Implementing quantum one time programs on cheap hardware for fun and profit

Transcript

Hello everyone, my name is Fabitio and today I will tell you about quantum one time programs. Uh just uh for the sake of statistics, how many of you are familiar with postquantum cryptography or know about this? Perfect. This talk is not about that. This is not about making our cryptography classical cryptography secure. It's about uh honest to god uh quantum infrastructure used in crypto. So okay. Um so yeah uh in this talk basically I will describe increasingly more complex ways of playing with quantum infrastructure in web 3. The

main ingredients we will rely on are trusted execution enclaves which are quite a famous topic in web3 cryptography at the moment and um QKD infrastructure which is the basically most consumer ready quantum infrastructure that we have today. Um now tees you know there is a lot of like fuss around tees. Some people say they are actually secure. Other people say well actually they are not as secure as we would like them to be. But the point is that in at the interplay between quantum and tees we can harden the you know security model of TE's basically.

Okay. So uh as a software we'll basically rely on T rust which is a rust library that we developed to do conjugate coding uh on uh TE's. I I will go through that in a second. Uh that's the link if you want to play with it. Uh yeah. So let's start with a recap. So what is a one time program? Uh as the name says it's a program that can be used only once. Uh they are useful for a lot of things especially in finance. You can imagine a quantum one time program as a program that for instance encapsulates some depth and then you can use it only once to redeem the depth and and since you cannot copy a one time program by definition you could really treat it as a resource and trade it

around. Now uh one time programs are provably impossible both in the quantum and in the classical model. Um they usually require some form of trusted hardware to be implemented. uh and this is why we also have TE's in the mix. Obviously, the name of the game is trying to use TE's as little as possible uh to to make it to make this work. Uh okay. So, uh the quantum thing that we are using uh is conjugate coding. To go through that, I'll very quickly go through what quantum is uh quantum computing and how it works.

So uh the most important unit uh in quantum computing is called a cubit which is a quantum analogous of a bit. Now the thing that you have to know about a cubit is that whereas a bit is usually usually it's literally either zero or one a cubit can be any point on the surface of that sphere which is called the block sphere. So for instance we have a cubit there that is in some state p. Now the interesting thing is that if someone gives you a cubit in principle, you may not know what cubit that is. Uh in indeed uh if you yourself prepared a cubit or know how the cubit has been prepared, you can more or less know what state on the sphere you have.

But if I just give you a cubit, you have no way of knowing what I gave you. And you can still operate on this thing. So for instance, you can rotate it, you can transform it, but you are kind of blind. you don't really know the state you're operating upon. Uh how do you extract information from this? Uh by the act of measuring uh the cubit. So measurement basically amounts to selecting an axis of the sphere. Uh and then what you do is you project the act of measurement projects the cubit on that axis and that gives you a probability. So for instance given that cubit pi we know that if you measure along the 01 axis pi is way more slanted towards zero that toward one. So

with is way more likely that the outcome of this measurement will be zero than one. Now and this is the interesting part after you measure the cubit the cubit ends up collapsing on this axis. So basically if I measure pi and I get zero I completely destroy pi and now I have nothing basically coinciding with the blue with the blue axis pointing upwards. So the act of measuring destroys information forever and this is the kind of key that we use in conjugate coding. So the idea of conjugate coding is quite simple. We want to encode uh two classical bits in two quantum bits in a way so that you can only recover

one of these. And to do that we just look at these two axis right and they are orthogonal. So basically if you have either zero or one on the red axis. So uh a quantum state that is either the north pole or the south pole and then you measure along the blue axis what you get is 50/50. It's literally unbiased. It's like flipping a coin. So basically, if I measure the a state on the red axis along the blue axis, I get random noise. On the contrary, if I have again the north pole and I measure along the red axis, then I get the north pole with certainty. It's like it's basically completely certain that we'll get zero

and not one. So now the idea is that I encode uh the first bit on the red axis. So if the first classical bit is zero is north pole, if it's one is south pole and I encode the second bit uh on the plus minus axis. So again I go left if I want zero for instance and I want I go right if I want one. Now I scramble the order of these two cubits and I don't tell you which is which. So you see two cubits and you don't know in principle which one has been encoded on the red axis and which one has been encoded on the blue axis. So now to extract information what you have to do is you say okay I

want to recover the first bit then you measure both cubits on along the red axis and what you get is the first bit with certainty and noise. Um on the contrary if you want to measure along the other axis you get the second bit with certainty and noise. The point is again that at this stage you don't know which bit is the real bit and which bit is noise and that's where you need the TE. The t will basically store the original ordering and will tell you okay given this string that you obtained from the measurement I know how to clean up the noise how to distinguish the noise from the real uh bit. But the important

thing is that the t only knows the position of the noise. So after I measured uh the information regarding the bit I didn't care about is completely destroyed. Okay. So what does tras do? TAS basically just encodes this simple protocol and the way it works is that we have a preparation phase where the preparing party prepares these cubits and sends them to the receiving party using some QKD infrastructure. So basically fiber optic that preserves polarization of light. Uh then there is an input phase where the person that wants to use the program uh gives an input to the program and what the TE does it says okay given this input I

