Search

Quantum low-density parity-check (qLDPC) codes are a promising construction for drastically reducing the overhead of fault-tolerant quantum computing (FTQC) architectures. However, all of the known hardware implementations of these codes require advanced technologies, such as long-range qubit connectivity, high-weight stabilizers, or multi-layered chip layouts. An alternative approach to reduce the hardware overhead of fault-tolerance is to use bosonic cat qubits where bit-flip errors are exponentially suppressed by design. In this work, we combine both approaches and propose an architecture based on cat qubits concatenated in classical LDPC codes correcting for phase-flips. We find that employing such phase-flip LDPC codes provides two major advantages. First, the hardware implementation of the code can be realised using short-range qubit interactions in 2D and low-weight stabilizers, which makes it readily compatible with current superconducting circuit technologies. Second, we demonstrate how to implement a fault-tolerant universal set of logical gates with a second layer of cat qubits while maintaining the local connectivity. We conduct a numerical brute force optimisation of these classical codes to find the ones with the best encoding rate for algorithmically relevant code distances. We discover that some of the best codes benefit from a cellular automaton structure. This allows us to define families of codes with high encoding rates and distances. Finally, we numerically assess the performance of our codes under circuit-level noise. Assuming a physical phase-flip error probability $\epsilon \approx 0.1\%$, our $[165+8\ell, 34+2\ell, 22]$ code family allows to encode $100$ logical qubits with a total logical error probability (including both logical phase-flip and bit-flip) per cycle and per logical qubit $\epsilon_L \leq 10^{-8}$ on a $758$ cat qubit chip., Comment: 23 pages, 11 figures

The goal of this note is to explain the reconciliation problem for continuous-variable quantum key distribution protocols with a discrete modulation. Such modulation formats are attractive since they significantly simplify experimental implementations compared to protocols with a Gaussian modulation. Previous security proofs that relied crucially on the Gaussian distribution of the input states are rendered inapplicable, and new proofs based on the entropy accumulation theorem have emerged. Unfortunately, these proofs are not compatible with existing reconciliation procedures, and necessitate a reevaluation of the reconciliation problem. We argue that this problem is nontrivial and deserves further attention. In particular, assuming it can be solved with optimal efficiency leads to overly optimistic predictions for the performance of the key distribution protocol, in particular for long distances., Comment: 11 pages, 1 figure

Between NISQ (noisy intermediate scale quantum) approaches without any proof of robust quantum advantage and fully fault-tolerant quantum computation, we propose a scheme to achieve a provable superpolynomial quantum advantage (under some widely accepted complexity conjectures) that is robust to noise with minimal error correction requirements. We choose a class of sampling problems with commuting gates known as sparse IQP (Instantaneous Quantum Polynomial-time) circuits and we ensure its fault-tolerant implementation by introducing the tetrahelix code. This new code is obtained by merging several tetrahedral codes (3D color codes) and has the following properties: each sparse IQP gate admits a transversal implementation, and the depth of the logical circuit can be traded for its width. Combining those, we obtain a depth-1 implementation of any sparse IQP circuit up to the preparation of encoded states. This comes at the cost of a space overhead which is only polylogarithmic in the width of the original circuit. We furthermore show that the state preparation can also be performed in constant depth with a single step of feed-forward from classical computation. Our construction thus exhibits a robust superpolynomial quantum advantage for a sampling problem implemented on a constant depth circuit with a single round of measurement and feed-forward.

Given some group $G$ of logical gates, for instance the Clifford group, what are the quantum encodings for which these logical gates can be implemented by simple physical operations, described by some physical representation of $G$? We study this question by constructing a general form of such encoding maps. For instance, we recover that the $[[5,1,3]]$ and Steane codes admit transversal implementations of the binary tetrahedral and binary octahedral groups, respectively. For bosonic encodings, we show how to obtain the GKP and cat qudit encodings by considering the appropriate groups, and essentially the simplest physical implementations. We further illustrate this approach by introducing a 2-mode bosonic code defined from a constellation of 48 coherent states, for which all single-qubit Clifford gates correspond to passive Gaussian unitaries., Comment: 13 pages, 2 figures, v3: Clifford code with a constellation of 48 coherent states, v4: added description of GKP and bosonic cat codes

