlations -- that is, correlations for which the number of measurements and number of measurement outcomes are fixed -- such that solving the quantum membership problem for this family is computationally impossible. Thus, the undecidability that arises in understanding Bell experiments is not dependent on varying the number of measurements in the experiment. This places strong constraints on the types of descriptions that can be given for quantum correlation sets. Our proof is based on a combination of techniques from quantum self-testing and from undecidability results of the third author for linear system nonlocal games.

1 aFu, Honghao1 aMiller, Carl1 aSlofstra, William uhttps://arxiv.org/abs/2101.1108701465nas a2200265 4500008004100000245006700041210006500108260001500173490000800188520070100196100001800897700002200915700002500937700002400962700002500986700001801011700002101029700002001050700002501070700001601095700001701111700001501128700001901143856003701162 2020 eng d00aExperimental Low-Latency Device-Independent Quantum Randomness0 aExperimental LowLatency DeviceIndependent Quantum Randomness c12/24/20190 v1243 a

Applications of randomness such as private key generation and public randomness beacons require small blocks of certified random bits on demand. Device-independent quantum random number generators can produce such random bits, but existing quantum-proof protocols and loophole-free implementations suffer from high latency, requiring many hours to produce any random bits. We demonstrate device-independent quantum randomness generation from a loophole-free Bell test with a more efficient quantum-proof protocol, obtaining multiple blocks of 512 bits with an average experiment time of less than 5 min per block and with certified error bounded by 2−64≈5.42×10−20.

1 aZhang, Yanbao1 aShalm, Lynden, K.1 aBienfang, Joshua, C.1 aStevens, Martin, J.1 aMazurek, Michael, D.1 aNam, Sae, Woo1 aAbellán, Carlos1 aAmaya, Waldimar1 aMitchell, Morgan, W.1 aFu, Honghao1 aMiller, Carl1 aMink, Alan1 aKnill, Emanuel uhttps://arxiv.org/abs/1812.0778601227nas a2200121 4500008004100000245006200041210005800103260001100161300001200172520081200184100001700996856009201013 2020 eng d00aThe impossibility of efficient quantum weak coin flipping0 aimpossibility of efficient quantum weak coin flipping c6/2020 a916-9293 a

How can two parties with competing interests carry out a fair coin flip across a quantum communication channel? This problem (quantum weak coin-flipping) was formalized more than 15 years ago, and, despite some phenomenal theoretical progress, practical quantum coin-flipping protocols with vanishing bias have proved hard to find. In the current work we show that there is a reason that practical weak quantum coin-flipping is difficult: any quantum weak coin-flipping protocol with bias є must use at least exp( Ω (1/√є )) rounds of communication. This is a large improvement over the previous best known lower bound of Ω ( log log(1/є )) due to Ambainis from 2004. Our proof is based on a theoretical construction (the two-variable profile function) which may find further applications.

1 aMiller, Carl uhttps://quics.umd.edu/publications/impossibility-efficient-quantum-weak-coin-flipping-001468nas a2200157 4500008004100000245005700041210005600098260001200154300001400166490000700180520103700187100001601224700001701240700001601257856003701273 2020 eng d00aParallel Device-Independent Quantum Key Distribution0 aParallel DeviceIndependent Quantum Key Distribution c09/2020 a5567-55840 v663 a

A prominent application of quantum cryptography is the distribution of cryptographic keys that are provably secure. Such security proofs were extended by Vazirani and Vidick ( Physical Review Letters , 113, 140501, 2014) to the device-independent (DI) scenario, where the users do not need to trust the integrity of the underlying quantum devices. The protocols analyzed by them and by subsequent authors all require a sequential execution of N multiplayer games, where N is the security parameter. In this work, we prove the security of a protocol where all games are executed in parallel. Besides decreasing the number of time-steps necessary for key generation, this result reduces the security requirements for DI-QKD by allowing arbitrary information leakage of each user’s inputs within his or her lab. To the best of our knowledge, this is the first parallel security proof for a fully device-independent QKD protocol. Our protocol tolerates a constant level of device imprecision and achieves a linear key rate.

