arXiv subjects

Takeshi Koshiba

Publications and source records attributed to Takeshi Koshiba.

At least 19 recordsLinked to original sources

arXiv2023

Computing the quantum guesswork: a quadratic assignment problem

The quantum guesswork quantifies the minimum number of queries needed to guess the state of a quantum ensemble if one is allowed to query only one state at a time. Previous approaches to the computation of the guesswork were based on standard semi-definite programming techniques and therefore lead to approximated results. In contrast, we show that computing the quantum guesswork of qubit ensembles with uniform probability distribution corresponds to solving a quadratic assignment problem and we provide an algorithm that, upon the input of any qubit ensemble over a discrete ring, after finitely many steps outputs the exact closed-form expression of its guesswork. While in general the complexity of our guesswork-computing algorithm is factorial in the number of states, our main result consists of showing a more-than-quadratic speedup for symmetric ensembles, a scenario corresponding to the three-dimensional analog of the maximization version of the turbine-balancing problem. To find such symmetries, we provide an algorithm that, upon the input of any point set over a discrete ring, after finitely many steps outputs its exact symmetries. The complexity of our symmetries-finding algorithm is polynomial in the number of points. As examples, we compute the guesswork of regular and quasi-regular sets of qubit states.

quant-ph↗

arXiv2022

Guesswork of a quantum ensemble

The guesswork of a quantum ensemble quantifies the minimum number of guesses needed in average to correctly guess the state of the ensemble, when only one state can be queried at a time. Here, we derive analytical solutions of the guesswork problem subject to a finite set of conditions, including the analytical solution for any qubit ensemble with uniform probability distribution. As explicit examples, we compute the guesswork for any qubit regular polygonal and polyhedral ensemble.

quant-ph↗

arXiv2021

Perfectly Secure Message Transmission against Rational Adversaries

Secure Message Transmission (SMT) is a two-party cryptographic protocol by which the sender can securely and reliably transmit messages to the receiver using multiple channels. An adversary can corrupt a subset of the channels and commit eavesdropping and tampering attacks over the channels. In this work, we introduce a game-theoretic security model for SMT in which adversaries have some preferences for protocol execution. We define rational "timid" adversaries who prefer to violate security requirements but do not prefer the tampering to be detected. First, we consider the basic setting where a single adversary attacks the protocol. We construct perfect SMT protocols against any rational adversary corrupting all but one of the channels. Since minority corruption is required in the traditional setting, our results demonstrate a way of circumventing the cryptographic impossibility results by a game-theoretic approach. Next, we study the setting in which all the channels can be corrupted by multiple adversaries who do not cooperate. Since we cannot hope for any security if a single adversary corrupts all the channels or multiple adversaries cooperate maliciously, the scenario can arise from a game-theoretic model. We also study the scenario in which both malicious and rational adversaries exist.

cs.CR↗

arXiv2019

Verifiable Quantum Secure Modulo Summation

We propose a new cryptographic task, which we call verifiable quantum secure modulo summation. Secure modulo summation is a calculation of modulo summation $Y_1+\ldots+ Y_m$ when $m$ players have their individual variables $Y_1,\ldots, Y_m$ with keeping the secrecy of the individual variables. However, the conventional method for secure modulo summation uses so many secret communication channels. We say that a quantum protocol for secure modulo summation is quantum verifiable secure modulo summation when it can verify the desired secrecy condition. If we combine device independent quantum key distribution, it is possible to verify such secret communication channels. However, it consumes so many steps. To resolve this problem, using quantum systems, we propose a more direct method to realize secure modulo summation with verification. To realize this protocol, we propose modulo zero-sum randomness as another new concept, and show that secure modulo summation can be realized by using modulo zero-sum randomness. Then, we construct a verifiable quantum protocol method to generate modulo zero-sum randomness. This protocol can be verified only with minimum requirements.

quant-ph↗

arXiv2019

Impossibility of perfectly-secure one-round delegated quantum computing for classical client

