arXiv:quant-ph/0601157v1 23 Jan 2006 oa,ie,cno eepandb hrdcasclinform not classical is shared by behavior explained resulting be the cannot that i.e., local, such bases measurement of and primitive—where et a edsrbdb odtoa rbblt distri- probability conditional a by described bution be hidden- can ments such that behavio [9] quantum-physical Specker explain general. to in and fail Kochen models parameter and [8] Piron [2], and von Jauch by [12], Bell later Specker [7], shown Gleason was [15], should it Neumann However, it measurements. that of sense certain results the by th in augmented was incomplete be [6] was of conclusion physics The quantum separated. spatially per- are to measurem events two lead the measurements when the results—even anti-correlated basis, fectly same the in measured are lsia nlget unu hne ntesm es as sense same qubits. the entangled in maximally channel for quantum are boxes a non-local to analogue classical alternatively, icsino o-oa eair e scnie,frinst for following, consider, us the Let behavior. non-local of on phenomenon discussion the is physics ment quantum of laws the Non-Locality and Entanglement Quantum A. el[]wstefis orcgieta hr xs pairs exist there that recognize to first the was [2] Bell h eairo iatt unu tt ne measure- under state quantum bipartite a of behavior The state The Abstract n ftems neetn n upiigcneune of consequences surprising and interesting most the of One ∗ Y n13,Enti,Pdlk,adRsn[]iiitda initiated [6] Rosen and Podolsky, Einstein, 1935, In . ru fApidPyis nvriyo eea 0 u el’ de rue 10, Geneva, of University Physics, Applied of Group h orsodn ucms(e iue1). Figure (see outcomes corresponding the P ioa Gisin Nicolas XY i.1 w-at nomto-hoei primitive. information-theoretic two-party A 1. Fig. eso htolvostase a ese sthe as seen be can transfer oblivious that show We — biiu rnfradQatmChannels Quantum and Transfer Oblivious | | UV X ψ EPR U † − aial entangled maximally as aldtopryinformation-theoretic two-party called —also .H il hsc aoaoy nvriyo rso,Tynd Bristol, of University Laboratory, Physics Wills H. H. i § | optrSineDprmn,EHZuih T etu,CH- Zentrum, ETH Z¨urich, ETH Department, Science Computer ψ U a h rpryta hntetoqubits two the when that property the has or − .I I. and i elstate Bell = ∗ NTRODUCTION V √ idnparameters hidden P 1 ‡ XY 2 elt-akr aoaois tk ifr,BitlBS1 Bristol Gifford, Stoke Laboratories, Hewlett-Packard eoetecoe ae and bases chosen the denote ( ad Popescu Sandu | : 01 | UV | − i E-mail: tt,called state, 10 i ) { Nicolas.Gisin,Valerio.Scarani . E-mail: eemnn the determining Y V †‡ -al [email protected] E-mail: singlet entangle- { aei Scarani Valerio wolf,wjuerg ance, ation ent (1) or, X at r , rbblt facretotu.Teeoe ohAadBjust B and input A for both values—one Therefore, two t output. improve t have correct not easy a does is strategies It of the box. probability of NL randomization an a of that simulation see classical the at look first an simulating of probability success box. the on NL bound upper an to htteotu ftetopaesi rn,te a achieve can they such wrong, inputs most is of at players pair of two accuracy a the an always of is output there the that Since output. will they P state EPR nyb omncto,does communication, classi explainable by although only behavior, non-local that note r oae ihrsett ahohrb h nl of angle the by other each to respect with rotated are eyitiiewy ic the since way, intuitive very measured. seFgr ) esoe htteeeitcraninequalit certain exist there that called showed (now He 2). Figure (see oa ytm u which but system, local nohrwords, other In eairo h Lbxi nprdb h n of one the by inspired is box NL the of behavior oec n orih[0 aeitoue “non-locality a introduced have called bett [10] machine,” consequences