Quantum computers often manipulate physical qubits encoded on two-level quantum systems. Bosonic qubit codes depart from this idea by encoding information in a well-chosen subspace of an infinite-dimensional Fock space. This larger physical space provides a natural protection against experimental imperfections and allows bosonic codes to circumvent no-go results that apply to states constrained by a 2-dimensional Hilbert space. A bosonic qubit is usually defined in a single bosonic mode but it makes sense to look for multimode versions that could exhibit better performance. In this work, building on the observation that the cat code lives in the span of coherent states indexed by a finite subgroup of the complex numbers, we consider a two-mode generalisation living in the span of 24 coherent states indexed by the binary tetrahedral group $2T$ of the quaternions. The resulting $2T$-qutrit naturally inherits the algebraic properties of the group $2T$ and appears to be quite robust in the low-loss regime. We initiate its study and identify stabilisers as well as some logical operators for this bosonic code., Comment: 24 pages, python code available at https://gitlab.inria.fr/adenys/the-2t-qutrit, v3 published version

We introduce sequential and parallel decoders for quantum Tanner codes. When the Tanner code construction is applied to a sufficiently expanding square complex with robust local codes, we obtain a family of asymptotically good quantum low-density parity-check codes. In this case, our decoders provably correct arbitrary errors of weight linear in the code length, respectively in linear or logarithmic time. The same decoders are easily adapted to the expander lifted product codes of Panteleev and Kalachev. Along the way, we exploit recently established bounds on the robustness of random tensor codes to give a tighter bound on the minimum distance of quantum Tanner codes., Comment: 35 pages; v3: corrected several minor mistakes. arXiv admin note: text overlap with arXiv:2206.07571

We propose a decoder for the correction of erasures with hypergraph product codes, which form one of the most popular families of quantum LDPC codes. Our numerical simulations show that this decoder provides a close approximation of the maximum likelihood decoder that can be implemented in O(N^2) bit operations where N is the length of the quantum code. A probabilistic version of this decoder can be implemented in O(N^1.5) bit operations., Comment: 11 pages

Quantum key distribution (QKD) enables the establishment of secret keys between users connected via a channel vulnerable to eavesdropping, with information-theoretic security, that is, independently of the power of a malevolent party. QKD systems based on the encoding of the key information on continuous variables (CV), such as the values of the quadrature components of coherent states, present the major advantage that they only require standard telecommunication technology. However, the most general security proofs for CV-QKD required until now the use of Gaussian modulation by the transmitter, complicating practical implementations. Here, we experimentally implement a protocol that allows for arbitrary, Gaussian-like, discrete modulations, whose security is based on a theoretical proof that applies very generally to such situations. These modulation formats are compatible with the use of powerful tools of coherent optical telecommunication, allowing our system to reach a performance of tens of megabit per second secret key rates over 25 km., Comment: 6 pages, 6 figures

We introduce and analyse an efficient decoder for the quantum Tanner codes of that can correct adversarial errors of linear weight. Previous decoders for quantum low-density parity-check codes could only handle adversarial errors of weight $O(\sqrt{n \log n})$. We also work on the link between quantum Tanner codes and the Lifted Product codes of Panteleev and Kalachev, and show that our decoder can be adapted to the latter. The decoding algorithm alternates between sequential and parallel procedures and converges in linear time., Comment: 43 pages

Tanner codes are long error correcting codes obtained from short codes and a graph, with bits on the edges and parity-check constraints from the short codes enforced at the vertices of the graph. Combining good short codes together with a spectral expander graph yields the celebrated expander codes of Sipser and Spielman, which are asymptotically good classical LDPC codes. In this work we apply this prescription to the left-right Cayley complex that lies at the heart of the recent construction of a $c^3$ locally testable code by Dinur et al. Specifically, we view this complex as two graphs that share the same set of edges. By defining a Tanner code on each of those graphs we obtain two classical codes that together define a quantum code. This construction can be seen as a simplified variant of the Panteleev and Kalachev asymptotically good quantum LDPC code, with improved estimates for its minimum distance. This quantum code is closely related to the Dinur et al. code in more than one sense: indeed, we prove a theorem that simultaneously gives a linearly growing minimum distance for the quantum code and recovers the local testability of the Dinur et al. code., Comment: 35 pages, v2: added a description of the quadripartite version of the code and an almost matching upper bound for the distance, v3: full version of the extended abstract appearing at FOCS 2022

