Supplementary Information

Quantum Cryptography Techniques

Quantum One Time Pad

• Pauli Gates
• Clifford Gates
• T Gates

Gate Teleportation

The idea comes from one-qubit teleporation. This means that one can transfer an unknown qubit |ψi without actually sending it via a quantum channel. The underlying equations explain the notion. See Figure 1 for circuit.

Figure 1: One Bit Teleportation

$(H\otimes I)(CZ_{12})|\psi \rangle _{1}|+\rangle _{2}$

$(H\otimes I)(CZ_{12})(a|0\rangle _{1}+b|1\rangle _{1})|+\rangle _{2}$ $(H\otimes I)(a|0\rangle _{1}|+\rangle _{2}+b|1\rangle _{1}|-\rangle _{2})$ $a|+\rangle _{1}|+\rangle _{2}+b|-\rangle _{1}|-\rangle _{2}$ $|0\rangle _{1}\otimes (a|+\rangle _{2}+b|-\rangle _{2})+|1\rangle _{1}\otimes (a|+\rangle _{2}-b|-\rangle _{2})$ $|0\rangle _{1}\otimes (a|+\rangle _{2}+b|-\rangle _{2})+|1\rangle _{1}\otimes X(a|+\rangle _{2}+b|-\rangle _{2})$ $|0\rangle _{1}\otimes H(a\rangle 0\rangle _{2}+b\rangle 1\rangle _{2})+|1\rangle _{1}\otimes XH(a|0\rangle _{2}+b|1\rangle _{2})$ $|0\rangle _{1}\otimes H|\psi \rangle _{2}+|1\rangle _{1}\otimes X|\psi \rangle _{2}$ $|m\rangle \otimes X^{m}H|\psi \rangle$

Similarly if we have the input state rotated by a $\mathrm {Z} (\theta )$ gate the circuit would look like Figure 2a. As the rotation gate $\mathrm {Z} (\theta )$ commutes with Controlled-Phase gate. Hence, Figure 2b is justified.

• 

  2(a)Modified Input
• 

  2(b)Gate Teleportation

This shows that for a pair of $\mathrm {CZ}$ entangled qubits, if the second qubit is in $|+\rangle$ state (not an eigen value of $\mathrm {Z}$) then one can teleport (transfer) the first qubit state operated by any unitary gate $\mathrm {U}$ to the second qubit by performing operations only on the first qubit and measuring it. Next, we would need to make certain Pauli corrections (in this case ${\mathrm {X} }^{\mathrm {m} }$) to obtain $\mathrm {U} |\psi \rangle$. In other words, we can say the operated state is teleported to the second qubit by a rotated basis measurement of the first qubit with additional Pauli corrections.

Graph states

The above operation can also be viewed as a graph state with two nodes and one edge. The qubit 1 is measured in a rotated basis $\mathrm {HZ} (\theta )$, thus leaving qubit 2 in desired state and Pauli Correction $\mathrm {X} ^{|}\mathrm {s1} \rangle \mathrm {HZ} (\theta _{1})|\psi \rangle$, where $\mathrm {s1}$ is the measurement outcome of qubit 1. See Figure 3

Figure 3: Graph State for Single Qubit Gates

Now, suppose we need to operate the state with two unitary gates $\mathrm {Z} (\theta _{1})$ and $\mathrm {Z} (\theta _{2})$. This can be done by taking the output state of $\mathrm {Z} (\theta _{1})$ gate as the input state of $\mathrm {Z} (\theta _{2})$ gate and then repeating gate teleportation for this setup, as described above. Thus, following the same pattern for graph states we have now three nodes (two measurement qubits for two operators and one output qubit) with two edges, entangled as one dimensional chain (See Figure 4).

