Loss-tolerant measurement-device-independent quantum private queries

Abstract

Quantum private queries (QPQ) is an important cryptography protocol aiming to protect both the user’s and database’s privacy when the database is queried privately. Recently, a variety of practical QPQ protocols based on quantum key distribution (QKD) have been proposed. However, for QKD-based QPQ the user’s imperfect detectors can be subjected to some detector- side-channel attacks launched by the dishonest owner of the database. Here, we present a simple example that shows how the detector-blinding attack can damage the security of QKD-based QPQ completely. To remove all the known and unknown detector side channels, we propose a solution of measurement-device-independent QPQ (MDI-QPQ) with single- photon sources. The security of the proposed protocol has been analyzed under some typical attacks. Moreover, we prove that its security is completely loss independent. The results show that practical QPQ will remain the same degree of privacy as before even with seriously uncharacterized detectors.

Introduction

An ideal symmetrically private information retrieval (SPIR) protocol¹ allows a user, e.g. Alice, to extract an item of a database without revealing any information about which one she has retrieved to the database owner, e.g. Bob (perfect user privacy). Meanwhile, Alice can obtain only one item in a single query (perfect database privacy). SPIR can be used in the internet search and online transactions for the valuable and sensitive information. A SPIR protocol is a 1-out-of-N oblivious transfer (OT) protocol essentially². In the 1-out-of-N OT, Bob sends N bits and Alice chooses which one she obtains. At the end of the protocol Alice knows the chosen bit value but has no information about other bits, while Bob is entirely ignorant of which bit Alice received. The security of classical OT relies on the unproven computational assumptions¹. Unfortunately, Lo has proven that quantum mechanics along cannot provide unconditionally secure perfect quantum OT either³. This implies the impossibility of perfect quantum SPIR. It can be concluded from Lo’s proof that if a quantum SPIR has perfect user privacy, then Alice can perform an Einstein-Podolsky-Rosen-type⁴ attack to access the entire database without being detected.

Despite the no-go theorem about ideal quantum SPIR, some interesting degree of security can be achieved with changes in the model or the security requirements of the protocol. The first attempt of combining the quantum mechanics with SPIR was made by Kerenidis and De Wolf ⁵. However, in their protocol, the database is replicated over more than one owner and it preserves database privacy against only honest user. In 2008, Giovannetti, Lloyd and Maccone proposed a cheat sensitive quantum protocol (GLM08 protocol), named quantum private queries (QPQ), to solve the SPIR problem⁶. The term cheat sensitive means that Alice can catch Bob cheating with a nonvanishing (but nonunity) probability if Bob attempts to learn what Alice queries. The imperfect user privacy is the reason that QPQ can evade the no-go proof of Lo³. The security of GLM08 has been analyzed strictly⁷ and a proof-of-principle experiment has been implemented by De Martini et al.⁸. In the experiment, the bits of database were represented by an array of half-wave plates. If there existed a half-wave plate in one spatial mode, it meant that the corresponding bit was 1. Otherwise the bit was 0. For the user Alice, she prepared two non-orthogonal polarized states (the query state and test state), and sent them to Bob in a random order. The query state was routed into the desired spatial mode to obtain the retrieved bit value. Combining this value with the test state, Alice could verify the honesty of Bob with a certain probability.

The advantage of GLM08 and its improved version⁹ is that the communication and computational complexity has been reduced exponentially. However, the security of the protocols may be seriously compromised in the presence of losses and it will be difficult to retrieve when the dimension of the database is large. In 2011, Jakobi et al.¹⁰ proposed a QPQ protocol (J⁺11 protocol) based on the Scarani-Acin-Ribordy-Gisin 2004 (SARG04) quantum key distribution (QKD) protocol¹¹. J⁺11 is completely impervious to losses and can be easily implemented for large database with mature QKD technology. By adjusting the coefficients of the sent states, Gao et al. made the J⁺11 flexible for either better user privacy or better database privacy (G⁺12 protocol)¹². Referring to the two-way QKD scheme, the QPQ has been designed to perform better in resisting the joint-measurement attack¹³. The QKD-based QPQ is a very practical solution and has been generalized with other QKD protocols^14,15,16. The first experimental demonstration of J⁺11 and G⁺12 has been done on a QKD system¹⁷ with some necessary modifications by Chan et al.¹⁸. In their experiment, four polarized states from two orthonormal bases were prepared randomly by Bob using the phase-randomized weak coherent state (PR-WCS) source. The faint laser pulses were transmitted to Alice trough a 12.4 km dark fiber with sequences of strong light, which acted as quantum frames¹⁷ to synchronize and compensate the time shift. Alice measured the faint pulses by passively selecting one of the bases randomly. After the classical postprocessing, including Bob announcing pairs of non-orthogonal states, key compression and error correction, Alice performed a total of 11 queries at the single-photon level. This experiment shows the feasibility of QKD-based QPQ with state-of-the-art technology. Note that the novel error-correcting code developed by Chan et al.¹⁸ and another one by Gao et al.¹⁹ to address the noise in the channel can protect the privacy of both parties. As the above QPQ protocols focused mainly on retrieving a single bit, multi-bit block QPQ has been proposed^20,43. Another problem is that the projection |Ψ⁻〉 from the case when the parties prepare the states in bases will introduce a high inherent error rate for Alice’s raw key. Thus, an appropriate error-correction code is needed for the correctness of the protocol. Or one can refer the setup proposed for MDI-SARG04 QKD with PR-WCS sources⁴⁴. We will deal with these obstacles in the following research to make the loss-tolerant MDI-QPQ more practical.