Enhanced delegated computing using coherence

0.7 MB·English

by  Stefanie Barz

Enhanceddelegatedcomputingusingcoherence
StefanieBarz1,VedranDunjko2,3,FlorianSchlederer1,MerrittMoore1,ElhamKashefi4,IanA.Walmsley1
1 ClarendonLaboratory, DepartmentofPhysics, UniversityofOxford, OX13PU,UnitedKingdom,
2 Institute for Quantum Optics and Quantum Information,
Austrian Academy of Sciences, Technikerstrasse 21a, A-6020 Innsbruck, Austria
3 InstituteforTheoreticalPhysics,UniversityofInnsbruck,Technikerstrasse25,6020Innsbruck,Austria
4 School of Informatics, Informatics Forum, 10 Crichton Street, Edinburgh, EH8 9AB, UK
Along-standingquestioniswhetheritispossibletodelegatecomputationaltaskssecurely. Recently,botha
classicalandaquantumsolutiontothisproblemwerefound[1,2].Here,westudytheinterplayofclassicaland
quantumapproachesandshowhowcoherencecanbeusedasatoolforsecuredelegatedclassicalcomputation.
Weshowthataclientwithlimitedcomputationalcapacity—restrictedtoanXORgate—canperformuniversal
classicalcomputationbymanipulatinginformationcarriersthatmayoccupysuperpositionsoftwostates.Using
singlephotonicqubitsorcoherentlight,weexperimentallyimplementsecuredelegatedclassicalcomputations
5
1 betweenanindependentclientandaserver.Theserverhasaccesstothelightsourcesandmeasurementdevices,
0 whereastheclientmayuseonlyarestrictedsetofpassiveopticaldevicestomanipulatethelightbeams. Thus,
2 ourworkhighlightshowminimalquantumandclassicalresourcescanbecombinedandexploitedforclassical
computing.
n
a
J
INTRODUCTION tumdelegatedcomputation. Thecentralquestioniswhatkind
7
ofadditionalresourcesaclient,withcapabilityrestrictedonly
2
Cloud computing, the storage and processing of data on toparitycomputations(XOR),needsinordertoperformuni-

] remote servers, has become highly relevant to modern infor- versal classical computations and to delegate those securely
h
mation processing. The question of whether it is possible to toaserver. Weshowthatthiscanbeaccomplishedusingco-
p
- compute over encrypted data was first asked some 35 years bits, systems capable of being in a coherent superposition of
nt ago [3]. With the progress from stand-alone machines to two ”states” (see Fig. 1), for example single photonic qubits
a large connected networks, the security of delegated compu- orcoherentlaserbeams.
u
tations has become increasingly important. In 2009, a clas- Inourscheme,theserverhasaccesstocobits,andtheclient
q
sical algorithm, the fully homomorphic encryption protocol, isrestrictedtoparitycomputationsandthelocalmanipulation
[
was invented which provides computation security in data of the cobits. The protocol works in the following manner:

1 processing at remote servers [1]. At the same time, a quan- the server sends cobits, and the client applies simple opera-
v
tum computing protocol was found which allows an almost- tionstothem,dependentonsomeclassicalbits.Thecobitsare
0
classicalclienttodelegateaquantumcomputationsecurelyto thensentbacktotheserver, whichperformsameasurement.
3
7 aquantumserver[2,4]. Incontrasttotheclassicalalgorithm, The result of the measurement depends on the client’s ma-
6 the quantum version provides unconditional security [2, 5– nipulationsandcontainstheencryptedoutcomeoftheNAND
0 7]; however, it requires classical communication of the or- operation on the client’s classical bits. This means that the
.
1 der of the size of the computation. The trade-off between cobitenablestheclienttocomputeproblemsbeyondherown
0 theamountofcommunicationrequiredandthedesiredsecu- power,sincetheNANDgateisuniversalforclassicalcompu-
5
rity level is what motivates evaluation of a hybrid quantum- tation.
