Measurement Device Independent Quantum Digital Signature (MDI-QDS)

The example protocol achieves the functionality of Quantum Digital Signature (QDS) by allowing exchange of messages using the procedure studied in Prepare and Measure Quantum Digital Signature but without trusting one's measurement devices, thus making the protocol device independent. It uses the security proof of MDI-QKD to the QDS scheme for insecure channels (1). This scheme involves three parties and is designed for signing one bit and the authors suggest that longer messages can be signed by iterating the same process. All three properties that define QDS i.e. non-repudiation, transferability and unforgeability are implied by the protocol.

Tags: Multi Party (three), Quantum Enhanced Classical Functionality, Specific Task, Quantum Digital Signature (QDS), Prepare and Measure QDS

Assumptions

• There exists authenticated classical channels between seller and buyer, and, seller and verifier.
• Receiver and verifier share a MDI-QKD link, used to transmit classical messages in full secrecy.
• Adversary is allowed to perform coherent attacks, which is the most general class of attacks QKD protocols are vulnerable to, due to experimental realisation.

Outline

Quantum Digital Signature protocols can be separated into two stages: the distribution stage, where quantum public keys are sent to all recipients, and the messaging stage, where classical messages are sent and verified. Here, we take the case of three parties, one sender (referred to as seller) and two receivers (buyer and verifier) sharing a one bit message.
The following protocol consists of only quantum communication in the distribution phase and only classical communication in the messaging phase. It uses the protocol for QDS with insecure channels (1) and replaces KGP (Key generation protocol) with Measurement Device Independent KGP (MDI-KGP). Distribution phase can be divided into the following steps:

• Key Distribution: Seller uses MDI-KGP twice with buyer and verifier, to generate two different keys with each, one for message bit 0 and one for message bit 1. Seller's signature for a particular message bit is a conjugation/concatenation of corresponding key for message bit sent to the buyer and the verifier. Below is an overview of MGI-KGP extracted from MDI-QKD (page to be visited in case more explanation is required)
  • MDI-KGP: MDI-KGP consists of only quantum communication part from MDI-QKD protocol in (2). This protocol requires an untrusted third party sitting in the middle of the participating parties, arbitrator. The following steps are performed with seller and each receiver, pairwise for each possible bit (0 and 1). Seller and receiver, both separately prepare a state in a randomly chosen basis (of the two chosen bases, say rectilinear (X basis) and diagonal (Z basis)), and send it to the arbitrator. The arbitrator performs Bell State Measurement on the two incoming states. A successful BSM entangles the two states and the outcome of the measurement is one of the four Bell States, which is declared by the arbitrator over public channel. This process is repeated until sifting condition is met. In sifting, seller and receiver then exchange the preparation basis chosen for each event, which is neglected if the basis is mismatched. If matched then, depending on the basis chosen, data (classical information of their own states/ classical bits) corresponding to each event is classified into two sets. This is repeated unless cardinality of the two sets is above a certain threshold number of elements. The receiver flips his bits (set elements) for each event according to the table shown in Pseudo Code. It is done to correlate seller's bits with receiver's bits. This marks the end of Sifting. Finally, one of the sets is used for error correction in MDI-QKD (not the concern of this protocol), while the other set is divided into two parts, one to be used as the code key and the other, to calculate the error rate. If error rate is greater than the tolerance value decided, the protocol is aborted by both parties. The signature/private key of seller for a particular message bit is the concatenation of both buyer and verifier's code keys corresponding to that bit.
• Symmetrisation: Buyer and Verifier exchange half of their MGI-KGP keys over MDI-QKD link. These become the final keys of the recipients. This prevents a dishonest seller succeed in cheating by sending dissimilar public keys to the receiver and makes the protocol secure against repudiation. Thus ends the distribution phase.

Similarly, Messaging Phase is divided into the following steps:

• Signing: Sender sends desired message and the corresponding signature to the desired receiver (called buyer). Buyer checks for mismatches, first with his half of the key, received directly from Seller and then, with verifier's half shared with him during symmterisation. If there are fewer mismatches than the decided threshold (to check for repudiation, determined by experimental parameters) then buyer accepts the signature.
• Transfer: Buyer forwards the same message and private key to the other receiver (called verifier) who compares it with his key for this message bit in the same way as the buyer, but with a different threshold value (to check for forgery and repudiation).

Requirements

• Network Stage: Prepare and Measure
• Authenticated quantum channel
• Authenticated classical channel
• Estimated parameters (for security level of order $10^{-5}$)
  • Signature length:$10^{6}$ for each message bit 0 and 1.
  • Transmission distance: 50km
  • Estimated time to generate raw keys: 93 minutes (can be improved by using detectors with better efficiency)
• MDI-QKD setup (without error correction and privacy amplification)

Properties

• The strings generated by Sender and Receiver are free from detector side channel attacks as one does not trust measurement devices.
• Implementation of long distance MDI-QKD [Measurement Device Independent Quantum Digital Signature (MDI-QDS)#References|(3)] employs establishes long distance QDS protocol without side channel attacks
• It removes all detector side-channel attacks
• It is valid against repudiation and forging attacks

Protocol Description

Stage 1 Distribution

• Input Key Length ($L$), Threshold values ($s_{a},s_{v}$), error threshold ($E_{tol}$), error rate parameter ($e$)
• Output Seller: $S_{B}^{0},S_{B}^{1},S_{V}^{0},S_{V}^{1}$ Buyer: $B^{0},B^{1}$; Verifier: $V^{0},V^{1}$
  • Key Distribution:

