Practical somewhat-secure quantum somewhat-homomorphic encryption with coherent states

We present a scheme for implementing homomorphic encryption on coherent states encoded using phase-shift keys. The encryption operations require only rotations in phase space, which commute with computations in the code space performed via passive linear optics, and with generalized nonlinear phase operations that are polynomials of the photon-number operator in the code space. This encoding scheme can thus be applied to any computation with coherent-state inputs, and the computation proceeds via a combination of passive linear optics and generalized nonlinear phase operations. An example of such a computation is matrix multiplication, whereby a vector representing coherent-state amplitudes is multiplied by a matrix representing a linear optics network, yielding a new vector of coherent-state amplitudes. By finding an orthogonal partitioning of the support of our encoded states, we quantify the security of our scheme via the indistinguishability of the encrypted code words. While we focus on coherent-state encodings, we expect that this phase-key encoding technique could apply to any continuous-variable computation scheme where the phase-shift operator commutes with the computation.

Figure 1

The boson-sampling model. A string of $n$ single photons is prepared in $m$ optical modes. They are evolved via a passive interferometer $U$. Finally the photon statistics are sampled from the distribution $P\left(S\right)$.

Figure 2

A plot of $D(\mathcal{E}\left({\widehat{\rho }}_{\mathbf{u}}\right),\mathcal{E}\left({\widehat{\rho }}_{\mathbf{v}}\right))$ vs $\left|\alpha \right|$ for $m=10$ and $d=100$, and for various values of $w=\mathrm{wt}(\mathbf{u}\oplus \mathbf{v})$.

Figure 3

A plot of $D({\widehat{\rho }}_{\mathbf{u}},{\widehat{\rho }}_{\mathbf{v}})$ vs $\left|\alpha \right|$ for $m=10$ and $d=100$, and for various values of $w=\mathrm{wt}(\mathbf{u}\oplus \mathbf{v})$.

Figure 4

A plot of $R=D(\mathcal{E}\left({\widehat{\rho }}_{\mathbf{u}}\right),\mathcal{E}\left({\widehat{\rho }}_{\mathbf{v}}\right))/D({\widehat{\rho }}_{\mathbf{u}},{\widehat{\rho }}_{\mathbf{v}})$ vs $\left|\alpha \right|$ for $m=10$ and $d=100$ for various weights $w=\mathrm{wt}(\mathbf{u}\oplus \mathbf{v})$ values. The values of $R$ are less than unity indicating a suppression of distinguishability by the encryption operation.

Figure 5

A plot of $R$ vs $m$ with fixed $\mathrm{wt}\left(\mathbf{x}\right)=1$ strings, where $\mathbf{x}=\mathbf{u}\oplus \mathbf{v}$, and $d=100$ for (i) $E=1.0$ and (ii) $E=m^r$, where $r=0.3$.

Figure 6

A plot of $I(\mathbf{x};{\mathbf{y}}_{\mathrm{PGM}})$ vs $m$ with $d=100$, and fixed $\mathrm{wt}\left(\mathbf{x}\right)=1$ strings for (i) $E=1.0$ and (ii) $E=m^r$, where $r=0.3$.