1
: classicalscheme[8]. Further,weexperimentallyimplementclassicalsecuredel-
v Here, we study the interplay between classical and quan- egated computation by using single qubits or coherent laser
i
X beams as cobits. In our implementation, the client and the
r server are set up in two different laboratories, separated by
a bit cobit qubit
more than 50 meters, and connected by optical fibres. Pho-
Z tonic systems are ideally suited for this task, since they can
be easily manipulated and transmitted over large distances;
however our scheme can be implemented using every physi-
Y calsystemthatprovidescoherence.
X Note that the protocol and the implementation are classi-
calinthesenseofclassicalphysics: theyusepurelyclassical
means,effectsanddevices,includingclassicalcoherence. We
notethatthisdefinitiondiffersfromthedefinitionof”classi-
FIG.1: Bit,cobits,andqubits. Thebitisatwo-levelclassicalsys- cal” in computer science, which is limited to only classical
tem,cobitsaresystemscapableofbeinginacoherentsuperposition two-level bits and gates on these bits. Thus, our work also
oftwo”states”, andqubitsarequantumsystems. TheoperationU highlights the two different notions of classicality in physics
transformsbasisstatesintosuperpositionstatesandviceversa.
andcomputerscience.
2
Server: Client: tainsaNANDgate.
generation input a,b
Inordertohidethestateoftheoutputcobittoachievese-
+ measurement + XOR gate
of cobits + single-cobit manipulation curedelegatedcomputing,theclientappliesanadditionalran-
dombitflipX:
single cobits in state manipulation of cobits
|NAND(a,b)⊕1⊕r(cid:105)=Xr|NAND(a,b)⊕1(cid:105), (2)
1.
whererisarandomvalue.
Thecobitisthensentbacktotheserver,whereameasure-
mentinthe|0/1(cid:105)basisisperformed. Theresultofthismea-
surement, s, is returned to the client, who finally obtains the
resultNAND(a,b)bycomputing:
measurement of 0 or 1 applies random bit flips
NAND(a,b)=s⊕1⊕r. (3)
2.
AsingleclassicalbitisnotsufficienttoimplementaNAND
gate, because at least two bits are required. Our protocol
shows that systems allowing for a coherent superposition of
two states are sufficient. A single qubit also accomplishes
this task in the fully quantum case. Here, the operation
1 1
0 10 U = Ry(π/2) is a rotation of π/2 around the Y axis of the
3. Result: Blochsphere: R (θ) = exp(−iθ/2σ ),σ isthePaulioper-
y y y
ator,andthebitflipX = σ isgivenbythePaulioperator.
X
However,noquantumbehaviorisrequiredinoursetting. Ev-
erysystemthatprovidescoherencecanbeusedtoimplement
FIG.2: SchemeofdelegatedNANDgate. Thestepsoftheprotocol
ourprotocol.
areindetaildescribedinthemaintext.
Optics facilitates transmission of information between the
serverandtheclientandback. Experimentally,wemakeuse
THEORY of single photonic qubits or a coherent laser beam, since the
logical states |0(cid:105) and |1(cid:105) can be encoded in the photon’s or
beam’s polarization. The only difference is that when using
Ourworkisbasedonaprotocolforsecuredelegatedclas-
acoherentstatelightbeammultiplephotonspassthroughthe
sicalcomputationusingquantumresources[9]. Itwasshown
client’sgateswiththesamesettings. Sincethesecurityeffec-
thatmanipulationsofonlytwo-levelbitsarenotsufficientfor
tivelyreducestoaclassicalinformation-theoreticalencryption
thistask.Here,wereformulatetheoriginalwork[9]andshow
(effectively a one-time pad) and is not relying on quantum
thatinthesamesettingaddingclassicalcoherenceenablesus
propertiesvitalinmostofquantumcryptography(e.g. theno-
toperformsecuredelegatedclassicalcomputations.
cloning result for quantum states), having multiple copies of
The protocol is based on the implementation of a NAND
thesamestatedoesnotreducethesecurity(seeproofinSI).
