Digital signature schemes enable a message to be securely signed, so that one or more recipients can be sure of its authenticity. R. Rivest, one of the inventors of the widely used RSA algorithm for public key cryptography, wrote in 1990 that "The notion of a digital signature may prove to be one of the most fundamental and useful inventions of modern cryptography". Indeed, digital signature schemes are today used extensively e.g. in internet commerce, and are of immense economic importance. Unfortunately all known classical digital signature schemes rely on unproven computational assumptions for their security. Quantum digital signature schemes, on the other hand, can be made unconditionally secure based only on the validity of quantum mechanics, similar to how the security of quantum key distribution is guaranteed. Distribution of a secret cryptographic key ensures the privacy of an encrypted message. Authentication and digital signature schemes, on the other hand, ensure the integrity of a message. This is different but no less important. Key distribution for cryptography also requires some kind of separate authentication scheme in order to work, since otherwise one cannot know that one is talking to the right person (a so-called "man-in-the-middle attack" becomes possible).
Quantum key distribution is one of the very few applications of quantum technology that are already commercially available. In contrast to quantum key distribution, however, no experimentally feasible scheme for quantum digital signatures has been proposed, until now. Existing schemes for quantum digital signatures use non-orthogonal quantum states distributed as "quantum signatures". For a classical physical system, there is in principle no limit to how well we can determine its position, velocity, colour, and so on, only practical limitations depending on how good our measurement equipment is. In contrast, quantum states cannot even in principle be perfectly determined or distinguished from each other, no matter how technically perfect our equipment is. Only the distributing party has perfect knowledge of the quantum signatures, allowing only her to later sign messages by giving the full classical description of the states, which can then be tested against the signature states. The recipients must store the signature states in quantum memory until the distributing party wants to sign a message. This requirement for long-term quantum memory unfortunately makes existing protocols completely unfeasible in practice. Quantum states are very fragile and rapidly deteriorate, usually on a scale of milliseconds or faster.
I propose a setting where the recipients measure the quantum signature states immediately after distribution. The quantum measurement they should use sometimes identifies the state perfectly, but sometimes fails. Integrity of a signed message is now guaranteed since no adverse party (including other recipients) can provide the correct description of the signature states for all the cases where identification succeeded. Only the distributing party can do this. Transferrability of messages can be guaranteed if the recipients "compare" the signature states they receive. Comparing quantum states is not as straightforward as comparing classical systems, but is feasible. This project will address the important task of investigating the information-theoretic security of such digital signature schemes which crucially do not require quantum memory, and identify the best scheme(s) in terms of scaling of key length versus level of security, and experimental feasibility of measurements and other components required. In addition to this theoretical work, a proof-of-principle experimental implementation will then be made.
The ultimate technological, societal and economical impact of this work is potentially very large, due to the importance and wide use of digital signature schemes.
|