Conjugate Codes and Applications to Cryptography
Total Page:16
File Type:pdf, Size:1020Kb
1 Conjugate Codes and Applications to Cryptography Mitsuru Hamada Research Center for Quantum Information Science Tamagawa University Research Institute 6-1-1 Tamagawa-gakuen, Machida, Tokyo 194-8610, Japan PRESTO, Japan Science and Technology Agency 4-1-8 Honcho, Kawaguchi, Saitama, Japan Abstract— A conjugate code pair is defined as a pair of linear parties, and the shared key itself is not the secret message codes such that one contains the dual of the other. The conjugate that the sender wishes to send. A typical scenario is that after code pair represents the essential structure of the corresponding sharing the key, the sender encrypts a secret data using the Calderbank-Shor-Steane (CSS) quantum code. It is argued that conjugate code pairs are applicable to quantum cryptography in key and sends it to the receiver and the receiver decrypts the order to motivate studies on conjugate code pairs. data using the shared key. The direct encryption is mightier, and can be used as QKD if one wishes. Turning back to the Index Terms— conjugate codes, quotient codes, cryptographic codes. original motivation of (algebraic) QECCs, these codes deemed indispensable for quantum computing since quantum states are more vulnerable to errors or quantum noise, most notably to I. INTRODUCTION decoherence. Among QECCs, CSS codes are said to be suited Since the invention of the first algebraic quantum error- for fault-tolerant quantum computing (e.g., [8] and references correcting code (QECC) by Shor [1] in 1995, the theory of therein). QECCs has been developed rapidly. The first code was soon The aim of this work is to enhance motivation to study extended to a class of algebraic QECCs called Calderbank- this class of codes. In particular, applications to cryptography, Shor-Steane (CSS) codes [2] and then to a more general class which allow direct encryption, are emphasized. We remark of QECCs, which are called symplectic codes or stabilizer that a large portion of this paper is nearly a paraphrase of a codes [3], [4], [5]. part of [7] though our description is slightly more general in In this paper, we focus on CSS codes. It is well-known that we explicitly treat a general code pair (C1, C2) satisfying that this class of symplectic codes are useful for quantum a certain condition, which will be given shortly, whereas [7] key distribution (QKD), at least, in theory. In particular, describes the result for the case where C1 = C2. Shor and Preskill [6] argued that the security of the famous This paper is organized as follows. In Section II, conjugate Bennett-Brassard 1984 (BB84) QKD protocol could be proved codes are introduced, and in Section III, CSS quantum codes by evaluating the fidelity of quantum error-correcting codes are explained. In Section IV, it is argued that conjugate code arXiv:quant-ph/0610193v1 23 Oct 2006 underlying the protocol. pairs are applicable to quantum cryptography. General sym- The term ‘conjugate codes’ appearing in the title is almost plectic codes, and quotient codes, are explained in SectionsV a synonym for CSS codes if one forgets about quantum and VI, respectively. Sections VII and VIII, contain remarks mechanical operations for encoding or decoding and pays and a summary, respectively. attention only to what can be done in the coding theorists’ universe of finite fields. This term was coined here so that this issue would be more accessible to those unfamiliar with II. CONJUGATE CODES quantum information theory. Recently, the present author [7] proved the existence of CSS We write B ≤ C if B is a subgroup of an additive group F codes that outperforms those proved to exist in the litera- C. We use a finite field q of q elements, and the dot product ture [2], and quantified the security and reliability of CSS- defined by code-based QKD schemes rigorously assuming ideal discrete n quantum systems. Although we have treated QKD in [7], the (x1,...,xn) · (y1,...,yn)= X xiyi (1) CSS-code-based QKD scheme can be viewed as merely one i=1 application of conjugate codes (CSS codes). For example, the Fn ⊥ Fn arguments in [7] also imply that conjugate codes can be used for vectors in q . We let C denote {y ∈ q | ∀x ∈ C, x·y = Fn as cryptographic codes that directly encrypt secret data as 0} for a subset C of q . will be