need you to perform this measurement you have to read this bit this bit this bit so you perform the measurement you feed this string to the TE uh and then there is a result phase where the TE evaluates the string and tells you okay I can execute this program or not you can harder harden this thing further by using garbet circuits and other primitives to to make it so no really important information is in the TE in the best like model that you can do. uh basically you can extract uh both the bits and so run the program as many times as you want only if you hijack both the TE and the measurement equipment before the measurement is

performed which is a very tight window and it's generally a good thing okay now how do we play with this thing there are basically three levels of playing here this is the $10 setup which is basically no quantum at all you just have a couple of ESP 32. They're like $4 each or in this case an ESP32 and an Arduino. So what happens is that the ESP has the TE functionality on it. It's not like a super hardened thing. It's actually more of a toy, but you know, you can encrypt the firmware, etc. And the Arduino is actually mimicking the quantum measurement outcome. So the T here is saying hey can you measure the uh first couple of cubits on the Z basis for

instance on the red axis and that thing is giving you uh the noise and the actual like uh numbers. So it's a simulator uh that you can download and play with uh but it's uh quite nice you know if you want to have a taste of quantum and you are on a budget. Okay then there is the most interesting setup. The more interesting setup is basically using something a bit more quantum which is the properties of polarization of light. So the way this works is that remember when I I showed you the conjugate coding thing. Now you can imagine that red and blue axis are two different ways of polarizing light and the choice of bit is a mask. So here

basically what I do is uh for instance I'm doing the Z axis and I'm encoding a one. Now I'm encoding a zero and now I'm coding the second bit. So I change polarization and I can still I use the mask and do this kind of stuff. Now the measurement phase uh amounts to select the same uh polarization the polarization screen uh a polarization selector and observing something on the screen. Now you see that you know if you polarized uh on the vertical axis vertically you encoded one and I detect I decode uh your ray of light using the same vertical polarization then I get a

one uh it's sorry yeah uh but if I change polarization basis now I basically won't see anything it will be like a very faint scramble thing. Um so again you can play with this thing. There are a few problems here. Clearly this must be an interactive protocol because you are not really storing cubits. You're just playing with light. Um but it still gives you a feeling. There is also another problem that is quantum is a property of particles. So if you have a photon that is generally quantum but in here we don't have a photon. We literally have a lay ray of light that carries billions and trillions of

photons per second. So, you know, I could time this thing. This is definitely not a secure setup. I could time this thing to basically extract way more information than I'm supposed to. And this brings us to the real setup, which is this mess here. This is the 50k uh setup uh which is genuinely quantum. So, this is genuinely you know QKD infrastructure. You can see like some fiber optic free space columators there. Uh that big fat box there is a single photon laser. So it's literally a laser that just shoots one photon. And those things there to the right are single photon detectors that are literally just like detecting one photon. And then you

have some shutters and and some things and and obviously our best friend the osilloscope that is the only one that tells us if we are getting something interesting or not. Uh and so yeah that's basically the thing. The problem is that you know these single laser detectors and emitters cost an arm and a leg and that's why this setup is so expensive. Uh so again feel free to play and you know contribute to this library which is open source. There are plenty of examples and and yeah let me know if you like it. I want just to conclude with an announcement. So in June 17th June 18th precisely we will give the first demonstration of this uh of this

experiment. So we will be at this villa in southern Italy and we will actually run you know this quantum experiment. So, you know, if you want to come by and and take a look at, you know, quantum web tree interaction, that's probably something interesting. Yeah, that's it. I think we have a still a bit of time for questions, right? Nice. Okay. This is more like a curious rather than anything, but do you actually have a $50,000 setup in your lab? Okay. Yes, unfortunately. like our bank account is not tanking us right now but yes we do.

Yeah. So we will carry all this thing at the event by the way. So from London you know uh we'll have to bring everything in a trolley hoping that nothing breaks down. Hi thank you. Uh so my question is what breaks if the if the tea is broken what breaks in the protocol? Okay. So there are basically two ways of playing this or playing it with this. The first one is that your program is on the TE. In that case if the TE breaks the program can be extracted and so it's not much better than what we have now. Now there is a second thing. The second thing is you encode your program in a galbert circuit basically and instead of

using oblivious transfer which is basically an interactive protocol what you do is you encode the tags of the galbert circuit in conjugate coding and the te just knows how to clean uh those measurements from entropy. So if you have access to the TE before you measure now you know how to measure strategically and instruct both strings but if you you know hijack the TE afterwards uh then the strings have already collapsed. Most importantly, even if a remote attacker has access to their to your TE and can read the, you know, entropy encoding, they need to actively

have access to your measurement device. So, they need your cooperation basically. So, yeah, that's it. Thank you for that. What are the main use cases you envision for this? Uh well especially everything like oneshot signature and you know one time program when you look at for instance execution delegation or stuff like that the idea is that I could give you a program uh and we know that quantum memories are becoming better and better now they are you know they have a lifetime uh in the span of seconds but they are

progressing at uh three orders of magnitude per year. So hopefully within a couple years we will have a time span in the order of hours or hundreds of hours and then what I can do is I give you a one-time program. I give you the string and you are free to do whatever you want with it at zero latency in a fully non-interactive way. So yeah those are the main applications. It's July. The event is in July. Yes, July. Okay, very good. Is it June? Oh, I'm an idiot. Oh, yes, it's in July.

Yes, otherwise would travel in the past. Yeah, sorry. One month from now. Uh, one, two weeks from now, basically. Yeah. Okay. I guess this is Thank you. Thank you.