Rohrlich its and and Popescu non-locality understand to order bnr)ipt n upt fteN o are box NL The the state. quantum of any outputs of ( and one inputs the (binary) than non-local” “more is ,Y X, } e h nust h Lbxb hsna adm e us Let random. at chosen be box NL the to inputs the Let h eairof behavior The sn uhN oe,w a nesadBl’ hoe in theorem Bell’s understand can we boxes, NL such Using @inf.ethz.ch cl-eMeeie H11 e`v ,Switzerland. Gen`eve 4, CH-1211 Ecole-de-M´edecine, ´ ) ∗ epciey and respectively, , } X @physics.unige.ch U | Prob[ Prob[ ψ l vne rso S T,U.K. 1TL, BS8 Bristol Avenue, all − elinequalities Bell tfnWolf Stefan i hycncryotmaueet nbssthat bases in measurements out carry can they , X X X o-oa box non-local 02Zuih Switzerland. Z¨urich, 8092 | and ψ = = i.2 oa system. local A 2. Fig. − Q,U.K. 6QZ, 2 Y Y i R Y 0 | | s hence, is, ( ( . X ,V U, ,V U, 75 § are satisfy HHBl inequality Bell CHSH ftepaeshv cest an to access have players the If . and htcno evoae yany by violated be cannot that ) iltdwe nERpi is pair EPR an when violated (1 = ) ) (1 6= J¨urg Wullschleger not Y 0 X or non-local n n o input for one and r admbt satisfying bits random are R ⊕ , , Lbox NL lo o inln.In signaling. for allow ) 0 = 1)] ) 1 = 1)] Y = ti motn to important is It . U · o hr.The short. for V . , corresponds . | Y V ( ψ ,V U, § − π/ i 1 u it but , —that 8 ) and , cally and ies er, he o get an accuracy of Conversely, 2 OT can be used to realize an NL box. 1 If the inputs to the− latter are u and v, then the parties input 2 π 2 cos 0.85 . (2) (r, r u) (where r is a random bit) and v to the OT. 8 ≈ 1 The sender’s⊕ output is then r, and the receiver’s output− is his Furthermore, it has been shown that one call to an NL box 2 output from 1 OT, i.e., r uv. We, hence, have for the allows for perfectly simulating the joint behavior of a singlet outputs that − ⊕ state under arbitrary von Neumann measurements [5]. It is, r (r uv)= uv , therefore, fair to say that the NL box is the classical analogue ⊕ ⊕ of a Bell state. as requested.
B. Oblivious Transfer C. Classical Teleportation Oblivious transfer, introduced by Wiesner [16] under the Quantum teleportation [3] is the simulation of sending a name of “multiplexing” and by Rabin [11], is a primitive qubit over a quantum channel, using a shared EPR pair and two of paramount importance in cryptography, in particular two- bits of classical communication. Classical teleportation [4] and multi-party computation. In chosen 1-out-of-2 oblivious is the term used for the following reduction. Given a box transfer or 2 OT for short, one party, called the sender, simulating the classical behavior of an EPR pair, e.g., a 1− singlet ψ− , and one bit of classical communication, one can has two binary inputs b0 and b1, whereas the other party, the simulate| sendingi a qubit over a quantum channel and carrying receiver, inputs a choice bit c. The latter then learns bc but no additional information, while the sender remains ignorant out a von Neumann measurement on the received qubit. The about c. idea is as follows [4]: Alice chooses, for her part of the EPR pair, a measurement basis consisting of the state she wants to send and its orthogonal complement, and communicates b0 c the outcome to Bob, who inverts his measurement result if 2 OT 1 and only if Alice has measured the state orthogonal to the b1 − bc one to be sent. Together with the result that an NL box allows for simulating the behavior of an EPR pair under Fig. 3. Chosen 1-out-of-2 oblivious transfer. von Neumann measurements, this leads to a realization of classical teleportation with one use of an NL box and one bit of OT has been shown universal for multi-party computation, classical communication. When