We establish an analytical lower bound on the asymptotic secret key rate of continuous-variable quantum key distribution with an arbitrary modulation of coherent states. Previously, such bounds were only available for protocols with a Gaussian modulation, and numerical bounds existed in the case of simple phase-shift-keying modulations. The latter bounds were obtained as a solution of convex optimization problems and our new analytical bound matches the results of Ghorai et al. (2019), up to numerical precision. The more relevant case of quadrature amplitude modulation (QAM) could not be analyzed with the previous techniques, due to their large number of coherent states. Our bound shows that relatively small constellation sizes, with say 64 states, are essentially sufficient to obtain a performance close to a true Gaussian modulation and are therefore an attractive solution for large-scale deployment of continuous-variable quantum key distribution. We also derive similar bounds when the modulation consists of arbitrary states, not necessarily pure., Comment: 36 pages, 6 figures, Python scripts for computing the secret key rate for QAM and PSK modulation available as ancillary files; v2 deals with modulations of arbitrary states; v3 published version

We study a three-fold variant of the hypergraph product code construction, differing from the standard homological product of three classical codes. When instantiated with 3 classical LDPC codes, this "XYZ product" yields a non CSS quantum LDPC code which might display a large minimum distance. The simplest instance of this construction, corresponding to the product of 3 repetition codes, is a non CSS variant of the 3-dimensional toric code known as the Chamon code. The general construction was introduced in Denise Maurice's PhD thesis, but has remained poorly understood so far. The reason is that while hypergraph product codes can be analyzed with combinatorial tools, the XYZ product codes also depend crucially on the algebraic properties of the parity-check matrices of the three classical codes, making their analysis much more involved. Our main motivation for studying XYZ product codes is that the natural representatives of logical operators are two-dimensional objects. This contrasts with standard hypergraph product codes in 3 dimensions which always admit one-dimensional logical operators. In particular, specific instances of XYZ product codes with constant rate might display a minimum distance as large as $\Theta(N^{2/3})$. While we do not prove this result here, we obtain the dimension of a large class of XYZ product codes, and when restricting to codes with dimension 1, we reduce the problem of computing the minimum distance to a more elementary combinatorial problem involving binary 3-tensors. We also discuss in detail some families of XYZ product codes that can be embedded in three dimensions with local interaction. Some of these codes seem to share properties with Haah's cubic codes and might be interesting candidates for self-correcting quantum memories with a logarithmic energy barrier., Comment: 45 pages, 7 figures, v2: updated references, v3: published in Quantum

Hypergraph product codes are a class of constant-rate quantum low-density parity-check (LDPC) codes equipped with a linear-time decoder called small-set-flip (SSF). This decoder displays sub-optimal performance in practice and requires very large error correcting codes to be effective. In this work, we present new hybrid decoders that combine the belief propagation (BP) algorithm with the SSF decoder. We present the results of numerical simulations when codes are subject to independent bit-flip and phase-flip errors. We provide evidence that the threshold of these codes is roughly 7.5% assuming an ideal syndrome extraction, and remains close to 3% in the presence of syndrome noise. This result subsumes and significantly improves upon an earlier work by Grospellier and Krishna (arXiv:1810.03681). The low-complexity high-performance of these heuristic decoders suggests that decoding should not be a substantial difficulty when moving from zero-rate surface codes to constant-rate LDPC codes and gives a further hint that such codes are well-worth investigating in the context of building large universal quantum computers., Comment: 17 pages, 4 figures. Comments welcome