1 aJain, Rahul1 aMiller, Carl1 aShi, Yaoyun uhttps://arxiv.org/abs/1703.0542603206nas a2200253 4500008004100000245010000041210006900141260001200210520236500222100001902587700002702606700001702633700001802650700001602668700001702684700001602701700001702717700001802734700001802752700001702770700002102787700002302808856012102831 2020 eng d00aStatus Report on the Second Round of the NIST Post-Quantum Cryptography Standardization Process0 aStatus Report on the Second Round of the NIST PostQuantum Crypto c07/20203 a

The National Institute of Standards and Technology is in the process of selecting one or more public-key cryptographic algorithms through a public, competition-like process. The new public-key cryptography standards will specify one or more additional digital signatures, public-key encryption, and key-establishment algorithms to augment Federal Information Processing Standard (FIPS) 186-4, Digital Signature Standard (DSS), as well as NIST Special Publication (SP) 800-56A Revision 3, Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography, and SP 800-56B Revision 2, Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography. It is intended that these algorithms will be capable of protecting sensitive information well into the foreseeable future, including after the advent of quantum computers.

The NIST Post-Quantum Cryptography Standardization Process began in 2017 with 69 candidate algorithms that met both the minimum acceptance criteria and submission requirements. The first round lasted until January 2019, during which candidate algorithms were evaluated based on their security, performance, and other characteristics. NIST selected 26 algorithms to advance to the second round for more analysis. This report describes the evaluation and selection process, based on public feedback and internal review, of the second-round candidates. The report summarizes the 26 second-round candidate algorithms and identifies those selected to move forward to the third round of the competition. The third-round finalist public-key encryption and key-establishment algorithms are Classic McEliece, CRYSTALS-KYBER, NTRU, and SABER. The third-round finalists for digital signatures are CRYSTALS-DILITHIUM, FALCON, and Rainbow. These finalists will be considered for standardization at the end of the third round. In addition, eight alternate candidate algorithms will also advance to the third round: BIKE, FrodoKEM, HQC, NTRU Prime, SIKE, GeMSS, Picnic, and SPHINCS+. These additional candidates are still being considered for standardization, although this is unlikely to occur at the end of the third round. NIST hopes that the announcement of these finalists and additional candidates will serve to focus the cryptographic community’s attention during the next round.

1 aAlagic, Gorjan1 aAlperin-Sheriff, Jacob1 aApon, Daniel1 aCooper, David1 aDang, Quynh1 aKelsey, John1 aLiu, Yi-Kai1 aMiller, Carl1 aMoody, Dustin1 aPeralta, Rene1 aPerlner, Ray1 aRobinson, Angela1 aSmith-Tone, Daniel uhttps://quics.umd.edu/publications/status-report-second-round-nist-post-quantum-cryptography-standardization-process01242nas a2200145 4500008004100000245006500041210006400106260001500170490000600185520081100191100002101002700001701023700001901040856003701059 2019 eng d00aGraphical Methods in Device-Independent Quantum Cryptography0 aGraphical Methods in DeviceIndependent Quantum Cryptography c05/20/20190 v33 a

We introduce a framework for graphical security proofs in device-independent quantum cryptography using the methods of categorical quantum mechanics. We are optimistic that this approach will make some of the highly complex proofs in quantum cryptography more accessible, facilitate the discovery of new proofs, and enable automated proof verification. As an example of our framework, we reprove a recent result from device-independent quantum cryptography: any linear randomness expansion protocol can be converted into an unbounded randomness expansion protocol. We give a graphical exposition of a proof of this result and implement parts of it in the Globular proof assistant.