Blind quantum computing protocols enable a client, who can generate or measure single-qubit states, to delegate quantum computing to a remote quantum server protecting the client's privacy (i.e., input, output, and program). With current technologies, generations or measurements of single-qubit states are not too much burden for the client. In other words, secure delegated quantum computing is possible for "almost classical" clients. However, is it possible for a "completely classical" client? Here we consider a one-round perfectly-secure delegated quantum computing, and show that the protocol cannot satisfy both the correctness (i.e., the correct result is obtained when the server is honest) and the perfect blindness (i.e., the client's privacy is completely protected) simultaneously unless BQP is in NP. Since BQP is not believed to be in NP, the result suggests the impossibility of the one-round perfectly-secure delegated quantum computing.

quant-ph↗

arXiv2018

Universal Construction of Cheater-Identifiable Secret Sharing Against Rushing Cheaters Based on Message Authentication

For conventional secret sharing, if cheaters can submit possibly forged shares after observing shares of the honest users in the reconstruction phase then they cannot only disturb the protocol but also only they may reconstruct the true secret. To overcome the problem, secret sharing scheme with properties of cheater-identification have been proposed. Existing protocols for cheater-identifiable secret sharing assumed non-rushing cheaters or honest majority. In this paper, we remove both conditions simultaneously, and give its universal construction from any secret sharing scheme. To resolve this end, we propose the concepts of "individual identification" and "agreed identification".

cs.CR↗

arXiv2017

Fourier-based Function Secret Sharing with General Access Structure

Function secret sharing (FSS) scheme is a mechanism that calculates a function f(x) for x in {0,1}^n which is shared among p parties, by using distributed functions f_i:{0,1}^n -> G, where G is an Abelian group, while the function f:{0,1}^n -> G is kept secret to the parties. Ohsawa et al. in 2017 observed that any function f can be described as a linear combination of the basis functions by regarding the function space as a vector space of dimension 2^n and gave new FSS schemes based on the Fourier basis. All existing FSS schemes are of (p,p)-threshold type. That is, to compute f(x), we have to collect f_i(x) for all the distributed functions. In this paper, as in the secret sharing schemes, we consider FSS schemes with any general access structure. To do this, we observe that Fourier-based FSS schemes by Ohsawa et al. are compatible with linear secret sharing scheme. By incorporating the techniques of linear secret sharing with any general access structure into the Fourier-based FSS schemes, we show Fourier-based FSS schemes with any general access structure.

cs.CR↗

arXiv2017

Arbitrable Blind Quantum Computation

Blind quantum computation is a two-party protocol which involves a server Bob who has rich quantum computational resource and provides quantum computation service and a client Alice who wants to delegate her quantum computation to Bob without revealing her quantum algorithms and her input to (resp., output from) the algorithms. Since Bob may be truant and pretend to execute some computation, Alice wants to verify Bob's computation. Verifiable blind quantum computation enables Alice to check whether Bob is cheating or not. If Bob is cheating and claims his innocence, Alice can refute the denial of Bob's cheating but she cannot persuade any others that Bob is cheating. In this paper, we incorporate arbitrators as the third party into blind quantum computation to resolve the above problem and give an arbitrable blind quantum computation scheme.

quant-ph↗

arXiv2017

Non-Malleable Codes Against Affine Errors

Non-malleable code is a relaxed version of error-correction codes and the decoding of modified codewords results in the original message or a completely unrelated value. Thus, if an adversary corrupts a codeword then he cannot get any information from the codeword. This means that non-malleable codes are useful to provide a security guarantee in such situations that the adversary can overwrite the encoded message. In 2010, Dziembowski et al. showed a construction for non-malleable codes against the adversary who can falsify codewords bitwise independently. In this paper, we consider an extended adversarial model (affine error model) where the adversary can falsify codewords bitwise independently or replace some bit with the value obtained by applying an affine map over a limited number of bits. We prove that the non-malleable codes (for the bitwise error model) provided by Dziembowski et al. are still non-malleable against the adversary in the affine error model.