gateusingonlyparitycomputationsandcoherence. Here,we
The challenge when single qubits are used for the proto-
first describe the protocol using single cobits and show later
col is that probabilistic generation and optical losses affect
its implementation with single photonic qubits and coherent
the robustness of the protocol. Since the client is only capa-
beams,whichrelaxestherequirementsoftheinitialtheory[9].
bleofperformingparitycomputationsandthepreparationof
Indetail,theprotocolworksasexplainedinthefollowing(see
also Fig 2). First, the server generates cobits in the state |0(cid:105) randombits,shecannotcheckwhetherthecomputationiscor-
rectornot. Iftheserverdoesnotsendaphotonorthephoton
and sends these cobits to the client. The client wants to im-
plement a NAND gate on two input bits a and b. The client getslost,thentheserverfailstoregisteraresult. Theeasiest
solutionwouldbetosendanadditionalclassicalbitonadif-
encodestheresultofaNAND(a,b)gateintheoutputcobitby
ferent channel from the server to the client, which indicates
applyingthegatesequence:
thattheprocedurehasworked.Dependentontheclassicalbit,
|NAND(a,b)⊕1(cid:105)=(U†)a⊕bUbUa|0(cid:105). (1) theclientcouldthenrepeatthecomputation. However,thisis
notpossibleinourframeworkasthisroutinewouldbeequiv-
Here, U is an operation which brings the state |0(cid:105) into a su- alent to implementing a NAND gate and thus is beyond the
perpositionof|0(cid:105)and|1(cid:105). IfU isappliedtothesuperposition client’s capabilities. Using a laserbeam for theimplementa-
of |0(cid:105) and |1(cid:105), the cobit will be in state |1(cid:105) after the opera- tionoftheprotocolhastheadvantageofprovidingrobustness
tion(U(U|0(cid:105)) = |1(cid:105)). Inourprotocol, theoperationU isor againstthesephotonlosses.
is not applied, depending on the values of a and b. Only if ANANDcomputationwithoutconsideringthesecurityas-
a=b=1,theoutputcobitisinstate|1(cid:105),forallothersettings pects, was first proposed in another work [10]. There, a
of a and b, the output cobit is in state |0(cid:105). Thus, the output classicalparitycomputercontrolledthree-qubitGreenberger-
cobitcanbewrittenas|NAND(a,b)⊕1(cid:105)andeffectivelycon- Horne-Zeilingerstatesinordertoperformuniversalclassical
3
a Quantum server Client and the 787 nm beam is focused through 3µm wide waveg-
50m8
uidesina10 mmlongAR-coatedKTPcrystal, whichispe-
riodicallypoledtophase-matchfortype-IIparametricdown-
conversion. Afterthechip,long-passfiltersareusedtoblock
outthepumplight. Thehorizontallyandverticallypolarized
Photon8source
HWP down-convertedphotons, centeredat1570nmand1580nm,
HWP
aresplitwithapolarizingbeamsplittercube. Thephotonsare
HWP
furtherfilteredandcoupledintosingle-modefibers. Thepho-
HWP
Photon8detector )RNGO tonsat1570nmareguidedtotheclient’ssetup, whereasthe
photonsat1580nmarekepttheserver’ssideandproducethe
heraldingsignal. Alternatively,weuseacoherentlaserbeam
Results
POL+HWP at1550nmthatisattenuatedtothesinglephotonlevel.
Thesepolarization-encodedcobitsaresenttotheclientwho
b to8client implementstherequiredgatesusingwaveplates. Weshowin
PBS
1008MHz 4-f8line PPKTP8 filters theSupplementaryInformation(SI)thatitissufficientforthe
7858nm HWP waveguide clienttohaveaccesstothreehalf-waveplates(HWP)forthe
implementationoftheNANDgateandtooneadditionalHWP
to8detector fortheimplementationoftheXr operation. Byapplyingthe
followinggatesequence:
FIG.3: Experimentalsetup. a. Setupofseparatedclientandserver.