elucidated in the sequel. Here, we remark that QKD We mean by an [[n, k]] conjugate (complementary) code means techniques for sharing a secret key between remote pair or CSS code pair over Fq a pair (C1, C2) consisting of an 2 1 [n, k1] linear code C1 and an [n, k2] linear code C2 satisfying and n NJ = {Nx | x ∈ J}, J ⊆ X . C⊥ ≤ C , (2) 2 1 An obvious but important consequence of (5) is that XuZw ′ ′ ⊥ u w ′ ′ which condition is equivalent to C1 ≤ C2, and and X Z commute if and only if u · w − w · u =0. The map k = k1 + k2 − n. (3) ([u, w], [u′, w′]) 7→ u · w′ − w · u′ (6) ⊥ If C1 and C2 satisfy (2), the quotient codes C1/C2 and is a symplectic bilinear form, which we refer to as standard. ⊥ C2/C1 are said to be conjugate. The notion of quotient codes A CSS code is specified by two classical linear codes (i.e., was introduced in [9], and will be explained in Section VI. Fn 2 subspaces of q ) C1 and C2 with (2). Coset structures are The goal, in a long span, is to find a conjugate code exploited in construction of CSS codes. We fix some set of ⊥ ⊥ pair (C1, C2) such that both C1/C and C2/C have good Fn 2 1 coset representatives of the factor group q /C1, for which performance. If the linear codes C1 and C2 both have good the letter x is always used to refer to a coset representative in ⊥ ⊥ performance, so do C1/C and C2/C . Hence, a conjugate ⊥ 2 1 this section, that of C1/C2 , for which v is used, and that of code pair (C1, C2) with good (not necessarily a technical term) Fn q /C2, for which z is used. These may be written as C and C is also desirable. 1 2 Fn x ∈ q /C1, Fn III. CALDERBANK-SHOR-STEANE CODES z ∈ q /C2, ⊥ The complex linear space of operators on a Hilbert space v ∈ C1/C2 H L H is denoted by ( ). A quantum code usually means a where is in abuse as usual. Put , ⊗n ∈ k1 = dim C1 k2 = pair (Q, R) consisting of a subspace Q of H and a ⊥ dim C2, and assume g1,...,gn−k2 form a basis of C2 , and trace-preserving completely positive (TPCP) linear map R on ⊥ h1,...,hn−k form a basis of C . We assume k1 is larger L(H⊗n), called a recovery operator. The subspace Q alone 1 1 than n − k2. is also called a code. Symplectic codes have more structure: The operators They are simultaneous eigenspaces of commuting operators on h h − g g − H⊗n. Once a set of commuting operators is specified, we have Z 1 ,...,Z n k1 , X 1 ,...,X n k2 , (7) a collection of eigenspaces of them. A symplectic code refers which generate the so-called stabilizer of the CSS code, to either such an eigenspace or a collection of eigenspaces, commute with each other, so that we have simultaneous each possibly accompanied by a suitable recovery operator. In eigenspaces of these operators. Specifically, put this section and the next, we assume H is a Hilbert space of 1 dimension q, and q is a prime (but see Section VII-E). Then, |φ i = ωz·w|x + v + wi (8) q−1 xzv ⊥ X F Z Z H |C | ⊥ q = /q . We fix an orthonormal basis (|ii)i=0 of . p 2 w∈C In constructing symplectic codes, the following basis of 2 L(H⊗n) is used. Let unitary operators X,Z on H be defined for coset representatives x, z and v. Then, we have by hj x·hj Z |φxzvi = ω |φxzvi, j =1,...,n − k1 j X|ji = |j − 1i, Z|ji = ω |ji, j ∈ Fq (4) and with ω being a primitive q-th root of unity (e.g., ei2π/q). For gj z·gj Fn u u u1 X |φxzvi = ω |φxzvi, j =1,...,n − k2. u = (u1,...,un) ∈ q , let X and Z denote X ⊗···⊗ Xun and Zu1 ⊗···⊗Zun , respectively. The operators XuZw, Fn Fn It can be checked that |φxzvi, x ∈ q /C1, z ∈ q /C2, v ∈ u, w ∈ Fn, form a basis of L(H⊗n), which we call the Weyl ⊥ H⊗n q C1/C2 , form an orthonormal basis of . In words, we have (unitary) basis [15]. We have the commutation relation k1+k2−n q -dimensional subspaces Qxz such that Lx,z Qxz = ′ ′ ′ ′ ′ ′ ⊗n · − · H and is spanned by orthonormal vectors , (XuZw)(Xu Zw )= ωu w w u (Xu Zw )(XuZw), (5) Qxz |φxzvi ⊥ Fn Fn v ∈ C1/C2 , for each pair (x, z) ∈ ( q /C1) × ( q /C2). ′ ′ Fn Fn Fn for u,w,u , w ∈ q , which follows from XZ = ωZX. It The subspaces Qxz, (x, z) ∈ ( q /C1) × ( q /C2), are the is sometimes useful to rearrange the components of (u, w) simultaneous eigenspaces of the operators in (7), and form a appearing in the operators XuZw in the Weyl basis as follows: CSS code. Fn ⊥ For u = (u1,...,un) and w = (w1,...,wn) ∈ q , we denote In [7], we have treated the case when C1 = C2 = C with by [u, w] the rearranged one a code C.