Practical quantum digital signatures

Digital signature schemes enable a message to be securely signed, so that one or more recipients can be sure of its authenticity. R. Rivest, one of the inventors of the widely used RSA algorithm for public key cryptography, wrote in 1990 that "The notion of a digital signature may prove to be one of the most fundamental and useful inventions of modern cryptography". Indeed, digital signature schemes are today used extensively e.g. in internet commerce, and are of immense economic importance. Unfortunately all known classical digital signature schemes rely on unproven computational assumptions for their security. Quantum digital signature schemes, on the other hand, can be made unconditionally secure based only on the validity of quantum mechanics, similar to how the security of quantum key distribution is guaranteed. Distribution of a secret cryptographic key ensures the privacy of an encrypted message. Authentication and digital signature schemes, on the other hand, ensure the integrity of a message. This is different but no less important. Key distribution for cryptography also requires some kind of separate authentication scheme in order to work, since otherwise one cannot know that one is talking to the right person (a so-called "man-in-the-middle attack" becomes possible).

Quantum key distribution is one of the very few applications of quantum technology that are already commercially available. In contrast to quantum key distribution, however, no experimentally feasible scheme for quantum digital signatures has been proposed, until now. Existing schemes for quantum digital signatures use non-orthogonal quantum states distributed as "quantum signatures". For a classical physical system, there is in principle no limit to how well we can determine its position, velocity, colour, and so on, only practical limitations depending on how good our measurement equipment is. In contrast, quantum states cannot even in principle be perfectly determined or distinguished from each other, no matter how technically perfect our equipment is. Only the distributing party has perfect knowledge of the quantum signatures, allowing only her to later sign messages by giving the full classical description of the states, which can then be tested against the signature states. The recipients must store the signature states in quantum memory until the distributing party wants to sign a message. This requirement for long-term quantum memory unfortunately makes existing protocols completely unfeasible in practice. Quantum states are very fragile and rapidly deteriorate, usually on a scale of milliseconds or faster.

I propose a setting where the recipients measure the quantum signature states immediately after distribution. The quantum measurement they should use sometimes identifies the state perfectly, but sometimes fails. Integrity of a signed message is now guaranteed since no adverse party (including other recipients) can provide the correct description of the signature states for all the cases where identification succeeded. Only the distributing party can do this. Transferrability of messages can be guaranteed if the recipients "compare" the signature states they receive. Comparing quantum states is not as straightforward as comparing classical systems, but is feasible. This project will address the important task of investigating the information-theoretic security of such digital signature schemes which crucially do not require quantum memory, and identify the best scheme(s) in terms of scaling of key length versus level of security, and experimental feasibility of measurements and other components required. In addition to this theoretical work, a proof-of-principle experimental implementation will then be made.

The ultimate technological, societal and economical impact of this work is potentially very large, due to the importance and wide use of digital signature schemes.

Understanding how to manipulate quantum systems is of tremendous technological importance and may lead to huge economic payoffs. The investment in basic research by companies such as IBM, Lucent technologies (Bell Labs), Microsoft research, Hitachi, Fujitsu, and Toshiba is testament to the potential impact of quantum technologies. The proposed research contributes to this challenge. Quantum communication is an emerging technology which could provide security and authentication protocols for the digital economy. Quantum cryptography is already commercially available, and the proposed work paves the way for bringing quantum digital signatures to a similar level.

There is also a shortage of STEM skilled employees in the UK, and it appears that young people are being put off science before they enter higher education. Enthusing the public about STEM subjects is one way to counter this. It is also essential that the public knows about relevant research results in order to make informed decisions about important issues. Especially levels of female students are low in STEM subjects, and the 'leaky pipeline' is of great concern, i.e. the fact that a higher proportion of women than men abandon a career in STEM subjects even after obtaining an undergraduate or postgraduate degree, or further along. This represents a great loss to the UK economy. The proportion of female students continuing with a PhD in Physics is actually higher than for male students, which indicates that the issue most likely is not lack of motivation among female students and researchers. The proposed research has great potential to enthuse the general public, and the applicant and her team have a strong track record in outreach activities. The applicant has also led the Athena Swan effort for Physics at Heriot-Watt (www.athenaswan.org). The Athena Swan Charter is committed to the advancement of the careers of women in science, engineering and technology.