another—weaker—result, by i.e., any secure computation can be carried out if OT is Bacon and Toner [13], is used stating that the EPR behavior available. An example is secure function evaluation, which under projective measurements can be simulated using one bit is an important special case of multi-party computation, and of communication, then one obtains the possibility of classical where a number of players want to secretly and correctly teleportation using two bits of classical communication. evaluate a function to which each player holds an input; here, II. CONNECTION BETWEEN OBLIVIOUS TRANSFER AND “secretly” means that no (unnecessary) information about the QUANTUM CHANNELS players’ inputs is revealed. In this note, we are interested in OT from the viewpoint In this section we show that—instead of one NL box and of communication complexity rather than cryptography. In one classical bit of communication—one oblivious transfer particular, the described reductions are not cryptographic: a (and shared randomness) is enough to perfectly simulate a party can obtain more information than specified. quantum channel with a von Neumann measurement. Note 2 that our discussion in the previous section shows that this is In [17], it has been shown that 1 OT and the NL box are roughly the same primitive in a cryptographic− sense, i.e., a strictly weaker primitive. one can be reduced to the other. An interesting and somewhat Furthermore, in the case of an NL box and EPR pairs, the 2 inverse is true as well, with identical success probabilities: surprising consequence thereof is that 1 OT, just as the 2 − Using a quantum channel, one can simulate oblivious transfer NL box, is symmetric: 1 OT from A to B can be perfectly − 2 with a probability of about 0.85, whereas with a classical reduced to a single instance of OT from B to A [18]. 1 channel one cannot be better than 0.75. In terms of communication complexity, − we have the fol- We can, therefore, conclude that oblivious transfer is the lowing reductions. 2 OT can be reduced to one realization 1 classical analogue to a quantum channel, in the same way as of an NL box plus one− bit of (classical) communication as 2 an NL box is for the EPR pair. follows. Let (b0,b1) and c be the parties’ inputs for OT. 1− Then they input b0 b1 and c to the NL box, respectively, and A. Simulating a Quantum Channel using Oblivious Transfer ⊕ receive the outputs X and Y with X Y = (b0 b1)c. The 2 ⊕ ⊕ The reduction of classical teleportation to 1 OT works first party then sends X b0 to the other, who computes − ⊕ as follows. Let l1 and l2 be two random vectors on the Poincar´esphere, and let l := l1 l2. (These vectors are (X b0) Y = b0 (b0 b1)c = bc , ± ± ⊕ ⊕ ⊕ ⊕ the randomness shared by the two parties.) Let vA and vB as desired. be the vectors determining the state Alice wants to send and the measurement Bob wants to perform, respectively. Then the III. CONCLUDING REMARKS AND OPEN PROBLEMS inputs to 2 OT are as shown in Figure 4. (Here, sg denotes 1− We have shown that bit oblivious transfer can be seen as the the signum function.) classical analogue of sending a qubit over a quantum channel in the same sense as the NL box is for measuring an EPR sg(vB l+) pair. sg(vA l1) · ⊕ 2 sg(vB l−) Note that our simulation of a quantum channel does not · OT · 1 preserve privacy, i.e. the players get more information than sg(vA l2) − z · they would get if they had only black-box access to a quantum channel. It is an open problem if there is an efficient simulation Fig. 4. Reducing classical teleportation to oblivious transfer. that would also be private.
