Editing Prepare and Measure Quantum Digital Signature

This [https://arxiv.org/abs/1403.5551 example protocol] achieves the task of [[Quantum Digital Signature]] which allows for the exchange of single or multiple bit classical messages from sender to multiple recipients such that parties are required to prepare and measure quantum states instantly without having to store them. For simplicity, most protocols take into account the case of one sender and two recipients (Seller, buyer, and verifier) exchanging single-bit classical messages.</br> It ensures that the sender (seller) cannot deny at a later stage having signed the message, a recipient (buyer) cannot fake or alter the QDS and another sender (verifier) can use the above two properties to verify if the sent message is signed by the genuine sender, thus, satisfying properties of  [[Quantum Digital Signature#Properties|transferability]], [[Quantum Digital Signature#Properties|unforgeability]] and [[Quantum Digital Signature#Properties|non-repudiation]] respectively. It allows the user to sign electronic documents.</br>

*'''Honest majority assumption:''' assumes that more than half of the number of participating parties are honest. In the present case, at least two parties are honest.

Quantum Digital Signature (QDS) protocols can be separated into two stages: the distribution phase, where quantum signals (public keys) are sent to all recipients, and the messaging phase, where classical messages are signed, sent and verified. Here, we take the case of three parties, one sender (referred to as seller) and two receivers (buyer and verifier) sharing a one-bit message.  

*''' Key Distribution:''' Seller generates her (public key, private key) pair and shares the public key with both receivers in this step. For each possible message (0 or 1), she generates two identical sequences/copies (one for each receiver per possible message) of randomly chosen BB84 ∈ {0,1,+,−} states. The sequence of states is called quantum public key and its classical description, private key. She then sends copies of each quantum public key to the receivers while keeping both the private keys secret to herself. At the end of this step, the seller has two private keys, one for each possible message. Similarly, each receiver has two quantum public keys, one for each possible message.

*''' State Elimination:''' Receivers store their classical records of the quantum public keys in this step. For each quantum public key received, a receiver randomly chooses pauli X or Z basis for each qubit and measures. Whatever outcome he gets, the receiver is certain that seller could not have generated a state orthogonal to his outcome. So, he records the state orthogonal to his outcome as the eliminated signature element. Such measurement is called ’Quantum State Elimination’. The sequence thus generated by measurement of all the qubits in a public key is called receiver’s eliminated signature for the respective quantum public key. Thus, each receiver finally has two eliminated signatures, one for each possible message.

*'''Symmetrisation:''' The two receivers exchange half of their randomly chosen eliminated signature elements. This prevents a dishonest seller to succeed in cheating by sending dissimilar public keys to the receivers. Thus ends the distribution phase.

Next the messaging phase is divided into the following steps:

*''' Signing:''' Seller sends desired classical one-bit message and the corresponding private key to the desired receiver (called buyer). Buyer compares the private key with his eliminated signature for the corresponding message and counts the number of mismatches (eliminated signature element in seller’s private key).

==Requirements==

**Benchmark values per qubit: QBER: 1-3<math>\%</math>, Transmission distance(d): 200 km, Key Length: 2Mbits, Estimated time: 3.5s, attenuation: 45.8dB at 200kms

 

 

==Protocol Description==

### Buyer chooses <math>b^k_l \epsilon_R \{0,1\}</math>  

###If <math>b^k_l=1</math>, Buyer measures his qubit in Z basis <math>\{|0\rangle,|1\rangle\}</math>

**Verifier repeats State Elimination steps with randomly chosen basis <math>v^k_l</math> to get his eliminated signature elements <math>V^k_l</math>

**'''Signing:''' `mismatch’ is when Buyer finds an eliminated signature element in Seller’s private key

##Buyer counts the number of mismatches (<math>B^m_l=\beta^m_l</math>) and returns <math>S_b</math>

##Verifier counts the number of mismatches (<math>V^m_l=\beta^m_l</math>) and returns <math>S_v</math>

The protocol under discussion (1) was the first version of Quantum Digital Signatures with only prepare and measure QKD components. The assumption authenticated quantum channel would render it useless as authenticated quantum channel is a more complex protocol. Thus in (6), a variant of this protocol overcomes this assumption by using a Key generation protocol (not QKD) for authentication where, instead of Seller, Buyer and Verifier sends quantum public keys to the Seller to measure in randomly chosen basis and generate her private keys. This variant is the '''simplest''' QDS protocol from the point of view of implementation. Following description for various papers on QDS protocols and their variants have been written keeping in mind the hardware requirements, assumptions, security and method used. One of the papers discusses generalisation of protocols to more than 3 parties and another one discusses security for iterating in case of sending multiple bits.

#[https://arxiv.org/abs/1507.03333 YFC (2016)] first QDS scheme without authenticated (trusted) quantum channels. Demonstrates one protocol with two implementation, two copies of single photon method and  decoy state method. First uses single qubit photons in three bases; Private key: classical description of states, Public key: pair of [[non-orthogonal states]] in any two of the three bases.  

#[https://arxiv.org/abs/1507.02975 AWKA (2015)] QDS scheme without authenticated quantum channels using parameter estimation phase. Uses a Key Generation Protocol (KGP) where noise threshold for Seller-Buyer and Seller-Verifier is better than when distilling secret key from QKD. Seller sends different key to Buyer and Verifier using KGP. This anomaly is justifiable due to symmetrisation.

#[https://www.nature.com/articles/srep09231 WCRZ (2015)] demonstrates sending multi-bit classical messages using [https://arxiv.org/abs/1507.02975 AWKA (2015)] or other similar protocols.</br>

#[http://iopscience.iop.org/article/10.1088/1742-6596/766/1/012021 MH (2016)] security proof for generalisation of [https://arxiv.org/abs/1507.02975 AWKA (2015)] to more than two recipients case.

#[https://physics.aps.org/featured-article-pdf/10.1103/PhysRevLett.113.040502 Collins et al (2014)] first experimental demonstration of a QDS scheme without quantum memory, implements a variant of [https://arxiv.org/abs/1309.1375 DWA (2013)]. Uses unambiguous state elimination (USE) instead of unambiguous state determination (USD)

#[https://arxiv.org/abs/1509.07827 Donaldson et al (2015)] Implements [https://arxiv.org/abs/1403.5551  WDKA (2015)].

#[https://www.ncbi.nlm.nih.gov/pubmed/27805641 Collins et al (2016)] Implements modified [https://arxiv.org/abs/1507.02975 AWKA (2015)]

#[https://www.nature.com/articles/s41598-017-03401-9 Collins et al (2017)] Implements modified [https://www.researchgate.net/publication/280034032_Secure_Quantum_Signatures_Using_Insecure_Quantum_Channels  AWKA (2015)] using DPS QKD  

#[https://journals.aps.org/pra/abstract/10.1103/PhysRevA.95.032334 Yin et al (2018)] Implements decoy state QDS scheme in [https://arxiv.org/abs/1507.03333 YFC (2016)]  

#[https://journals.aps.org/prapplied/abstract/10.1103/PhysRevApplied.10.034033 Zhang et al (2018)] Implements a [[Decoy State QKD|passive decoy state]] protocol which uses Passive BB84 Key Generation protocol (KGP) to share public keys from Bob and Charlie to Alice.