Classical Fully Homomorphic Encryption for Quantum Circuits: Difference between revisions

== Functionality Description==

[[Category:Two Party Protocols]][[Category:Quantum Functionality]][[Category:Universal Task]]

== Outline==

FHE presents a classical protocol with the help of which a completely classical Client could assign Server a quantum computation for her encrypted (hidden) input/output. Similar to any classical HE this scheme is divided into four steps: Key Generation generates keys for encryption, decryption and evaluation of the circuit, Encryption encodes the input into a ciphertext using encryption key, Homomorphic Evauation performs operations (imlpements the circuit) on the encrypted input using evaluation key and Decryption transforms result of the ciphertext to actual outcome of the circuit using decryption key. Following the stages of Delegated Quantum Computation, in preparation stage, Client encrypts (hides) her inputs from the Server who, in the computation stage, performs quantum computation by a completely classical evaluation step where applying Clifford gates remains a simple step as it leaves the state with only Pauli corrections which are easy to handle by QOTP, but when applying Toffoli Gates, it leaves the state with some Pauli corrections and Clifford gate corrections depending on the one pad key used for (QOTP) by Client. QOTP cannot deal with Clifford gate errors and hence it needs to be corrected before the operation of next gate. These Clifford gate corrections are a combination of CNOT corrections dependent on pad key and Hadamard correction independent of pad key. Applying Hadamard requires no extra information but CNOT gate errors require revelation of one pad keys. FHE deals with this problem via Encrypted CNOT operation using TCF which only needs client to prepare one-time padded superposition states. Sever thus, updates the Pauli keys accordingly and at the end of computation, sends encrypted output to the Client with updated Pauli keys. Client decrypts sent states and gets correct output in Output Correction stage. Following is an outline of the steps involved in the scheme, assuming depth of circuit (see notations used) equal to L.

Server repeats the same procedure for each layer and finally sends the updated Pauli encryption and quantum one time padded output of the circuit to Client. Client uses the encrypted pad keys of both qubits related to the CNOT error and converts it to another ciphertext using AltHE.

* '''Decryption''' The sent Pauli corrections are updated with public key of the last evaluation key used. This is the (L + 1)th public key and hence, Client uses (L + 1)th secret key (which was not included in the evaluation keys) to decrypt the updated encryption of pad key sent by the Server. Thus, she uses the resulting pad key to undo the quantum one time pad on the sent output state.

== Notations ==

* x˜ encryption of x

* Lc, depth of a layer of circuit where each layer contains clifford gates and Toffoli gates

* (µ0,r0)(µ1,r1) random claw for TCF pair, for given y

* d, measurement outcome of the second register

== Properties ==

*''Quantum Capable'' A classical HE is quantum capable i.e. can perform quantum computation efficiently if there exists AltHE which can execute natural XOR operations.

*''Indistinguishability under Chosen Plaintext Attacks by adversary(IND-CPA)'' The presented classical FHE scheme is CPA secure i.e. it is not possible for any polynomial time adversary to distinguish between the encrypted classical message bits 0 and 1, by learning with errors.

*''Circular Security'' This orotocol has a stronger notion of circular security where not only the secret key but also the trapdoor functions are encrypted when provided to the Server.

==='''Stage 1''' Client’s Preparation===

   

# Client decrypts ˜a,˜b using skL+1 to obtain a,b.

# She then uses the decrypted Pauli corrections to get the output XaZb |li, which can be represented as a ⊕ l.<br/>She operates XaZb on quantum output to get C|ψi, in case of quantum output.