Bob’s output is the bit ACKNOWLEDGMENT This work was supported by the Swiss National Science z sg(vB l+) 1 . ⊕ · ⊕ Foundation (SNF). We have REFERENCES z = sg(vA l1) [sg(vA l1) sg(vA l2)][sg(vB l+) sg(vB l−)] . [1] A. Ambainis, A. Nayak, A. Ta-Shma, and U. Vazirani, Dense Quan- · ⊕ · ⊕ · · ⊕ · tum Coding and a Lower Bound for 1-way Quantum Automata, Hence, we obtain the same expression as in [4] (see also [13]). quant-ph/9804043, 1998. [2] J. S. Bell, On the Einstein-Podolsky-Rosen paradox, Physics, Vol. 1, B. Simulating Oblivious Transfer using a Quantum Channel pp. 195–200, 1964. [3] C. H. Bennett, G. Brassard, C. Cr´epeau, R. Jozsa, A. Peres, and W. Let now Alice and Bob be connected by a quantum channel Wootters, Teleporting an unknown quantum state via dual classical and over which they are allowed to send exactly one qubit. They EPR channels, Phys. Rev. Lett., Vol. 70, pp. 1895-1899, 1993. want to simulate OT (with an error as small as possible) with [4] N. Cerf, N. Gisin, and S. Massar, Classical teleportation of a quantum bit, Phys. Rev. Lett., Vol. 84, No. 11, 2000. Alice as sender and Bob as receiver. Alice has inputs b0 and [5] N. Cerf, N. Gisin, S. Massar, and S. Popescu, Simulating maximal b1 and Bob c, i.e., Bob wants to know bc. Alice takes a qubit quantum entanglement without communication, Phys. Rev. Lett., Vol. φ = 0 and rotates it by an angle of 94, 2005. See also quant-ph/0410027. | i | i [6] A. Einstein, B. Podolsky, and N. Rosen, Can quantum-mechanical π description of physical reality be considered complete?, Phys. Rev., Vol. φ(b0,b1) := (2b0 +4b1 3) . (3) 41, 1935. 8 − [7] A. M. Gleason, Measures on the closed subspaces of a Hilbert space, She gets J. Math. Mech., Vol. 6, 885, 1957. [8] J. M. Jauch and C. Piron, Can hidden variables be excluded in quantum φ = cos(φ(b0,b1)) 0 + sin(φ(b0,b1)) 1 (4) mechanics?, Helv. Phys. Acta, Vol. 36, 827, 1963. | i | i | i [9] S. Kochen and E. Specker, The problem of hidden variables in quantum and send φ to Bob. If c = 1, Bob applies a Hadamard mechanics, Journal of Mathematics and Mechanics, Vol. 17, No. 1, transform on| i φ and leaves it unchanged otherwise. He then 1967. | i [10] S. Popescu and D. Rohrlich, Causality and nonlocality as axioms for measures φ in the computational basis and outputs the quantum mechanics, quant-ph/9709026, 1997. outcome of| i this measurement. It is easy to verify that his [11] M. Rabin, How to exchange secrets by oblivious transfer, Technical Report TR-81, Harvard Aiken Computation Laboratory, 1981. output is equal to c with a probability of b [12] E. Specker, Die Logik nicht gleichzeitig entscheidbarer Aussagen, 2 π Dialectica, Vol. 14, pp. 239–246, 1960. cos 0.85 , (5) [13] B. Toner and D. Bacon, Communication cost of simulating Bell corre- 8 ≈ lations, Phys. Rev. Lett., Vol. 91, No. 18, 2003. which is the same as for the simulation of an NL box using [14] W. van Dam, On quantum computation theory, Ph.D. thesis, University an EPR pair. of Oxford, 2000. [15] J. von Neumann, Mathematische Grundlagen der Quanten-Mechanik, If Alice and Bob are only allowed to communicate one Verlag Julius-Springer, Berlin, 1932. Mathematial Foundations of Quan- classical bit, the best Alice can do is to choose one of the tum Mechanics, Princeton University, Princeton, 1955. two input bits and send it to Bob. Therefore, Bob will only be [16] S. Wiesner, Conjugate coding, Sigact News, Vol. 15, No. 1, 1983. [17] S. Wolf and J. Wullschleger, Oblivious transfer and quantum non- able to output the correct value bc with probability 0.75, if all locality, quant-ph/0502030, 2005. inputs are random. Again, we get the same success probability [18] S. Wolf and J. Wullschleger, Oblivious transfer is symmetric, as for the NL box without an EPR pair. Results related to ours http://ePrint.iacr.org 2004/336, 2004. were obtained in [1].