Advances in Quantum Cryptography S. Pirandola1,2, U. L. Andersen3, L. Banchi4, M. Berta5, D. Bunandar2, R. Colbeck6, D. Englund2, T. Gehring3, C. Lupo7, C. Ottaviani1, J. Pereira1, M. Razavi8, J. S. Shaari9,10, M. Tomamichel11, V. C. Usenko12, G. Vallone13, P. Villoresi13, P. Wallden14 1Computer Science and York Centre for Quantum Technologies, University of York, York YO10 5GH, UK 2Research Laboratory of Electronics, Massachusetts Institute of Technology (MIT), Cambridge, Massachusetts 02139, USA 3Center for Macroscopic Quantum States (bigQ), Department of Physics, Technical University of Denmark, Fysikvej, 2800 Kgs. Lyngby, Denmark 4Department of Physics and Astronomy, University of Florence, via G. Sansone 1, I-50019 Sesto Fiorentino (FI), Italy 5Department of Computing, Imperial College, Kensington, London SW7 2AZ, UK 6Department of Mathematics, University of York, York YO10 5DD, UK 7Department of Physics and Astronomy, University of Sheffield, Sheffield S3 7RH, UK 8School of Electronic and Electrical Engineering, University of Leeds, Leeds, LS2 9JT, UK 9Faculty of Science, International Islamic University Malaysia (IIUM), Jalan Sultan Ahmad Shah, 25200 Kuantan, Pahang, Malaysia 10Institute of Mathematical Research (INSPEM), University Putra Malaysia, 43400 UPM Serdang, Selangor, Malaysia 11Centre for Quantum Software and Information, School of Software, University of Technology Sydney, Sydney NSW 2007, Australia 12Department of Optics, Palacky University, 17. listopadu 50, 772 07 Olomouc, Czech Republic 13Dipartimento di Ingegneria dell’Informazione, Universit´adegli Studi di Padova, via Gradenigo 6B, 35131 Padova, Italy and 14School of Informatics, University of Edinburgh, 10 Crichton Street, Edinburgh EH8 9AB, UK Quantum cryptography is arguably the fastest growing area in quantum information science. Novel theoretical protocols are designed on a regular basis, security proofs are constantly improv- ing, and experiments are gradually moving from proof-of-principle lab demonstrations to in-field implementations and technological prototypes. In this review, we provide both a general introduc- tion and a state of the art description of the recent advances in the field, both theoretically and experimentally. We start by reviewing protocols of quantum key distribution based on discrete variable systems. Next we consider aspects of device independence, satellite challenges, and high rate protocols based on continuous variable systems. We will then discuss the ultimate limits of point-to-point private communications and how quantum repeaters and networks may overcome these restrictions. Finally, we will discuss some aspects of quantum cryptography beyond standard quantum key distribution, including quantum data locking and quantum digital signatures. CONTENTS 1.E91protocol 14 2.BBM92protocol 14 I. Introduction 3 E. Two-way quantum communication 15 1.Pingpongprotocol 15 II. Basic notions in quantum key distribution 4 2.Two-wayQKDprotocols 16 A. GenericaspectsofaQKDprotocol 4 3.Intercept-resendstrategy 16 B. Asymptotic security and eavesdropping 4. Non-orthogonalattack strategies 16 arXiv:1906.01645v1 [quant-ph] 4 Jun 2019 strategies 5 5. Further considerations 17 C. Finite-size effects 5 D.ComposablesecurityofQKD 5 IV.Device-independentQKD 17 A. Introduction 17 III.OverviewofDV-QKD 7 B. The link between Bell violation and A. Preliminary notions 7 unpredictability 17 B.Prepareandmeasureprotocols 8 C. Quantitative bounds 19 1.BB84protocol 8 D.ProtocolsforDI-QKD 20 2.Six-stateprotocol 10 1.ThesetupforDI-QKD 20 3.B92protocol 11 2. The spot-checking CHSH QKD protocol 20 C. Practical imperfections and E.Historicalremarks 21 countermeasures 12 F. Putting DI-QKD protocols into practice 21 1.PNSattacks 12 G. Measurement device independence (MDI) 22 2. Decoy States 13 H. Twin-field QKD 24 3. SARG04 protocol 13 D. Entanglement-based QKD 14 V. ExperimentalDV-QKDprotocols 25 2 A. Detector technology 25 2. Guaranteeing large smooth min-entropy 52 B.DecoystateBB84 25 C. Uncertainty principle versus entanglement: C. Differential phase shift QKD 26 an intuitive approach to QKD security 53 D.Coherentone-way 27 D.CVprotocols 53 E.DVMDI-QKD 27 E.ExtensionsandOutlook 54 F. High-dimensional QKD 29 G. Photonic integrated circuits 30 X. Quantum hacking 54 A. Hacking DV-QKD protocols 55 VI. Satellite quantum communications 32 1. PNS and intensity-based attacks 55 A. Introduction 32 2.Trojanhorseattacks 56 B. The satellite opportunity 33 3.Backflashattacks 57 C. Type of orbits and applications 33 4. Faked states and detector efficiency 1. Space-link losses 33 mismatch 57 2.Low-Earth-orbit(LEO) 34 B.HackingCV-QKDprotocols 58 3. Higher Earth orbits (MEO and GEO) 35 1. Attacks on the local oscillator 59 4. Night and day use of the link 35 2. Saturationattacksondetectors 59 D. Beyond satellite QKD 35 3.Trojanhorseattacks 60 1.Otherprotocols 35 C.Generalconsiderations 60 2. Tests of quantum mechanics in space 36 D. Device-independence as a solution? 