Establishing secure communication links at a global scale is a major potential application of quantum information science but also extremely challenging for the underlying technology. While milestone experiments using satellite-to-ground links and exploiting singe-photon encoding for implementing quantum key distribution have shown recently that this goal is achievable, it is still necessary to further investigate practical solutions compatible with classical optical communication systems. Here we examine the feasibility of establishing secret keys in a satellite-to-ground downlink configuration using continuous-variable encoding, which can be implemented using standard telecommunication components certified for space environment and able to operate at high symbol rates. Considering a realistic channel model and state-of-the-art technology, and exploiting an orbit subdivision technique for mitigating fluctuations in the transmission efficiency, we find positive secret key rates for a low-Earth-orbit scenario, while finite-size effects can be a limiting factor for higher orbits. Our analysis determines regions of values for important experimental parameters where secret key exchange is possible and can be used as a guideline for experimental efforts in this direction., Comment: 13 pages, 11 figures

We introduce the hemicubic codes, a family of quantum codes obtained by associating qubits with the $p$-faces of the $n$-cube (for $n>p$) and stabilizer constraints with faces of dimension $(p\pm1)$. The quantum code obtained by identifying antipodal faces of the resulting complex encodes one logical qubit into $N = 2^{n-p-1} \tbinom{n}{p}$ physical qubits and displays local testability with a soundness of $\Omega(1/\log(N))$ beating the current state-of-the-art of $1/\log^{2}(N)$ due to Hastings. We exploit this local testability to devise an efficient decoding algorithm that corrects arbitrary errors of size less than the minimum distance, up to polylog factors. We then extend this code family by considering the quotient of the $n$-cube by arbitrary linear classical codes of length $n$. We establish the parameters of these generalized hemicubic codes. Interestingly, if the soundness of the hemicubic code could be shown to be constant, similarly to the ordinary $n$-cube, then the generalized hemicubic codes could yield quantum locally testable codes of length not exceeding an exponential or even polynomial function of the code dimension., Comment: 44 pages, an extended abstract appeared at ITCS 2021 v2: journal version

We establish a lower bound on the asymptotic secret key rate of continuous-variable quantum key distribution with a discrete modulation of coherent states. The bound is valid against collective attacks and is obtained by formulating the problem as a semidefinite program. We illustrate our general approach with the quadrature phase-shift keying (QPSK) modulation scheme and show that distances over 100 km are achievable for realistic values of noise. We also discuss the application to more complex quadrature amplitude modulations (QAM) schemes. This work is a major step towards establishing the full security of continuous-variable protocols with a discrete modulation in the finite-size regime and opens the way to large-scale deployment of these protocols for quantum key distribution., Comment: 11 pages, 5 figures; v2: added discussion of more general quadrature amplitude modulation schemes, v3: close to published version

We prove that quantum expander codes can be combined with quantum fault-tolerance techniques to achieve constant overhead: the ratio between the total number of physical qubits required for a quantum computation with faulty hardware and the number of logical qubits involved in the ideal computation is asymptotically constant, and can even be taken arbitrarily close to 1 in the limit of small physical error rate. This improves on the polylogarithmic overhead promised by the standard threshold theorem. To achieve this, we exploit a framework introduced by Gottesman together with a family of constant rate quantum codes, quantum expander codes. Our main technical contribution is to analyze an efficient decoding algorithm for these codes and prove that it remains robust in the presence of noisy syndrome measurements, a property which is crucial for fault-tolerant circuits. We also establish two additional features of the decoding algorithm that make it attractive for quantum computation: it can be parallelized to run in logarithmic depth, and is single-shot, meaning that it only requires a single round of noisy syndrome measurement., Comment: 32 pages

We present a general framework encompassing a number of continuous-variable quantum key distribution protocols, including standard one-way protocols, measurement-device-independent protocols as well as some two-way protocols, or any other continuous-variable protocol involving only a Gaussian modulation of coherent states and heterodyne detection. The main interest of this framework is that the corresponding protocols are all covariant with respect to the action of the unitary group $U(n)$, implying that their security can be established thanks to a Gaussian de Finetti reduction. In particular, we give a composable security proof of two-way continuous-variable quantum key distribution against general attacks. We also prove that no active symmetrization procedure is required for these protocols, which would otherwise make them prohibitively costly to implement., Comment: 14 pages