1 aBreiner, Spencer1 aMiller, Carl1 aRoss, Neil, J. uhttps://arxiv.org/abs/1705.0921301481nas a2200157 4500008004100000245006800041210006700109260001500176300001000191490000800201520102300209100002101232700001601253700001701269856003701286 2019 eng d00aParallel Self-Testing of the GHZ State with a Proof by Diagrams0 aParallel SelfTesting of the GHZ State with a Proof by Diagrams c01/29/2019 a43-660 v2873 a

Quantum self-testing addresses the following question: is it possible to verify the existence of a multipartite state even when one's measurement devices are completely untrusted? This problem has seen abundant activity in the last few years, particularly with the advent of parallel self-testing (i.e., testing several copies of a state at once), which has applications not only to quantum cryptography but also quantum computing. In this work we give the first error-tolerant parallel self-test in a three-party (rather than two-party) scenario, by showing that an arbitrary number of copies of the GHZ state can be self-tested. In order to handle the additional complexity of a three-party setting, we use a diagrammatic proof based on categorical quantum mechanics, rather than a typical symbolic proof. The diagrammatic approach allows for manipulations of the complicated tensor networks that arise in the proof, and gives a demonstration of the importance of picture-languages in quantum information.

1 aBreiner, Spencer1 aKalev, Amir1 aMiller, Carl uhttps://arxiv.org/abs/1806.0474402754nas a2200229 4500008004100000245009900041210006900140520205300209100001902262700002402281700001302305700001502318700001302333700001702346700001402363700001602377700001602393700001702409700001902426700001602445856006302461 2019 eng d00aStatus Report on the First Round of the NIST Post-Quantum Cryptography Standardization Process0 aStatus Report on the First Round of the NIST PostQuantum Cryptog3 a

The National Institute of Standards and Technology is in the process of selecting one or more
public-key cryptographic algorithms through a public competition-like process. The new publickey cryptography standards will specify one or more additional digital signature, public-key
encryption, and key-establishment algorithms to augment FIPS 186-4, Digital Signature Standard
(DSS), as well as special publications SP 800-56A Revision 2, Recommendation for Pair-Wise
Key Establishment Schemes Using Discrete Logarithm Cryptography, and SP 800-56B,
Recommendation for Pair-Wise Key-Establishment Schemes Using Integer Factorization. It is
intended that these algorithms will be capable of protecting sensitive information well into the
foreseeable future, including after the advent of quantum computers.
In November 2017, 82 candidate algorithms were submitted to NIST for consideration. Among
these, 69 met both the minimum acceptance criteria and our submission requirements, and were
accepted as First-Round Candidates on Dec. 20, 2017, marking the beginning of the First Round
of the NIST Post-Quantum Cryptography Standardization Process. This report describes the
evaluation criteria and selection process, based on public feedback and internal review of the
first-round candidates, and summarizes the 26 candidate algorithms announced on January 30,
2019 for moving forward to the second round of the competition. The 17 Second-Round
Candidate public-key encryption and key-establishment algorithms are BIKE, Classic McEliece,
CRYSTALS-KYBER, FrodoKEM, HQC, LAC, LEDAcrypt (merger of LEDAkem/LEDApkc),
NewHope, NTRU (merger of NTRUEncrypt/NTRU-HRSS-KEM), NTRU Prime, NTS-KEM,
ROLLO (merger of LAKE/LOCKER/Ouroboros-R), Round5 (merger of Hila5/Round2), RQC,
SABER, SIKE, and Three Bears. The 9 Second-Round Candidates for digital signatures are
CRYSTALS-DILITHIUM, FALCON, GeMSS, LUOV, MQDSS, Picnic, qTESLA, Rainbow,
and SPHINCS+.

1 aAlagic, Gorjan1 aAlperin-Sheriff, J.1 aApon, D.1 aCooper, D.1 aDang, Q.1 aMiller, Carl1 aMoody, D.1 aPeralta, R.1 aPerlner, R.1 aRobinson, A.1 aSmith-Tone, D.1 aLiu, Yi-Kai uhttps://nvlpubs.nist.gov/nistpubs/ir/2019/NIST.IR.8240.pdf01727nas a2200157 4500008004100000245004800041210004700089260001500136300001100151490000700162520129200169100001701461700001901478700001601497856005601513 2018 eng d00aKeyring models: an approach to steerability0 aKeyring models an approach to steerability c2018/01/02 a0221030 v593 a