60 E.Concludingremarks 37 XI. Limits of point-to-point QKD 61 VII. Continuous-variable QKD 37 A.Overview 61 A. BriefintroductiontoCVsystems 37 B. Adaptive protocols and two-way assisted B. Historical outline 37 capacities 62 C.One-wayCV-QKDprotocols 38 C. General weak-converseupper bound 64 D. Computation of the key rate 38 D. LOCC simulation of quantum channels 64 E. Ideal performances in a thermal-loss E. Teleportation covariance and simulability 65 channel 39 F. Strong and uniform convergence 65 F. Finite-size aspects 40 G. Stretching of an adaptive protocol 66 G.Two-wayCV-QKDprotocols 40 H. Single-letter upper bound for two-way 1. Asymptotic security of two-way assisted capacities 66 CV-QKD 41 I. Bounds for teleportation-covariant 2. Asymptotic key rates 41 channels 67 3. Further considerations 42 J. Capacities for distillable channels 68 H.Thermal-stateQKD 42 K.Openproblems 69 1. One-way thermal communication 42 2. Two-way thermal communication 43 XII. Repeater chains and quantum networks 69 I. Unidimensional protocol 43 A.Overview 69 J. CV-QKD with discrete modulation 44 B. Idealchainsofquantumrepeaters 70 K.CVMDI-QKD 44 C. Quantum communication networks 70 1.Basicconceptsandprotocol 44 D. Practical designs for quantum repeaters 71 2.Securityandkeyrates 44 1. Probabilistic quantum repeaters 72 3.VariantsofCVMDI-QKD 46 2. Deterministic quantum repeaters 73 4. Multipartite CV MDI-QKD 46 3. Memory-lessquantumrepeaters 74 VIII.ExperimentalCV-QKD 46 XIII. QKD against a bounded quantum memory 75 A. Introduction 46 A. Introduction 75 B.Point-to-pointCV-QKD 46 B. Entropic uncertainty relations 75 1.Coherentstateencoding 47 C. Bounded quantum storage model 76 2.Detection 47 D. Quantum data locking 76 3.Post-processing 50 E. Quantum data locking for communication: C. Implementation of advanced CV-QKD 50 the quantum enigma machine 77 1.Squeezed-stateprotocols 51 F. Practical quantum data locking 78 2.CVMDI-QKD 51 G. Experimental demonstrations 78 IX.Theoreticalsecurityaspects 51 XIV. Quantum random number generation 78 A. Finite-size analysis in QKD 51 A. Introduction 78 B. Finite-size statistical analysis 52 B.ProtocolsforDI-QRE 80 1. Privacy amplification 52 1.ThesetupforDI-QRE 80 3 2. The spot-checking CHSH QRE protocol 80 integers by using Shor’s algorithm [22, 23]. The threat C. Historical remarks and further reading 81 for the Rivest-Shamir-Adleman (RSA) protocol [24] and D. Implementations 81 the other public key cryptosystems not only comes from E. Randomness amplification 81 quantum computing but also from potential advances in number theory, where an efficient factorization al- XV. Quantum Digital Signatures 82 gorithm might be found for classical Turing machines A. Introduction 82 (e.g., already in 2004 the test of primality has become B. Definitions and security properties 82 polynomial, thanks to the Agrawal-Kayal-Saxena algo- C. What is a quantum digital signature scheme rithm [25]). and why it is useful? 83 An important point to understand is that the fragility D. The Lamport one-time signature scheme 84 of current classical cryptosystems not only is a poten- E. The Gottesman-Chuang QDS 84 tial threat for the present, but a more serious and re- 1.Theprotocol 84 alistic threat for the future. Today, eavesdroppers may 2. Security intuition 85 intercept cryptograms that they are not able to decrypt. 3.Remarks 85 However, they may store these encrypted communica- 4. Practical limitations of GC-QDS 86 tions and wait for their decryption once a sufficiently F. Practical QDS: Lifting the limitations 86 large quantum computer is technologically available (or 1. Simplifying state comparison 86 a new classical algorithm is discovered). This means that 2. No quantum memory requirement 87 the confidentiality of messages may have a very limited 3.QDSfromQKDtechnology 87 lifespan. Following Michele Mosca [26], we may write 4. Insecure quantum channels 88 a simple inequality. Let us call x the security shelf-life G. AgenericmodernQDSprotocol 88 which is the length of time (in years) we need the classi- 1. Description 88 cal cryptographic keys to be secure. Then, let us call y 2. Security intuition and performance 89 the migration time which is the time (in years) needed to H. Extending QDS: Multiple parties, longer adapt the current classical infrastructure with quantum- messages,andMDI 89 secure encryption. Finally, let us call z the collapse time I. Experimental QDS realizations 90 which is the time (in years) for a large quantum computer 1. Proof-of-principle 90 to be built. If x + y>z then “worry” [26]. 2. Kilometer-range and fully-secure QDS 90 It is therefore clear that suitably countermeasures are J. Classical unconditional secure signatures 90 necessary. One approach is known as post-quantum cryp- K. Summary and outlook 91 tography. This is the development of novel classical cryp- tosystems which are robust to factorization and other XVI. Conclusions 91 quantum algorithms. This is certainly one option but Acknowledgments 92 it does not completely solve the problem. The point is that there may be undiscovered quantum algorithms (or A. Formulas for Gaussian states 92 undiscovered classical ones) that might easily break the 1. Symplectic action and its computation 93 security of the new cryptosystems. In other words, post- 2.