We adapt a construction of Guth and Lubotzky [arXiv:1310.5555] to obtain a family of quantum LDPC codes with non-vanishing rate and minimum distance scaling like $n^{0.1}$ where $n$ is the number of physical qubits. Similarly as in [arXiv:1310.5555], our homological code family stems from hyperbolic 4-manifolds equipped with tessellations. The main novelty of this work is that we consider a regular tessellation consisting of hypercubes. We exploit this strong local structure to design and analyze an efficient decoding algorithm., Comment: 30 pages, 4 figures

We show that quantum expander codes, a constant-rate family of quantum LDPC codes, with the quasi-linear time decoding algorithm of Leverrier, Tillich and Z\'emor can correct a constant fraction of random errors with very high probability. This is the first construction of a constant-rate quantum LDPC code with an efficient decoding algorithm that can correct a linear number of random errors with a negligible failure probability. Finding codes with these properties is also motivated by Gottesman's construction of fault tolerant schemes with constant space overhead. In order to obtain this result, we study a notion of $\alpha$-percolation: for a random subset $W$ of vertices of a given graph, we consider the size of the largest connected $\alpha$-subset of $W$, where $X$ is an $\alpha$-subset of $W$ if $|X \cap W| \geq \alpha |X|$., Comment: 26 pages

Establishing the security of continuous-variable quantum key distribution against general attacks in a realistic finite-size regime is an outstanding open problem in the field of theoretical quantum cryptography if we restrict our attention to protocols that rely on the exchange of coherent states. Indeed, techniques based on the uncertainty principle are not known to work for such protocols, and the usual tools based on de Finetti reductions only provide security for unrealistically large block lengths. We address this problem here by considering a new type of Gaussian de Finetti reduction, that exploits the invariance of some continuous-variable protocols under the action of the unitary group $U(n)$ (instead of the symmetric group $S_n$ as in usual de Finetti theorems), and by introducing generalized $SU(2,2)$ coherent states. Our reduction shows that it is sufficient to prove the security of these protocols against Gaussian collective attacks in order to obtain security against general attacks, thereby confirming rigorously the widely held belief that Gaussian attacks are indeed optimal against such protocols., Comment: 5+19 pages

In this paper, we show that the zero-knowledge construction for Hamiltonian cycle remains secure against quantum adversaries in the relativistic setting. Our main technical contribution is a tool for studying the action of consecutive measurements on a quantum state which in turn gives upper bounds on the value of some entangled games. This allows us to prove the security of our protocol against quantum adversaries. We also prove security bounds for the (single-round) relativistic string commitment and bit commitment in parallel against quantum adversaries. As an additional consequence of our result, we answer an open question from [Unr12] and show tight bounds on the quantum knowledge error of some $\Sigma$-protocols., Comment: v2, corrected a few typos and added references

We prove a generalization of the quantum de Finetti theorem when the local space is an infinite-dimensional Fock space. In particular, instead of considering the action of the permutation group on $n$ copies of that space, we consider the action of the unitary group $U(n)$ on the creation operators of the $n$ modes and define a natural generalization of the symmetric subspace as the space of states invariant under unitaries in $U(n)$. Our first result is a complete characterization of this subspace, which turns out to be spanned by a family of generalized coherent states related to the special unitary group $SU(p,q)$ of signature $(p,q)$. More precisely, this construction yields a unitary representation of the noncompact simple real Lie group $SU(p,q)$. We therefore find a dual unitary representation of the pair of groups $U(n)$ and $SU(p,q)$ on an $n(p+q)$-mode Fock space. The (Gaussian) $SU(p,q)$ coherent states resolve the identity on the symmetric subspace, which implies a Gaussian de Finetti theorem stating that tracing over a few modes of a unitary-invariant state yields a state close to a mixture of Gaussian states. As an application of this de Finetti theorem, we show that the $n\times n$ upper-left submatrix of an $n\times n$ Haar-invariant unitary matrix is close in total variation distance to a matrix of independent normal variables if $n^3 =O(m)$., Comment: v2: 39 pages, including new application to truncations of Haar random matrices. Comments are welcome