If a measurement is made on one half of a bipartite system then, conditioned on the outcome, the other half has a new reduced state. If these reduced states defy classical explanation — that is, if shared randomness cannot produce these reduced states for all possible measurements — the bipartite state is said to be steerable. Determining which states are steerable is a challenging problem even for low dimensions. In the case of two-qubit systems a criterion is known for T-states (that is, those with maximally mixed marginals) under projective measurements. In the current work we introduce the concept of keyring models — a special class of local hidden state model. When the measurements made correspond to real projectors, these allow us to study steerability beyond T-states. Using keyring models, we completely solve the steering problem for real projective measurements when the state arises from mixing a pure two-qubit state with uniform noise. We also give a partial solution in the case when the uniform noise is replaced by independent depolarizing channels. Our results imply that Werner states, which are a special case of the previous states, are unsteerable under real projective measurements if and only if their efficiency is at most 2/π.

1 aMiller, Carl1 aColbeck, Roger1 aShi, Yaoyun uhttp://aip.scitation.org/doi/full/10.1063/1.500619901139nas a2200133 4500008004100000245004700041210004600088260001200134300001100146520077800157100001600935700001700951856003700968 2018 eng d00aLocal randomness: Examples and application0 aLocal randomness Examples and application c03/2018 a0323243 a

When two players achieve a superclassical score at a nonlocal game, their outputs must contain intrinsic randomness. This fact has many useful implications for quantum cryptography. Recently it has been observed [C. Miller and Y. Shi, Quantum Inf. Computat. 17, 0595 (2017)] that such scores also imply the existence of local randomness—that is, randomness known to one player but not to the other. This has potential implications for cryptographic tasks between two cooperating but mistrustful players. In the current paper we bring this notion toward practical realization, by offering near-optimal bounds on local randomness for the CHSH game, and also proving the security of a cryptographic application of local randomness (single-bit certified deletion).

1 aFu, Honghao1 aMiller, Carl uhttps://arxiv.org/abs/1708.0433801103nas a2200109 4500008004100000245008300041210006900124260001500193520073100208100001700939856003700956 2017 eng d00aAn Elementary Proof of Private Random Number Generation from Bell Inequalities0 aElementary Proof of Private Random Number Generation from Bell I c2017/07/203 a

The field of device-independent quantum cryptography has seen enormous success in the past several years, including security proofs for key distribution and random number generation that account for arbitrary imperfections in the devices used. Full security proofs in the field so far are long and technically deep. In this paper we show that the concept of the mirror adversary can be used to simplify device-independent proofs. We give a short proof that any bipartite Bell violation can be used to generate private random numbers. The proof is based on elementary techniques and is self-contained.

1 aMiller, Carl uhttps://arxiv.org/abs/1707.0659701545nas a2200145 4500008004100000245006100041210006100102260001500163300001400178490000700192520113000199100001701329700001601346856003701362 2017 eng d00aRandomness in nonlocal games between mistrustful players0 aRandomness in nonlocal games between mistrustful players c2017/06/15 a0595-06100 v173 a

If two quantum players at a nonlocal game G achieve a superclassical score, then their measurement outcomes must be at least partially random from the perspective of any third player. This is the basis for device-independent quantum cryptography. In this paper we address a related question: does a superclassical score at G guarantee that one player has created randomness from the perspective of the other player? We show that for complete-support games, the answer is yes: even if the second player is given the first player's input at the conclusion of the game, he cannot perfectly recover her output. Thus some amount of local randomness (i.e., randomness possessed by only one player) is always obtained when randomness is certified from nonlocal games with quantum strategies. This is in contrast to non-signaling game strategies, which may produce global randomness without any local randomness. We discuss potential implications for cryptographic protocols between mistrustful parties.