Theserverin“lab1”generatesandmeasurespolarization-encoded
HWP(ϕr).HWP(−θ(a⊕b)).HWP(θ−b).HWP(θa) (4)
single qubits or the polarization of an attenuated laser beam. The
(cid:124) (cid:123)(cid:122) (cid:125) (cid:124) (cid:123)(cid:122) (cid:125)
clientin“lab2”manipulatesthepolarizationandencodestheNAND X orIZ gateimplementation
gate.b.Sourceforthegenerationofheraldedsinglephotons.
withϕ = π/4andθ = π/8,theclientalterstheoutputstate,
dependent on the values of a and b. The value of the ran-
computation. This setting can be seen as a measurement-
dom number r is generated via a classical computer in our
based version of ours—a rotation is performed via single-
implementation. However, thiscouldbeeasilyreplacedbya
qubitmeasurements[11,12]. Ourworkshowsthatthesame
quantumrandomnumbergenerator.
functionality can be achieved without having any quantum
Theoutputcobitissendbacktotheserverwhoperformsa
resources at all. Furthermore, we achieve secure delegated
measurementinthecomputationalbasis. Experimentally,for
computations by sending cobits. This reduction to the ma-
bothimplementations,thepolarizationofthephotonsreturned
nipulationof”simple”resources,comparedtothegeneration
to the server is analyzed using a half-wave plate, a Glan-
of entanglement, clearly decreases the experimental require-
ThompsonpolarizerandInGaAsavalanchephotodiodesthat
mentsandenablesonetoperformsecureanddelegatedclas-
are specified to be 20% efficient and a deadtime set to 10
sicalcomputationswithminimalresources.
µs. The results of the server’s measurement is then equal to
AND(a,b).
Note,thatarealphysicalimplementationintroducesstate-
EXPERIMENTS dependentphaseshifts,forexampleHWP(0) = σ . Inorder
z
to avoid that these phase shifts reveal any information about
Weimplementtheserverandtheclientusingtwoindepen- aorb, thesettingshavetobecarefullychosen. Asweshow
dentexperimentalsetupsrunningintwodifferentlaboratories, intheSI,thesettingsgivenabovearesecureinthesense,that
whichareseparatedby50m(seeFig.3). theseglobalphaseshiftsdonotrevealanyinformationabout
Weeitheruseaheraldedsinglephotonsourceoraweakco- our computation. Further, additional phase shifts are intro-
herentlaserbeamfortheimplementationoftheprotocol. For duced when the photons are sent through the fibers. These
both cases, we encode the states |0(cid:105) and |1(cid:105) in polarization, phaseshiftsareindependentofthesettingsofaandbanddo
denotinghorizontalandverticalpolarization,respectively. notaffectthecorrectnessofthecomputation.