1. For k = 0,1
   1. $S_{B}^{k}=B^{k}=$MDI-KGP(Seller, Buyer, Arbitrator,k)
   2. $S_{V}^{k}=V^{k}=$MDI-KGP(Seller, Verifier, Arbitrator,k)

• • Symmetrisation

1. For k = 0,1
   1. Buyer chooses $I\subset _{R}\{1,2,...,L\},|I|=[L/2]$
   2. $\forall i\epsilon I$, Buyer sends Verifier $(k,i,B_{i}^{k})$
   3. Verifier chooses $J\subset _{R}\{1,2,...,L\},|J|=[L/2]$
   4. $\forall j\epsilon J$, Verifier sends Buyer $(k,j,V_{j}^{k})$

Stage 2 Messaging

• Input Seller: Message $m$, Private Key for $m$: $S_{m}^{B},S_{m}^{V}$
• Output Buyer: accept or abort, Verifier: accept or abort
  • Signing:

1. Seller sends Buyer (m,$S_{m}^{B},S_{m}^{V}$)
2. For l = 1,2,..,L
   1. If $l\epsilon \{1,2,...,L\}-I$
      1. Buyer counts the number of mismatches ($B_{l}^{m}!=S_{l}^{m}$), b=b+1
   2. If $l\epsilon J$
      1. Buyer counts the number of mismatches ($V_{l}^{m}!=S_{l}^{m}$), v=v+1
3. If $(b<s_{a}L/2)$&&$(v<s_{a}L/2)$, Buyer accepts m else he aborts

• • Transfer

1. Buyer sends Verifier (m,$S_{m}^{B},S_{m}^{V}$)
2. For l = 1,2,..,L
   1. If $l\epsilon \{1,2,...,L\}-J$
      1. Verifier counts the number of mismatches ($V_{l}^{m}!=S_{l}^{m}$), v=v+1
   2. If $l\epsilon I$
      1. Verifier counts the number of mismatches ($B_{l}^{m}!=S_{l}^{m}$), b=b+1
3. If $(b<s_{v}L/2)$&&$(v<s_{v}L/2)$, Verifier accepts m else he aborts

Subroutine: MDI-KGP(Seller, Receiver R, Arbitrator,i)

• For k=0,L

1. Seller chooses $s_{\text{basis}}\epsilon \{X,Z\}$ and generates $|a\rangle$
2. Receiver chooses $r_{\text{basis}}\epsilon \{X,Z\}$ and generates $|b\rangle$
3. Seller.send(Arbitrator,$|a\rangle$)
4. Receiver.send(Arbitrator,$|b\rangle$)
5. $|\Psi \rangle$=Arbitrator.BSM($|a\rangle$,$|b\rangle$)
6. If ($|\Psi \rangle !={}$)&&($s_{\text{basis}}=r_{\text{basis}}$)
   1. 1. $A_{R}^{i}(k)=a$
      2. If ($s_{\text{basis}}=r_{\text{basis}}=Z$)
         1. If ($|\Psi \rangle ={\frac {1}{\sqrt {2}}}(|00\rangle +|11\rangle ))||(|Psi\rangle ={\frac {1}{\sqrt {2}}}(|00\rangle -|11\rangle )$) then $R^{i}(k)=b$
         2. If ($|\Psi \rangle ={\frac {1}{\sqrt {2}}}(|01\rangle +|10\rangle ))||(|Psi\rangle ={\frac {1}{\sqrt {2}}}(|01\rangle -|10\rangle )$) then $R^{i}(k)={\tilde {b}}$
      3. If ($s_{\text{basis}}=r_{\text{basis}}=X$)
         1. If ($|\Psi \rangle ={\frac {1}{\sqrt {2}}}(|++\rangle +|--\rangle ))||(|Psi\rangle ={\frac {1}{\sqrt {2}}}(|+-\rangle +|-+\rangle )$) then $R^{i}(k)=b$
         2. If ($|\Psi \rangle ={\frac {1}{\sqrt {2}}}(|++\rangle -|--\rangle ))||(|Psi\rangle ={\frac {1}{\sqrt {2}}}(|01\rangle -|+-\rangle )$) then $R^{i}(k)={\tilde {b}}$

• Error rate calculation

1. Seller and Buyer choose $I\subset _{R}\{1,2,...,L\},|I|=e$
2. $\forall i\epsilon I$, $E_{k}={\frac {1}{e}}\sum _{i}(A_{R}^{k}(i)\oplus R^{k}(i))$
3. If $E_{k}>E_{tol}$ then abort else
4. return ($A_{R}^{k},R^{k}$)

• For more detail on error rate and MDI-KGP Pseudo code, refer MDI-QKD

Further Information

MDI-QDS is so far the best Prepare and Measure Network Stage QDS protocol. It does not rely on the measurement devices and is easy from implementation point of view. Unlike classical schemes, this protocol does not assume a trusted arbitrator. As the platform of widely implemented MDI-QKD is available, MDI-QDS can be implemented most efficiently and provides the best security in the QDS protocols discovered so far. Another approach would be to adapt DI-QKD for key generation. Here one would neither trust the measurement devices nor the source. As seller and buyer both act as an adversary in QDS protocols, we do not want depend on our state preparation devices either. This has not been studied yet due to as QDS protocols discovered so far yet do not match up to the efficiency of classical and post-quantum digital signature schemes in terms of signing time, key length, etc.

• Theoretical Papers

1. Guang et al (2011) A scheme for untrusted arbitartor like MDI-QDS, but trusts its measurement devices

• Experimental Papers

1. Roberts et al (2017) Implementation of the example protocol

References

1. AWKA (2015)
2. Lo et al (2011)
3. Xu et al (2013)

*contributed by Shraddha Singh