1 aMiller, Carl1 aShi, Yaoyun uhttps://arxiv.org/abs/1706.0498401315nas a2200145 4500008004100000245004100041210004100082260001500123300001100138490000600149520091300155100001601068700001701084856006801101 2017 eng d00aRigidity of the magic pentagram game0 aRigidity of the magic pentagram game c2017/11/02 a0150020 v33 a

A game is rigid if a near-optimal score guarantees, under the sole assumption of the validity of quantum mechanics, that the players are using an approximately unique quantum strategy. Rigidity has a vital role in quantum cryptography as it permits a strictly classical user to trust behavior in the quantum realm. This property can be traced back as far as 1998 (Mayers and Yao) and has been proved for multiple classes of games. In this paper we prove ridigity for the magic pentagram game, a simple binary constraint satisfaction game involving two players, five clauses and ten variables. We show that all near-optimal strategies for the pentagram game are approximately equivalent to a unique strategy involving real Pauli measurements on three maximally-entangled qubit pairs.

1 aKalev, Amir1 aMiller, Carl uhttp://iopscience.iop.org/article/10.1088/2058-9565/aa931d/meta01611nas a2200133 4500008004100000245008000041210006900121260001500190490000700205520118300212100001701395700001601412856004901428 2017 eng d00aUniversal Security for Randomness Expansion from the Spot-Checking Protocol0 aUniversal Security for Randomness Expansion from the SpotCheckin c2017/08/010 v463 a

Colbeck (Thesis, 2006) proposed using Bell inequality violations to generate certified random numbers. While full quantum-security proofs have been given, it remains a major open problem to identify the broadest class of Bell inequalities and lowest performance requirements to achieve such security. In this paper, working within the broad class of spot-checking protocols, we prove exactly which Bell inequality violations can be used to achieve full security. Our result greatly improves the known noise tolerance for secure randomness expansion: for the commonly used CHSH game, full security was only known with a noise tolerance of 1.5%, and we improve this to 10.3%. We also generalize our results beyond Bell inequalities and give the first security proof for randomness expansion based on Kochen-Specker inequalities. The central technical contribution of the paper is a new uncertainty principle for the Schatten norm, which is based on the uniform convexity inequality of Ball, Carlen, and Lieb (Inventiones mathematicae, 115:463-482, 1994).

1 aMiller, Carl1 aShi, Yaoyun uhttp://epubs.siam.org/doi/10.1137/15M104433302103nas a2200229 4500008004100000022001400041245010900055210006900164260001500233300001700248490000700265520140200272653002101674653001901695653001201714653002501726653002901751653002101780100001701801700001601818856003901834 2016 eng d a0004-541100aRobust Protocols for Securely Expanding Randomness and Distributing Keys Using Untrusted Quantum Devices0 aRobust Protocols for Securely Expanding Randomness and Distribut c2016/10/26 a33:1–33:630 v633 a

Randomness is a vital resource for modern-day information processing, especially for cryptography. A wide range of applications critically rely on abundant, high-quality random numbers generated securely. Here, we show how to expand a random seed at an exponential rate without trusting the underlying quantum devices. Our approach is secure against the most general adversaries, and has the following new features: cryptographic level of security, tolerating a constant level of imprecision in devices, requiring only unit size quantum memory (for each device component) in an honest implementation, and allowing a large natural class of constructions for the protocol. In conjunction with a recent work by Chung et al. [2014], it also leads to robust unbounded expansion using just 2 multipart devices. When adapted for distributing cryptographic keys, our method achieves, for the first time, exponential expansion combined with cryptographic security and noise tolerance. The proof proceeds by showing that the Rényi divergence of the outputs of the protocol (for a specific bounding operator) decreases linearly as the protocol iterates. At the heart of the proof are a new uncertainty principle on quantum measurements and a method for simulating trusted measurements with untrusted devices.

