Experimental Demonstration of Quantum Fully Homomorphic Encryption with Application in a Two-Party Secure Protocol

A fully homomorphic encryption system hides data from unauthorized parties while still allowing them to perform computations on the encrypted data. Aside from the straightforward benefit of allowing users to delegate computations to a more powerful server without revealing their inputs, a fully homomorphic cryptosystem can be used as a building block in the construction of a number of cryptographic functionalities. Designing such a scheme remained an open problem until 2009, decades after the idea was first conceived, and the past few years have seen the generalization of this functionality to the world of quantum machines. Quantum schemes prior to the one implemented here were able to replicate some features in particular use cases often associated with homomorphic encryption but lacked other crucial properties, for example, relying on continual interaction to perform a computation or leaking information about the encrypted data. We present the first experimental realization of a quantum fully homomorphic encryption scheme. To demonstrate the versatility of a a quantum fully homomorphic encryption scheme, we further present a toy two-party secure computation task enabled by our scheme.

Popular Summary

Fully homomorphic encryption (FHE) enables a variety of fascinating cryptographic applications. These include secure delegated computation (where a server can help perform computation on clients’ encrypted data without having to decrypt it first), zero-knowledge proofs (where one party can prove to another that one has the answer to a problem or function without having to divulge what that answer is), and two-party secure computation (where two parties, each possessing a different secret, can jointly compute an answer that depends on their secret, without either party having to divulge their secret to the other). Here, we present the first implementation of a quantum FHE scheme.

While the first FHE for classical computers was constructed a decade ago, a similar effort on the quantum computing front culminated in a theoretical proposal only recently. To date, all experimental implementations have either focused on particular use cases at the expense of the FHE’s versatility or compromised on security. Our work represents the first experimental implementation of a quantum scheme that is unencumbered by caveats that prevented previous schemes from being applicable to a wide range of cryptographic uses. We also demonstrate a two-party computation task to highlight the capabilities of our FHE scheme.

We hope this work will aid and encourage other researchers in exploring the wide gamut of potential cryptographic use cases enabled by quantum FHE and its real-world implementation.

Figure 1

Key transformation under Clifford gates. In circuit diagrams above, $Z^a{X}^b$ and $Z^{a^{\prime }}{X}^{b^{\prime }}$ are encrypting and decrypting maps performed by Alice. The symbol $\oplus$ denotes addition modulo 2.

Figure 2

The ancilla qubit(s) usage in three canonical cases for single-qubit Clifford sequences followed by a $T$ gate. By $a^{\prime }$ and $b^{\prime }$ we denote the result of transforming decryption keys $a$ and $b$ in accordance with Fig. 1 for every Clifford operation that precedes the $T$ gate (which here are the gate sequences $T$, $TH$, and $THP$). Here, $r,s\in \{0,1\}$ are random bits that secure $|{\xi }_a⟩$ and $|{\xi }_b⟩$, respectively.

Figure 3

Securely applying a $P^{†b}$ phase correction with aid of an appropriate ancilla. Since $r$ is a random bit, Bob (represented by dashed box) remains ignorant of Alice’s key $b$.

Figure 4

Circuit to combine ancillary qubits $Z^r{P}^{a_j}|+⟩$ and $Z^s{P}^{b_k}|+⟩$ produces a new ancillary qubit $Z^q{P}^{a\oplus b}|+⟩$. This way, Bob can generate any one of $2^{2N}$ possible ancillary qubits whose phase takes the form of sums (modulo 2) of Alice’s Pauli keys $a_j$ and $b_k$.

Figure 5

Diagram of our QFHE scheme. (a) The intended computation $U$ performed by Bob directly on plaintext $|\varphi ⟩$. (b) The same computation $U$ performed via QFHE. Here $\mathcal{E}$ and $\mathcal{D}$ are encryption and decryption operations. The computational map performed by Bob is a quantum channel that depends on the intended computation on $U$, and consumes some ancillas $|\xi ⟩$ in the process. Classically homomorphically encrypted Pauli keys $\mathrm{Enc}(\overrightarrow{a},\overrightarrow{b})$ are modified along the way. Alice decrypts $\mathrm{Enc}(\overrightarrow{a},\overrightarrow{b})$, which allows her to decrypt $|\psi ⟩$ and obtain the desired output $U|\varphi ⟩$.