cs.CR↗

arXiv2014

Classical simulatability of the one clean qubit model

Deterministic quantum computation with one quantum bit (DQC1), or the one clean qubit model, [E. Knill and R. Laflamme, Phys. Rev. Lett. {\bf81}, 5672 (1998)] is a model of quantum computing where the input is the tensor product of a single pure qubit and many completely-mixed states, and only the single qubit is measured at the end of the computation. In spite of its naive appearance, the DQC1 model can efficiently solve some problems for which no classical efficient algorithms are known, and therefore it has been conjectured that the DQC1 model is more powerful than classical computing (under the assumption of $\mbox{BPP}\subsetneq\mbox{BQP}$). Here we show that the output probability distribution of the DQC1 model cannot be classically efficiently approximated (exactly within a polynomial bit length or in the fully polynomial randomized approximation scheme (FPRAS) with at most a constant error) unless $\mbox{BQP}\subseteq\mbox{BPP}$.

quant-ph↗

arXiv2014

Linear Programming Relaxations for Goldreich's Generators over Non-Binary Alphabets

Goldreich suggested candidates of one-way functions and pseudorandom generators included in $\mathsf{NC}^0$. It is known that randomly generated Goldreich's generator using $(r-1)$-wise independent predicates with $n$ input variables and $m=C n^{r/2}$ output variables is not pseudorandom generator with high probability for sufficiently large constant $C$. Most of the previous works assume that the alphabet is binary and use techniques available only for the binary alphabet. In this paper, we deal with non-binary generalization of Goldreich's generator and derives the tight threshold for linear programming relaxation attack using local marginal polytope for randomly generated Goldreich's generators. We assume that $u(n)\in ω(1)\cap o(n)$ input variables are known. In that case, we show that when $r\ge 3$, there is an exact threshold $μ_\mathrm{c}(k,r):=\binom{k}{r}^{-1}\frac{(r-2)^{r-2}}{r(r-1)^{r-1}}$ such that for $m=μ\frac{n^{r-1}}{u(n)^{r-2}}$, the LP relaxation can determine linearly many input variables of Goldreich's generator if $μ>μ_\mathrm{c}(k,r)$, and that the LP relaxation cannot determine $\frac1{r-2} u(n)$ input variables of Goldreich's generator if $μ<μ_\mathrm{c}(k,r)$. This paper uses characterization of LP solutions by combinatorial structures called stopping sets on a bipartite graph, which is related to a simple algorithm called peeling algorithm.

cs.CR↗

arXiv2013

Composable security of measuring-Alice blind quantum computation

Blind quantum computing [A. Broadbent, J. Fitzsimons, and E. Kashefi, Proceedings of the 50th Annual IEEE Symposium on Foundations of Computer Science 517 (2009)] is a secure cloud quantum computing protocol which enables a client (who does not have enough quantum technology at her disposal) to delegate her quantum computation to a server (who has a universal quantum computer) without leaking any relevant information to the server. In [T. Morimae and K. Fujii, Phys. Rev. A {\bf87}, 050301(R) (2013)], a new blind quantum computing protocol, so called the measuring-Alice protocol, was proposed. This protocol offers several advantages over previous protocols, such as the device-independent security, less demanding requirements for the client, and a simpler and stronger security based on the no-signaling principle. In this paper, we show composable security of the measuring-Alice protocol by using the formalism of the constructive cryptography [U. Maurer, Proceedings of Theory of Security and Applications, TOSCA 2011, pages 33-56. Springer (2011)]. The above advantages of measuring-Alice protocol enable more intuitive and transparent proofs for the composable security.

quant-ph↗

arXiv2013

Ancilla-Driven Universal Blind Quantum Computation

Blind quantum computation is a new quantum secure protocol, which enables Alice who does not have enough quantum technology to delegate her computation to Bob who has a fully-fledged quantum power without revealing her input, output and algorithm. So far, blind quantum computation has been considered only for the circuit model and the measurement-based model. Here we consider the possibility and the limitation of blind quantum computation in the ancilla-driven model, which is a hybrid of the circuit and the measurement-based models.

quant-ph↗

arXiv2011

Computational Indistinguishability between Quantum States and Its Cryptographic Application