10akey distribution10anonlocal games10aprivacy10aquantum cryptography10arandom-number generation10auntrusted device1 aMiller, Carl1 aShi, Yaoyun uhttp://doi.acm.org/10.1145/288549301475nas a2200145 4500008004100000022001400041245007300055210006900128260001500197300001200212490000600224520104100230100001701271856004101288 2013 eng d a1551-305X00aEvasiveness of Graph Properties and Topological Fixed-Point Theorems0 aEvasiveness of Graph Properties and Topological FixedPoint Theor c2013/05/16 a337-4150 v73 a

Many graph properties (e.g., connectedness, containing a complete subgraph) are known to be difficult to check. In a decision-tree model, the cost of an algorithm is measured by the number of edges in the graph that it queries. R. Karp conjectured in the early 1970s that all monotone graph properties are evasive -- that is, any algorithm which computes a monotone graph property must check all edges in the worst case. This conjecture is unproven, but a lot of progress has been made. Starting with the work of Kahn, Saks, and Sturtevant in 1984, topological methods have been applied to prove partial results on the Karp conjecture. This text is a tutorial on these topological methods. I give a fully self-contained account of the central proofs from the paper of Kahn, Saks, and Sturtevant, with no prior knowledge of topology assumed. I also briefly survey some of the more recent results on evasiveness.

1 aMiller, Carl uhttp://dx.doi.org/10.1561/040000005503288nas a2200169 4500008004100000245006700041210006500108260001500173300001100188490000700199520278500206100002002991700001703011700001603028700001903044856005503063 2013 eng d00aOptimal entanglement-assisted one-shot classical communication0 aOptimal entanglementassisted oneshot classical communication c2013/06/03 a0623010 v873 a

The one-shot success probability of a noisy classical channel for transmitting one classical bit is the optimal probability with which the bit can be successfully sent via a single use of the channel. Prevedel et al. [Phys. Rev. Lett. 106, 110505 (2011)] recently showed that for a specific channel, this quantity can be increased if the parties using the channel share an entangled quantum state. In this paper, we characterize the optimal entanglement-assisted protocols in terms of the radius of a set of operators associated with the channel. This characterization can be used to construct optimal entanglement-assisted protocols for a given classical channel and to prove the limits of such protocols. As an example, we show that the Prevedel et al. protocol is optimal for two-qubit entanglement. We also prove some tight upper bounds on the improvement that can be obtained from quantum and nonsignaling correlations.

1 aHemenway, Brett1 aMiller, Carl1 aShi, Yaoyun1 aWootters, Mary uhttp://link.aps.org/doi/10.1103/PhysRevA.87.06230101399nas a2200193 4500008004100000245006100041210006000102260007900162300001400241490000700255520072700262653001900989653002501008653002901033653001701062100001701079700001601096856009301112 2013 eng d00aOptimal robust self-testing by binary nonlocal XOR games0 aOptimal robust selftesting by binary nonlocal XOR games bSchloss Dagstuhl- Leibniz-Zentrum fur Informatik GmbH, Dagstuhl Publishing a254–2620 v223 a

Self-testing a quantum apparatus means verifying the existence of a certain quantum state as well as the effect of the associated measuring devices based only on the statistics of the measurement outcomes. Robust (i.e., error-tolerant) self-testing quantum apparatuses are critical building blocks for quantum cryptographic protocols that rely on imperfect or untrusted devices. We devise a general scheme for proving optimal robust self-testing properties for tests based on nonlocal binary XOR games. We offer some simplified proofs of known results on self-testing, and also prove some new results.

10anonlocal games10aquantum cryptography10aRandom number generation10aSelf-testing1 aMiller, Carl1 aShi, Yaoyun uhttps://quics.umd.edu/publications/optimal-robust-self-testing-binary-nonlocal-xor-games03224nas a2200205 4500008004100000022001400041245009700055210006900152260001500221300001400236490000700250520257700257653002302834653002602857653002802883100002002911700001702931700001602948856005402964 2011 eng d a1533-714600aDeciding Unitary Equivalence Between Matrix Polynomials and Sets of Bipartite Quantum States0 aDeciding Unitary Equivalence Between Matrix Polynomials and Sets c2001/09/01 a813–8190 v113 a

In this brief report, we consider the equivalence between two sets of m + 1 bipartite quantum states under local unitary transformations. For pure states, this problem corresponds to the matrix algebra question of whether two degree m matrix polynomials are unitarily equivalent; i.e. UAiV† = Bi for 0 ≤ i ≤ m where U and V are unitary and (Ai, Bi) are arbitrary pairs of rectangular matrices. We present a randomized polynomial-time algorithm that solves this problem with an arbitrarily high success probability and outputs transforming matrices U and V.