Theheraldedsinglephotonsareproducedbytype-IIpara-
metric down conversion in a Potassium Titanium Oxide
Phosphate (KTP) crystal that has periodically poled waveg- RESULTS
uides[13].Amode-lockedfiber-basedfemtosecondlaserpro-
duces 90 fs long pulses at 1575 nm with a repetition rate Wefirstimplementtheprotocolwithsinglephotons. Since
of 100 MHz. These pulses are frequency-doubled in a 1 theprotocolissecureevenwhenmultiplephotonspassatthe
mmlongperiodicallypoledPotassiumDihydrogenPhosphate sametimethoughthesamesettings(seeSI),asingle-shotim-
(KDP)crystalcutfortype-IIsecondharmonicgeneration,re- plementationisnotnecessaryandweintegratetheresultover
sultingin7 mWof787 nmlight. Thefundamental1575nm 10sofmeasurementtime. Inourexperiment,weuseaGlan-
lightisfilteredoutwithadichroicmirrorandshort-passfilter, ThompsonpolarizerandanadditionalHWPforanalysingthe
4

1.0 r=0 1.0 r=1 1 .0 0
1.0 1.0
0.8 0.8
0.8 0.8
0 .9 9
0.6 0.6
00singlephoton..00042...246 00singlephoton000..4...2246 bability0 .9 8
0.00.0 01,0 02,1 13,0 14,1 a,b00.0.0 0,10 0,21 1,30 1,41 a,b e pro0 .9 7
1.10.0 A rC=101..00 A rag
e
0.8 0.8 v
0.8 0.8 a
0 .9 6
0.6 0.6
0coherent.004..46 0coherent00...446 0 .9 5
0.2 0.2 0 5 0 1 0 0 1 5 0 2 0 0
0.2 0.2
tim e in m in u te s
0.0 a,b0.0 a,b
0.0 01,0 02,1 13,0 14,1 0.0 0,10 0,21 1,03 1,41
ProbabilityufoAru0uoutcome rG=0 Probabilityuforu1uAoutcome FIG.5: Studyofthelong-termstabilityofourexperiment. Were-
peatthemeasurementsequence,showninFig.4,sixtimesover210
FIG. 4: Results of delegated secure NAND gate. Implementation minutes and compute the average probability of obtaining the cor-
withsinglephotons(toprow)andwithanattenuatedlaserbeam(bot- rectresultoftheNANDcomputation(averagedoverallresults,for
tomrow)forthecasesr = 0(left)andr = 1(right). Weachieve r=0andr=1). Errorbarsarenotshownastheyaresmallerthan
probabilitiesforfindingthecorrectoutputof(98.8±0.5)%forthe thesymbols.
single-photonimplementationandof(98.2±0.06)%fortheimple-
mentationwithacoherentbeam.
polarization. Theresultsofthesingle-photonrunsareshown complishthistask—eventhoughnoquantumnessisrequired.
inFig.4a. Weobtaincountratesof300heraldedphotonsper Theextensionofpreviousworktosystemscapableofbeingin
second. Theaverageprobabilityforfindingthecorrectresults acoherentsuperpositionoftwostatesprovidesapracticaland
is(98.8±0.5)%. robust way to implement the protocol experimentally while
Werunthesameexperimentalsequencewithalaserbeam stillbeingsecure.
thatisattenuatedto30000singlecountspersecond,measured
afterthetransmissionthroughthesetup. Inthisexperimental We note that the protocol we present here is completely
run,weobtainsimilaraverageprobabilitiesoffindingthecor- classical in the sense of classical physics. In a different set-
rectresultsof(98.2±0.06)%(seedetailedresultsinFig.4b). ting,itcouldalsobeaccomplishedwithaclassicalpointerin-
Inbothexperiments,theerrorsarecalculatedassumingPois- steadofqubitsandcoherentbeams.Here,theclassicalpointer
sonian errors. Experimental imperfections arise from polar- represents a three-level system, which shows the same func-
izationsdriftswhenthephotonsaretransmittedthroughfibers tionality than a two-level system with coherence. However,
and errors in the manipulations with wave plates as well as thiswouldalsorequiretheclienttohaveadifferentfunction-
imperfectioninthemeasurementinthe|0,1(cid:105)basis. ality.
The fibres connecting both laboratories are 50m long and
While the focus of our work is more of fundamental na-
areplacedpartlyoutsidethebuilding.Inordertotestthelong-
ture, demonstrating the computational capability of cobits, a
term stability of our fibre connection and influences such as
potentialpracticalapplicationofitcouldbealsoinvestigated
temperature changes and movements of the fibres, we per-
infuture. Notethatanypartialefficientclassicalsolutionfor
form a series of NAND-gate measurements for all possible
secure cloud computing once boosted to be universal would
inputs and repeat this measurement six times over 210 min-
require a huge overhead. We intend to explore whether our
utes. Duringthisperiod,theobtainedprobabilitiesarestable
schemecouldbeusedasanalternativeschemewherethemore
anddecreaseonlyslightlyfromonaverage(98.2±0.06)%to
costlyencodingforNANDcomputingisdoneviacobits.