We introduce a computational problem of distinguishing between two specific quantum states as a new cryptographic problem to design a quantum cryptographic scheme that is "secure" against any polynomial-time quantum adversary. Our problem, QSCDff, is to distinguish between two types of random coset states with a hidden permutation over the symmetric group of finite degree. This naturally generalizes the commonly-used distinction problem between two probability distributions in computational cryptography. As our major contribution, we show that QSCDff has three properties of cryptographic interest: (i) QSCDff has a trapdoor; (ii) the average-case hardness of QSCDff coincides with its worst-case hardness; and (iii) QSCDff is computationally at least as hard as the graph automorphism problem in the worst case. These cryptographic properties enable us to construct a quantum public-key cryptosystem, which is likely to withstand any chosen plaintext attack of a polynomial-time quantum adversary. We further discuss a generalization of QSCDff, called QSCDcyc, and introduce a multi-bit encryption scheme that relies on similar cryptographic properties of QSCDcyc.

quant-ph↗

arXiv2011

Non-Interactive Statistically-Hiding Quantum Bit Commitment from Any Quantum One-Way Function

We provide a non-interactive quantum bit commitment scheme which has statistically-hiding and computationally-binding properties from any quantum one-way function. Our protocol is basically a parallel composition of the previous non-interactive quantum bit commitment schemes (based on quantum one-way permutations, due to Dumais, Mayers and Salvail (EUROCRYPT 2000)) with pairwise independent hash functions. To construct our non-interactive quantum bit commitment scheme from any quantum one-way function, we follow the procedure below: (i) from Dumais-Mayers-Salvail scheme to a weakly-hiding and 1-out-of-2 binding commitment (of a parallel variant); (ii) from the weakly-hiding and 1-out-of-2 binding commitment to a strongly-hiding and 1-out-of-2 binding commitment; (iii) from the strongly-hiding and 1-out-of-2 binding commitment to a normal statistically-hiding commitment. In the classical case, statistically-hiding bit commitment scheme (by Haitner, Nguyen, Ong, Reingold and Vadhan (SIAM J. Comput., Vol.39, 2009)) is also constructible from any one-way function. While the classical statistically-hiding bit commitment has large round complexity, our quantum scheme is non-interactive, which is advantageous over the classical schemes. A main technical contribution is to provide a quantum analogue of the new interactive hashing theorem, due to Haitner and Reingold (CCC 2007). Moreover, the parallel composition enables us to simplify the security analysis drastically.

quant-ph↗

arXiv2010

A Weak Quantum Oblivious Transfer

Due to the commonly known impossibility results, information theoretic security is considered impossible for oblivious transfer (OT) in both the classical and the quantum world. In this paper, we proposed a weak version of the all-or-nothing OT. In our protocol the honest parties do not need long term quantum memory, entanglements, or sophisticated quantum computations. We observe some difference between the classical and quantum OT impossibilities.

quant-ph↗

arXiv2010

Asymptotically Secure Quantum Oblivious Transfer

Due to the commonly known impossibility results, unconditional security for oblivious transfer is seen as impossible even in the quantum world. In this paper, we try to overcome these impossibility results by proposing a protocol which is asymptotically secure. The protocol makes use of the basic properties of non-orthogonal quantum states. Apart from security, the advantages of our protocol include the fact that the honest players do not need to have quantum memory or create entanglement between individual qubits. The relation of our work to the known impossibility results is also discussed.

quant-ph↗

arXiv2007

Security Notions for Quantum Public-Key Cryptography

It is well known that Shor's quantum algorithm for integer factorization can break down the RSA public-key cryptosystem, which is widely used in many cryptographic applications. Thus, public-key cryptosystems in the quantum computational setting are longed for cryptology. In order to define the security notions of public-key cryptosystems, we have to model the power of the sender, receiver, adversary and channel. While we may consider a setting where quantum computers are available only to adversaries, we generally discuss what are the right security notions for (quantum) public-key cryptosystems in the quantum computational setting. Moreover, we consider the security of quantum public-key cryptosystems known so far.

quant-ph↗