Relativistic cryptography exploits the fact that no information can travel faster than the speed of light in order to obtain security guarantees that cannot be achieved from the laws of quantum mechanics alone. Recently, Lunghi et al [Phys. Rev. Lett. 2015] presented a bit commitment scheme where each party uses two agents that exchange classical information in a synchronized fashion, and that is both hiding and binding. A caveat is that the commitment time is intrinsically limited by the spatial configuration of the players, and increasing this time requires the agents to exchange messages during the whole duration of the protocol. While such a solution remains computationally attractive, its practicality is severely limited in realistic settings since all communication must remain perfectly synchronized at all times. In this work, we introduce a robust protocol for relativistic bit commitment that tolerates failures of the classical communication network. This is done by adding a third agent to both parties. Our scheme provides a quadratic improvement in terms of expected sustain time compared to the original protocol, while retaining the same level of security., Comment: 22 pages, 1 figure

Due to Shor's algorithm, quantum computers are a severe threat for public key cryptography. This motivated the cryptographic community to search for quantum-safe solutions. On the other hand, the impact of quantum computing on secret key cryptography is much less understood. In this paper, we consider attacks where an adversary can query an oracle implementing a cryptographic primitive in a quantum superposition of different states. This model gives a lot of power to the adversary, but recent results show that it is nonetheless possible to build secure cryptosystems in it. We study applications of a quantum procedure called Simon's algorithm (the simplest quantum period finding algorithm) in order to attack symmetric cryptosystems in this model. Following previous works in this direction, we show that several classical attacks based on finding collisions can be dramatically sped up using Simon's algorithm: finding a collision requires $\Omega(2^{n/2})$ queries in the classical setting, but when collisions happen with some hidden periodicity, they can be found with only $O(n)$ queries in the quantum model. We obtain attacks with very strong implications. First, we show that the most widely used modes of operation for authentication and authenticated encryption e.g. CBC-MAC, PMAC, GMAC, GCM, and OCB) are completely broken in this security model. Our attacks are also applicable to many CAESAR candidates: CLOC, AEZ, COPA, OTR, POET, OMD, and Minalpher. This is quite surprising compared to the situation with encryption modes: Anand et al. show that standard modes are secure with a quantum-secure PRF. Second, we show that Simon's algorithm can also be applied to slide attacks, leading to an exponential speed-up of a classical symmetric cryptanalysis technique in the quantum model., Comment: 31 pages, 14 figures

Quantum computers, that may become available one day, would impact many scientific fields, most notably cryptography since many asymmetric primitives are insecure against an adversary with quantum capabilities. Cryptographers are already anticipating this threat by proposing and studying a number of potentially quantum-safe alternatives for those primitives. On the other hand, symmetric primitives seem less vulnerable against quantum computing: the main known applicable result is Grover's algorithm that gives a quadratic speed-up for exhaustive search. In this work, we examine more closely the security of symmetric ciphers against quantum attacks. Since our trust in symmetric ciphers relies mostly on their ability to resist cryptanalysis techniques, we investigate quantum cryptanalysis techniques. More specifically, we consider quantum versions of differential and linear cryptanalysis. We show that it is usually possible to use quantum computations to obtain a quadratic speed-up for these attack techniques, but the situation must be nuanced: we don't get a quadratic speed-up for all variants of the attacks. This allows us to demonstrate the following non-intuitive result: the best attack in the classical world does not necessarily lead to the best quantum one. We give some examples of application on ciphers LAC and KLEIN. We also discuss the important difference between an adversary that can only perform quantum computations, and an adversary that can also make quantum queries to a keyed primitive., Comment: 25 pages

We study a general family of quantum protocols for position verification and present a new class of attacks based on the Clifford hierarchy. These attacks outperform current strategies based on port-based teleportation for a large class of practical protocols. We then introduce the Interleaved Product protocol, a new scheme for position verification involving only the preparation and measurement of single-qubit states for which the best available attacks have a complexity exponential in the number of classical bits transmitted., Comment: 12 pages, 1 figure

We consider the recent relativistic bit commitment protocol introduced by Lunghi et al. [Phys. Rev. Lett. 2015] and present a new security analysis against classical attacks. In particular, while the initial complexity of the protocol scaled double-exponentially with the commitment time, our analysis shows that the correct dependence is only linear. This has dramatic implications in terms of implementation: in particular, the commitment time can easily be made arbitrarily long, by only requiring both parties to communicate classically and perform efficient classical computation., Comment: In an independent and concurrent work, Fehr and Fillinger [FF15] proved a general composition theorem for two-prover commitments which implies a similar bound on the security of the Lunghi et al. protocol than the one derived here