Figure 4: Gate Teleporation for Multiple Single Qubit Gates

The measurement on qubit $\mathrm {1}$ will operate $\mathrm {X} ^{\mathrm {s1} }\mathrm {HZ} (\theta _{1})|\psi \rangle \otimes I$ on qubits $\mathrm {2}$ and $\mathrm {3}$. If qubit $\mathrm {2}$ when measured in the given basis yields outcome $\mathrm {s2}$, qubit $\mathrm {3}$ results in the following state ${\mathrm {X} }^{\mathrm {s2} }\mathrm {HZ} (\theta _{2}){\mathrm {X} }^{\mathrm {s1} }\mathrm {HZ} (\theta _{1})|\psi \rangle$. Using the relation we shift all the Pauli corrections to one end i.e. qubit $\mathrm {3}$ becomes ${\mathrm {X} }^{\mathrm {s2} }\mathrm {HZ} (\theta _{2})\mathrm {HZ} (\theta _{1})|\psi \rangle$ (${\mathrm {Z} }^{\mathrm {s1} }\mathrm {H} ={\mathrm {HX} }^{\mathrm {s1} }$). This method of computation requires sequential measurement of states i.e. all the states should not be measured simultaneously. As outcome of qubit $\mathrm {1}$ can be used to choose sign of $\pm \theta _{2}$. This technique is also known as adaptive measurement. With each measurement, the qubits before the one measured at present have been destroyed by measurement. It is a feed-forward mechanism, hence known as one way quantum computation.

Measurement Based Quantum Computation (MBQC)

MBQC is a formalism used for quantum computation by operating only single qubit measurements on a fixed set of entangled states, also known as graph states. Graph states denote any graph where each node represents a quantum state, and the edges denote entanglement between any two vertices. The measurement on successive layers of qubits is decided by previous measurement outcomes. Outcomes of last qubit layer gives the result of concerned computation. Following, we illustrate certain primitives necessary to understand the working of MBQC.

Cluster States

In case of multi-qubit quatum circuits, one needs a 2-dimensional graph state. Cluster State is a square lattice used as substrate for such computation. All the nodes are in $|+\rangle$ entangled by $\mathrm {CZ}$ indicated by the edges. It is known to be universal i.e. it can simulate any quatum gate.

Figure 5: Cluster State

Each row would thus represent the teleporation of starting qubit in that row horizontally. On the other hand, vertical edges indicate different input qubits linked with multi-qubit gates (same as circuit model). For example, see Figure Figure 6 to understand the conversion from circuit model to graph state model. As the computation relation follows $X=HZH$, thus, Figure Figure 6a represents Circuit diagram for $\mathrm {CNOT}$ gate in terms of $\mathrm {CZ}$ gate and Single Qubit Gate $\mathrm {H}$.

• 

  (a)Circuit Diagram to implement C-NOT
• 

  (b)Graph State Pattern for C-NOT
Figure 6: Measurement Pattern from Circuit Model

Figure 6b shows implementation of the first Hadamard gate on the second input state as measurement $\mathrm {M} _{\mathrm {2} }$ on qubit $\mathrm {2}$. Then $\mathrm {CZ}$ gate is implemented by the entangled qubits $\mathrm {3}$ and $\mathrm {1}$ in the graph state. Qubit $\mathrm {3}$ is entangled to another qubit $\mathrm {4}$ to record the output while measurement $\mathrm {M} _{\mathrm {3} }$ on qubit $\mathrm {3}$ implements the second Hadamard gate. Finally, the states to which qubits $\mathrm {(1)}$ and $\mathrm {(4)}$ are reduced to determine the output states of the two input qubits after $\mathrm {CNOT}$ gate operation.
It is evident that one needs to remove certain nodes from the cluster state in order to implement the above shown graph state. This can be done by Z-basis measurements. Such measurements would leave the remaining qubits in the cluster state with extra Pauli corrections. This can be explained as follows. Consider a two-dimesional graph state $\{\mathrm {1,2} \}$. If qubit $\mathrm {1}$ is to be eliminated, we operate $\mathrm {CZ}$ with $\mathrm {2}$ as target and $\mathrm {1}$ as control.