Figure 6

Schematic of optical circuit designed to implement each canonical case enumerated in Fig. 2. Each incoming rail from the left is a separate photon from a SPDC event (see Fig. 7 for source schematic). Liquid-crystal retarders allow us to modulate the phase of a qubit much more quickly and precisely than a motorized wave plate mount. Two-qubit gates shown here in dashed boxes can be bypassed as necessary, either by swapping a photon onto another rail (gray dashed lines) or by translating “cnot 1” out of the optical path.

Figure 7

Schematic of our double-pass SPDC source. The pump (blue) is retroreflected to make a second pass through the BBO crystal.

Figure 8

Tomographic reconstruction of $T$ unitary operator. From top left to bottom right: (a) initial Bloch sphere of pure states, (b) simulation of that Bloch sphere under ideal $T$, (c) experimental reconstruction with correct decryption, and (d) experimental reconstruction with bad decryption.

Figure 9

Tomographic reconstruction of $TH$ unitary operator. From top left to bottom right: (a) initial Bloch sphere of pure states, (b) simulation of that Bloch sphere under ideal $TH$, (c) experimental reconstruction with correct decryption, and (d) experimental reconstruction with bad decryption.

Figure 10

Tomographic reconstruction of $THP$ unitary operator. From top left to bottom right: (a) initial Bloch sphere of pure states, (b) simulation of that Bloch sphere under ideal $THP$, (c) experimental reconstruction with correct decryption, and (d) experimental reconstruction with bad decryption.

Figure 11

Background compensated version of Fig. 10.

Figure 12

Tomographic reconstruction of $T$ unitary operator. From top left to bottom right: (a),(b) real and imaginary parts of process matrix, given correct decryption, and (c),(d) real and imaginary parts of process matrix, given wrong decryption.

Figure 13

Tomographic reconstruction of $TH$ unitary operator. From top left to bottom right: (a),(b) real and imaginary parts of process matrix, given correct decryption, and (c),(d) real and imaginary parts of process matrix, given wrong decryption.

Figure 14

Tomographic reconstruction of $THP$ unitary operator. From top left to bottom right: (a),(b) real and imaginary parts of process matrix, given correct decryption, and (c),(d) real and imaginary parts of process matrix, given wrong decryption.

Figure 15

(a) A simple comparator circuit. (b) A secure comparator that uses our QFHE scheme. Here, ${\sigma }_{\alpha }^{(i)}$ is the $i$th encrypted copy of Alice’s qubit, ${\rho }_{\beta }$ is Bob’s qubit, and $k_1^{(i)},k_2^{(i)}\in \{0,1\}$ are classical measurement outcomes.

Figure 16

Experimental setup for our secure comparator two-party protocol.

Figure 17

Plot of measured versus actual infidelity between two states, given correct decryption. Dashed line indicates expected theoretical values.

Figure 18

Plot of measured versus actual infidelity between two states, given wrong decryption. Dashed line indicates expected theoretical values—decrypting with an erroneous key should yield 0.5 (i.e., infidelity relative to the maximally mixed state). Good agreement with this dashed line indicates that result of the computation is well hidden from parties without a valid decryption key.

Figure 19

Bloch vector components of the output photon from phase-add gate as a function of LCWP retardance $\varphi$. Solid lines are theoretical predictions. The LCWPs prepare photons in the states $(|H⟩+e^{i\varphi }|V⟩)/\sqrt{2}$ and $(|H⟩-|V⟩)/\sqrt{2}$. The output state is consistent with $(|H⟩+e^{i(\varphi +\pi )}|V⟩)/\sqrt{2}$. Each point represents $\approx 1000$ photons. Density of points is not uniform along $x$ axis because the LCWP’s retardance is nonlinear with respect to driving voltage.