10amatrix polynomials10aSchwartz-Zippel lemma10aunitary transformations1 aChitambar, Eric1 aMiller, Carl1 aShi, Yaoyun uhttp://dl.acm.org/citation.cfm?id=2230936.223094207538nas a2200145 4500008004100000022001400041245006900055210006600124260001500190300001200205490000600217520708300223100001707306856006907323 2010 eng d a1937-065200aAn Euler–Poincaré bound for equicharacteristic étale sheaves0 aEuler–Poincaré bound for equicharacteristic étale sheaves c2010/01/14 a21 - 450 v43 a

The Grothendieck–Ogg–Shafarevich formula expresses the Euler characteristic of an étale sheaf on a characteristic-p curve in terms of local data. The purpose of this paper is to prove an equicharacteristic version of this formula (a bound, rather than an equality). This follows work of R. Pink.

The basis for the proof of this result is the characteristic-p Riemann–Hilbert correspondence, which is a functorial relationship between two different types of sheaves on a characteristic-p scheme. In the paper we prove a one-dimensional version of this correspondence, considering both local and global settings.

1 aMiller, Carl uhttp://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.648.358408283nas a2200169 4500008004100000022001300041245005100054210005100105260001500156300001100171490000700182520779500189100002007984700001708004700001608021856007608037 2010 eng d a0022248800aMatrix pencils and entanglement classification0 aMatrix pencils and entanglement classification c2010/01/01 a0722050 v513 a

Quantum entanglement plays a central role in quantum information processing. A main objective of the theory is to classify different types of entanglement according to their interconvertibility through manipulations that do not require additional entanglement to perform. While bipartite entanglement is well understood in this framework, the classification of entanglements among three or more subsystems is inherently much more difficult. In this paper, we study pure state entanglement in systems of dimension 2mn. Two states are considered equivalent if they can be reversibly converted from one to the other with a nonzero probability using only local quantum resources and classical communication (SLOCC). We introduce a connection between entanglement manipulations in these systems and the well-studied theory of matrix pencils. All previous attempts to study general SLOCC equivalence in such systems have relied on somewhat contrived techniques which fail to reveal the elegant structure of the problem that can be seen from the matrix pencil approach. Based on this method, we report the first polynomial-time algorithm for deciding when two2mstates are SLOCC equivalent. We then proceed to present a canonical form for all 2mstates based on the matrix pencil construction such that two states are equivalent if and only if they have the same canonical form. Besides recovering the previously known 26 distinct SLOCC equivalence classes in 23systems, we also determine the hierarchy between these classes.

1 aChitambar, Eric1 aMiller, Carl1 aShi, Yaoyun uhttp://scitation.aip.org/content/aip/journal/jmp/51/7/10.1063/1.345906906219nas a2200145 4500008004100000022001300041245011100054210006900165260001500234300001400249490000700263520571500270100001705985856007106002 2005 eng d a0040938300aExponential iterated integrals and the relative solvable completion of the fundamental group of a manifold0 aExponential iterated integrals and the relative solvable complet c2005/03/01 a351 - 3730 v443 a

We develop a class of integrals on a manifold M called exponential iterated integrals  , an extension of K.T. Chen's iterated integrals. It is shown that the matrix entries of any upper triangular representation of π1(M,x) can be expressed via these new integrals. The ring of exponential iterated integrals contains the coordinate rings for a class of universal representations, called the relative solvable completions   of π1(M,x). We consider exponential iterated integrals in the particular case of fibered knot complements, where the fundamental group always has a faithful relative solvable completion.

1 aMiller, Carl uhttp://www.sciencedirect.com/science/article/pii/S0040938304000795