${\mathrm {CZ} }_{\mathrm {12} }{|+\rangle }_{1}|+\rangle _{2}=|0\rangle _{1}|+\rangle _{2}+|1\rangle _{1}|-\rangle _{2}$

Thus, if measurement on $\mathrm {1}$ yields $\mathrm {m}$, qubit $\mathrm {2}$ would be in the state $\mathrm {Z} ^{\mathrm {m} }|+\rangle$. Hence, such Z-basis measurements invoke an extra $\mathrm {Z} ^{\mathrm {m} }$ Pauli correction on all the neighbouring sites of 1 with 1 eliminated, in the resulting graph state. Thus, to summarise, we design a measurement pattern from gate teleportation circuit of the desired computation as shown above. The cluster state is converted into the required graph state by Z-basis measurement on extraneous sites. Measuring all the qubits in the required basis and we get the required computation in the form of classical outcome register from measurement of the last layer of qubits. If it is a quantum function, the last layer of qubits is the output quantum register.

Brickwork States

Although cluster states are universal for MBQC, yet we need to tailor these to the specific computation by performing some computational (Z) basis measurements. If we were to use this principle for blind quantum computing, Client would have to reveal information about the structure of the underlying graph state. Thus, for the UBQC protocol, we introduce a new family of states called the Brickwork states which are universal for X − Y plane measurements and thus do not require the initial computational basis measurements. It was later shown that the Z-basis measurements can be dropped for cluster states and hence cluster states are also universal in X-Y measurements.

Figure 7: Brickwork State

Definition 1 A brickwork state Gn×m, where m ≡ 5 (mod 8), is an entangled state of n × m qubits constructed as follows (see also Figure 7):

1. Prepare all qubits in state |+i and assign to each qubit an index (i,j), i being a column (i ∈ [n]) and j being a row (j ∈ [m]).
2. For each row, apply the operator c-Z on qubits (i,j) and (i,j + 1) where 1 ≤ j ≤ m − 1.
3. For each column j ≡ 3 (mod 8) and each odd row i, apply the operator c-Z on qubits (i,j) and (i + 1,j) and also on qubits (i,j + 2) and (i + 1,j + 2).
4. For each column j ≡ 7 (mod 8) and each even row i, apply the operator c-Z on qubits (i,j) and (i + 1,j) and also on qubits (i,j + 2) and (i + 1,j + 2).

Flow Construction-Determinism

Measurement outcomes of qubits is not certain, hence it renders MBQC a non-deterministic model. This can still be rectified by invoking Pauli corrections based on the previous outcomes, as evident from above. For example, to implement Hadamard gate on input state |ψi = a|0i + b|1i, we consider the case of a two qubit graph state C2x1.
C2x1 = CZij |ψii |+ij = a|00i + a|01i + b|10i − b|11i
If one measures qubit i in {|+i,|−i} basis and gets outcome s, qubit j reduces to,
= (a + b)|0i + (a − b)|1i,if s=0
= (a − b)|0i + (a + b)|1i,if s=1
As, the two possible output states are different, it shows this method is non-deterministic. One could end up with any of the two states and there is no certainty. Nevertheless, we observe that if X gate is operated on the second qubit after measurement if outcome is 1, both the equations would be same and hence, obtained state is H |ψi.
Flow construction is the semanticism to construct the measurement pattern for a given graph state. It gives the Pauli corrections for a particular qubit in the graph state, called X and Z dependencies. In simpler words, it records the effect of shifting all Pauli X and Z corrections to the left of (after performing) Entanglement and Entanglement operations, respectively, for each qubit. The result is recorded as sets of X, Z corrections required for each site. These sets depend on the graph state and not the computation or measurement results. Hence, it can be computed while choosing the graph state for a required computation. Following we illustrate how to construct such models with ease using Measurement Calculus to invoke determinism in One-Way Quantum Computation(MBQC).
Choose a unitary gate for the circuit and hence, its measurement pattern. In order to implement this pattern on a graph state, there are four basic steps: Preparation, Entanglement, Measurement, Corrections.

• Preparation prepares all input qubits in the required state, generally represented as |+θi = ) where
• Entanglement entangles all the qubits according to the required graph state. This operation is denoted by Eij, where C-Z is operated with i as control qubit and j as target qubit.
  
• Measurement assigns measurement angle in X-Y plane for each qubit. Measurement operator is notated as Miα: the qubit ’i’ would be measured in {|+αi,|−αi} basis i.e. if the state is ) one gets outcome 0 and if the state is ), the outcome is 1.
  