In this work we present a security analysis for quantum key distribution, establishing a rigorous tradeoff between various protocol and security parameters for a class of entanglement-based and prepare-and-measure protocols. The goal of this paper is twofold: 1) to review and clarify the state-of-the-art security analysis based on entropic uncertainty relations, and 2) to provide an accessible resource for researchers interested in a security analysis of quantum cryptographic protocols that takes into account finite resource effects. For this purpose we collect and clarify several arguments spread in the literature on the subject with the goal of making this treatment largely self-contained. More precisely, we focus on a class of prepare-and-measure protocols based on the Bennett-Brassard (BB84) protocol as well as a class of entanglement-based protocols similar to the Bennett-Brassard-Mermin (BBM92) protocol. We carefully formalize the different steps in these protocols, including randomization, measurement, parameter estimation, error correction and privacy amplification, allowing us to be mathematically precise throughout the security analysis. We start from an operational definition of what it means for a quantum key distribution protocol to be secure and derive simple conditions that serve as sufficient condition for secrecy and correctness. We then derive and eventually discuss tradeoff relations between the block length of the classical computation, the noise tolerance, the secret key length and the security parameters for our protocols. Our results significantly improve upon previously reported tradeoffs., Comment: v2: completely revised, improved presentation and finite-key bounds; v3: accepted at Quantum

The ability to distribute secret keys between two parties with information-theoretic security, that is, regardless of the capacities of a malevolent eavesdropper, is one of the most celebrated results in the field of quantum information processing and communication. Indeed, quantum key distribution illustrates the power of encoding information on the quantum properties of light and has far reaching implications in high-security applications. Today, quantum key distribution systems operate in real-world conditions and are commercially available. As with most quantum information protocols, quantum key distribution was first designed for qubits, the individual quanta of information. However, the use of quantum continuous variables for this task presents important advantages with respect to qubit based protocols, in particular from a practical point of view, since it allows for simple implementations that require only standard telecommunication technology. In this review article, we describe the principle of continuous-variable quantum key distribution, focusing in particular on protocols based on coherent states. We discuss the security of these protocols and report on the state-of-the-art in experimental implementations, including the issue of side-channel attacks. We conclude with promising perspectives in this research field., Comment: 21 pages, 2 figures, 1 table

We present an efficient decoding algorithm for constant rate quantum hypergraph-product LDPC codes which provably corrects adversarial errors of weight $\Omega(\sqrt{n})$ for codes of length $n$. The algorithm runs in time linear in the number of qubits, which makes its performance the strongest to date for linear-time decoding of quantum codes. The algorithm relies on expanding properties, not of the quantum code's factor graph directly, but of the factor graph of the original classical code it is constructed from.

We give the first composable security proof for continuous-variable quantum key distribution with coherent states against collective attacks. Crucially, in the limit of large blocks the secret key rate converges to the usual value computed from the Holevo bound. Combining our proof with either the de Finetti theorem or the Postselection technique then shows the security of the protocol against general attacks, thereby confirming the long-standing conjecture that Gaussian attacks are optimal asymptotically in the composable security framework. We expect that our parameter estimation procedure, which does not rely on any assumption, will find applications elsewhere, for instance for the reliable quantification of continuous-variable entanglement in finite-size settings., Comment: 27 pages, 1 figure. v2: added a version of the AEP valid for conditional states

We ask how quantum theory compares to more general physical theories from the point of view of dimension. To do so, we first give two model independent definition of the dimension of physical systems, based on measurements and on the capacity of storing information. While both definitions are equivalent in classical and quantum mechanics, they are in general different in generalized probabilistic theories. We discuss in detail the case of a theory known as 'boxworld', and show that such a theory features systems with a dimension mismatch. This dimension mismatch can be made arbitrarily large by using an amplification procedure. Furthermore, we show that the dimension mismatch of boxworld has strong consequences on its power for performing information-theoretic tasks, leading to the collapse of communication complexity and to the violation of information causality. Finally, we discuss the consequences of a dimension mismatch from the perspective of thermodynamics, and ask whether this effect could break Landauer's erasure principle and thus the second law., Comment: 17 pages, 2 figures

