Continuous-variable quantum digital signatures over insecure channels

Digital signatures ensure the integrity of a classical message and the authenticity of its sender. Despite their far-reaching use in modern communication, currently used signature schemes rely on computational assumptions and will be rendered insecure by a quantum computer. We present a quantum digital signatures (QDS) scheme whose security is instead based on the impossibility of perfectly and deterministically distinguishing between quantum states. Our continuous-variable (CV) scheme relies on phase measurement of a distributed alphabet of coherent states and allows for secure message authentication against a quantum adversary performing collective beamsplitter and entangling-cloner attacks. Crucially, in the CV setting we allow for an eavesdropper on the quantum channels and yet retain shorter signature lengths than previous protocols with no eavesdropper. This opens up the possibility to implement CV QDS alongside existing CV quantum key distribution platforms with minimal modification.

Figure 1

Schematic of three-party QDS. The parties share quantum distribution channels (solid lines), public classical channels (dot-dashed lines), and Bob and Charlie share an encrypted classical channel (dashed lines). Initially, sender $A$ distributes her classical signatures $\{{\mathrm{\Phi }}_m^B,{\mathrm{\Phi }}_m^C\}$ via the quantum states $|\alpha {\varphi }_j^{B,C}\rangle$ by encoding into the QPSK alphabet. Then she sends a message $m$ to recipients Bob ($B$) and Charlie ($C$), with the corresponding signatures, through the public classical channel. $B$ and $C$ use the signatures to authenticate $m$. The encrypted classical channel is used during the Symmetrization step of the protocol. Inset: the QPSK alphabet of coherent states with amplitudes $\alpha \in \mathbb{C}$.

Figure 2

After measuring the phase of a distributed coherent state, Bob and Charlie eliminate the two alphabet states which were least likely to have given that outcome. (a) An individual measurement outcome $x$ with $\text{Re}\left(x\right)\ge 0$, $\text{Im}\left(x\right)\ge 0$. (b) The corresponding eliminated signature element. The states $|-\alpha \rangle ,|-i\alpha \rangle$ are the least likely from our alphabet to give $x$, so they are eliminated.

Figure 3

Schematic of the beamsplitter attack. Alice distributes her state ${\rho }_A$ through a lossy channel with transmission $T$, modeled as a $\{T,1-T\}$ beamsplitter with vacuum input at the fourth port. Bob and Charlie collect their states from the reflected and transmitted ports, respectively.

Figure 4

A single eliminated signature element corresponds to an entire phase quadrant as an allowed region for the phase measurement outcome. (a) An eliminated signature element. (b) The element can be generated by any heterodyne measurement outcome in the shaded region.

Figure 5

Schematic of the entangling cloner attack. Bob replaces the vacuum input into the beamsplitter by one of his TMSV modes, and collects the output. Correlations between the output and his retained TMSV mode provide him with an additional advantage, while the attack manifests itself just as thermal noise in the channel. Charlie measures an excess noise $\xi$ above shot noise.

Figure 6

Signature lengths $L$ required to securely sign a 1 bit message, for channel transmission $T$ and coherent state amplitude $\alpha$. The length $L\to \infty$ as $T\to 0$, but remains modest at the realistic distances denoted by vertical gridlines. Left gridline: $T=0.20$ (approximately 20-km fiber); right gridline: $T=0.48$ (approximately 1-km fiber). Solid: $\xi =0\%$ (beamsplitter attack). Dashed: $\xi =2\%$ (entangling-cloner attack). The required signature length $L$ is strongly influenced by the choice of $\alpha$.

Figure 7

Security parameter $g$ as it varies with $\alpha$ for $T=[0.61\text{(upper}\text{curve)},0.47,0.19,0.11,0.01\text{(lower}\text{curve)}]$. Solid: $\xi =0\%$. Dashed: $\xi =1\%$. The optimal $\alpha$ which players should pick varies with $T$ but only slightly varies with $\xi$. Horizontal gridlines denote $O\left(L\right)$ starting from $L\sim {10}^5$ at $g=0.038$ (top) and increasing by a factor of 10 at subsequent lower gridlines, Eq. (21). Red, dot-dashed: The $g$ varying with $\alpha$ for 1 km (upper curve) and 20 km fiber (lower curve) under the previous protocol [11], for $\xi =0\%$. Note that under [11] the optimal $\alpha$'s do not vary with either $T$ or $\xi$.

Figure 8

Optimal signature length $L$ for $\xi =0\%$. At each transmission $T$ the coherent state amplitude ${\alpha }_{\text{opt}}$ is chosen to minimize $L$. We have considered alphabets ${\mathcal{A}}_4$, ${\mathcal{A}}_6$, ${\mathcal{A}}_8$, and ${\mathcal{A}}_2$. Solid: ${\mathcal{A}}_4$. Dashed: ${\mathcal{A}}_6$. Gray, solid: ${\mathcal{A}}_8$. Dot-dashed: ${\mathcal{A}}_2$. Inset: the corresponding ${\alpha }_{\text{opt}}$. Choosing an alphabet size larger than ${\mathcal{A}}_4$ decreases the optimal ${\alpha }_{\text{opt}}$ while slightly increasing the required signature length $L$. As the alphabet size increases it becomes closer to a Gaussian distribution, and so the beamsplitter and entangling-cloner attack become increasingly optimal. The largest jump in protocol efficiency occurs from ${\mathcal{A}}_2$ to ${\mathcal{A}}_4$. Vertical gridlines denote $T$ corresponding to the 20-km (left) and 1-km (right) fiber.