• Correction calculates all Pauli corrections to be applied on a given qubit in the pattern. The set of such parameters are called Dependencies for X and Z operators individually. To calculate all the Pauli Corrections on a given qubit, one needs to take into account the measurement outcomes of previous qubits as well as commutation relations. Both affect the Pauli corrections for a given qubit. Below is a formalism to explain the process with an example.
  

The effect of X gate on a measurement angle (α) in X-Y plane is to change its sign and Z gate is to add a phase π.
t α s α t s (−1)sα+tπ [Mi ] = Mi Z X = Mi{equation missing}π
We shall denote measurement in X-basis ({equation missing} and Y-basis ({equation missing}
Commutation relations:
EijXis = XisZisEij (EX)
EijXjs = XjsZjsEij (EX)
EijZit = ZitEij (EZ){equation missing}

	=	 	(EZ){equation missing} 

t α s r
[Mi ] Xi = t α s+r[Mi ]{equation missing}(MX)
MixXis = Mix (MX){equation missing}

	=	 	(MZ){equation missing} 

The last second equation is implied from the fact that for , x=0=-0. Thus, X gate has no effect on measurement in X-basis for the given states. Using above notations we express the equation for circuit model of C-NOT from Figure 6 with two inputs and two outputs: Qubits: 1,2,3,4
Outcomes: s1,s2,s3,s4
Circuit Operation: .

	EX =⇒{equation missing} 

	EX =⇒{equation missing} 

	MX =⇒{equation missing} 

X4s3Z4s2Z1s2M3xM2xE13E234{equation missing}
Hence, we obtain a measurement pattern to implement C-NOT gate with a T-shaped graph state with three qubits entangled chain {2,3,4} and 1 entangled to 3. X dependency sets for qubit 1:{s3}, 2:φ, 3:φ, 4:φ. Z dependency sets for qubit 1:{s2}, 2:φ, 3:φ, 4:{s2}. The measurements are independent of any outcome so they can all be performed in parallel. In the end, Pauli corrections are performed as such. Parity (modulo 2 sum) of all the previous outcomes in the dependency set is calculated for each qubit{equation missing} (i), for X (sXi = s1 ⊕ s2 ⊕ ...) and Z (sZi = s1 ⊕ s2 ⊕ ...), separately. Thus, is operated on qubit i.{equation missing}

Quantum Capable Homomorphic Encryption

• Homomorphic Encryption
  A homomorphic encryption scheme HE is a scheme to carry out classical computation from the Server while hiding the inputs, outputs and computation. It can be divided into following four stages.
• Key Generation. The algorithm (pk,evk,sk) ← HE.Keygen(1λ) takes a λ, a security parameter as input and outputs a public key encryption key pk, a public evaluation key evk and a secret decryption key sk.
• Encryption. The algorithm c ← HE.Encpk(µ) takes the public key pk and a single bit message µ ∈ {0,1} and outputs a ciphertext c. The notation HE.Encpk(µ;r) is be used to represent the encryption of a bit µ using randomness r.
• Decryption. The algorithm µ∗ ← HE.Decsk(c) takes the secret key sk and a ciphertext c and outputs a message µ∗ ∈ {0,1}.
• Homomorphic Evaluation The algorithm cf ← HE.Evalevk(f,c1,...,cl) takes the evaluation key evk, a function f : {0,1}l → {0,1} and a set of l ciphertexts c1,...,cl, and outputs a ciphertext cf. It must be the case that:

HE.Decsk(cf) = f(HE.Decsk(c1),...,HE.Decsk(cl)) (1) with all but negligible probability in λ. This means classical HE decrypts ciphertext bit by bit. HE scheme is compact if HE.Eval is independent of any inputs or computation. It is fully homomorphic if it can compute any boolean computation.

• Quantum Capable
  

A classical HE is quantum capable if it can be used to evaluate quantum circuits.

Any HE scheme to be quantum capable requires the following two properties.

• invariance of ciphertext:
• natural XOR operation:

Garden Hose Complexity Model

• Gadget Construction for QFHE

Quantum Error Correction

• Quantum Error Correcting Codes (QECCs)

• Stabilizer Codes