Nonlocality is arguably one of the most fundamental and counterintuitive aspects of quantum theory. Nonlocal correlations could, however, be even more nonlocal than quantum theory allows, while still complying with basic physical principles such as no-signaling. So why is quantum mechanics not as nonlocal as it could be? Are there other physical or information-theoretic principles which prohibit this? So far, the proposed answers to this question have been only partially successful, partly because they are lacking genuinely multipartite formulations. In Nat. Comm. 4, 2263 (2013) we introduced the principle of Local Orthogonality (LO), an intrinsically multipartite principle which is satisfied by quantum mechanics but is violated by non-physical correlations. Here we further explore the LO principle, presenting new results and explaining some of its subtleties. In particular, we show that the set of no-signaling boxes satisfying LO is closed under wirings, present a classification of all LO inequalities in certain scenarios, show that all extremal tripartite boxes with two binary measurements per party violate LO, and explain the connection between LO inequalities and unextendible product bases., Comment: Typos corrected; data files uploaded

BosonSampling is a problem where a quantum computer offers a provable speedup over classical computers. Its main feature is that it can be solved with current linear optics technology, without the need for a full quantum computer. In this work, we investigate whether an experimentally realistic BosonSampler can really solve BosonSampling without any fault-tolerance mechanism. More precisely, we study how the unavoidable errors linked to an imperfect calibration of the optical elements affect the final result of the computation. We show that the fidelity of each optical element must be at least $1 - O(1/n^2)$, where $n$ refers to the number of single photons in the scheme. Such a requirement seems to be achievable with state-of-the-art equipment., Comment: 20 pages, 7 figures, v2: new title, to appear in QIC

We introduce a framework to describe probabilistic models in Bell experiments, and more generally in contextuality scenarios. Such a scenario is a hypergraph whose vertices represent elementary events and hyperedges correspond to measurements. A probabilistic model on such a scenario associates to each event a probability, in such a way that events in a given measurement have a total probability equal to one. We discuss the advantages of this framework, like the unification of the notions of contexuality and nonlocality, and give a short overview of results obtained elsewhere., Comment: In Proceedings QPL 2013, arXiv:1412.7917

So far, most of the literature on (quantum) contextuality and the Kochen-Specker theorem seems either to concern particular examples of contextuality, or be considered as quantum logic. Here, we develop a general formalism for contextuality scenarios based on the combinatorics of hypergraphs which significantly refines a similar recent approach by Cabello, Severini and Winter (CSW). In contrast to CSW, we explicitly include the normalization of probabilities, which gives us a much finer control over the various sets of probabilistic models like classical, quantum and generalized probabilistic. In particular, our framework specializes to (quantum) nonlocality in the case of Bell scenarios, which arise very naturally from a certain product of contextuality scenarios due to Foulis and Randall. In the spirit of CSW, we find close relationships to several graph invariants. The recently proposed Local Orthogonality principle turns out to be a special case of a general principle for contextuality scenarios related to the Shannon capacity of graphs. Our results imply that it is strictly dominated by a low level of the Navascu\'es-Pironio-Ac\'in hierarchy of semidefinite programs, which we also apply to contextuality scenarios. We derive a wealth of results in our framework, many of these relating to quantum and supraquantum contextuality and nonlocality, and state numerous open problems. For example, we show that the set of quantum models on a contextuality scenario can in general not be characterized in terms of a graph invariant. In terms of graph theory, our main result is this: there exist two graphs $G_1$ and $G_2$ with the properties \begin{align*} \alpha(G_1) &= \Theta(G_1), & \alpha(G_2) &= \vartheta(G_2), \\[6pt] \Theta(G_1\boxtimes G_2) & > \Theta(G_1)\cdot \Theta(G_2),& \Theta(G_1 + G_2) & > \Theta(G_1) + \Theta(G_2). \end{align*}, Comment: minor revision, same results as in v2, to appear in Comm. Math. Phys