(97.1±0.08)%(seeFig.5).
Furthermore, our implementation can be easily extended
to long distances using standard technology from quantum
CONCLUSION
key distribution. In the future, it will be interesting to study
howthisschemecanbeextendedtomulti-partycomputations,
In this work, we have studied secure delegated comput- where different parties compute a result while hiding the in-
ing at the boundary between classical and quantum physics. putsfromeachother.
Wehaveshownthatthecomputationalpowerofclassicalen-
tity limited to parity computations can be boosted to univer- Inconclusion,ourworkshowsanewwayofhowtoexploit
sal classical computation by exploiting coherence. We have thepropertiesofbothquantumparticlesandclassicalfieldsas
shownthatasinglequbitcanbeusedasasimplesystemtoac- toolsforclassicalcomputing.
5
ACKNOWLEDGEMENTS Tothisend, wechoosethefollowingsequencefortheim-
plementationoftheNANDgate:
We thank Animesh Datta, Andreas Eckstein, Peter
HWP(−θ(a⊕b)).HWP(−θb).HWP(θa)|0(cid:105), (5)
Humphries, SteveKolthammer, BenMetcalf, andJoshNunn
with θ = π/8. For the settings a = b = 0, a = 0,b = 1,
fordiscussions. ThisworkwassupportedbytheMarieCurie
a = 1,b = 0, this gate sequence adds an additional phase
Actions within the Seventh Framework Programme for Re-
shiftofπtothestate|1(cid:105).Thisphaseshiftcanbecompensated
search of the European Commission, under the Initial Train-
ifweincorporateanadditionalphaseflipinourone-timepad.
ingNetworkPICQUE,GrantNo. 608062andbytheUKEn-
Forthis,weuseanotherwaveplateHWP(ϕr)withϕ=π/4,
gineering and Physical Sciences Research Council (EPSRC
whichallowsustorandomlyswitchbetweenaphaseflipand
EP/K034480/1).
a bit flip. Thus, we can implement the whole scheme using
onlyfourHWPssecurely:
HWP(ϕr).HWP(−θ(a⊕b)).HWP(−θb).HWP(θa)|0(cid:105) (6)
[1] C.Gentry,inProceedingsofthe41stannualACMsymposium
onTheoryofComputing(ACM,2009),pp.169–178. withϕ=π/4andθ =π/8.
[2] A.Broadbent,J.Fitzsimons,andE.Kashefi,inProceedingsof
the50thAnnualSymposiumonFoundationsofComputerSci-
ence(2009),pp.517–526.
Securityofimplementationusinglaserbeams
[3] R.Rivest,L.Adleman,andM.Dertouzos,FoundationsofSe-
cureComputationpp.169–178(1978).
[4] S.Barz,E.Kashefi,A.Broadbent,J.Fitzsimons,A.Zeilinger, Thesecurityoftheimplementedprotocolcanfollowimme-
andP.Walther,Science335,303(2012). diatelyfromtheproofgivenin[9]undertwoassumptions:
[5] T.Morimae,arXiv:1208.1495(2012).
[6] V. Giovannetti, L.Maccone, T. Morimae, andT.G.Rudolph, 1. ideal devices and or devices with noise/loss, provided
Phys.Rev.Lett.111,230501(2013).
the noise/loss parameters are not controlled by the
[7] K. Fisher, A. Broadbent, L. Shalm, Z. Yan, J. Lavoie,
server.
R. Prevedel, T. Jennewein, and K. Resch, Nature Comm. 5
(2014).
2. themalevolentserverdoessendindividualphotonstates
[8] S.-H.Tan,J.A.Kettlewell,Y.Ouyang,L.Chen,andJ.F.Fitzsi-
mons,arXivpreprintarXiv:1411.5254(2014). inthemodesthatensurethecorrectoperationoftheop-
[9] V. Dunjko, T. Kapourniotis, and E. Kashefi, arXiv preprint ticalelementsontheclient’ssideonthepolarizationde-
arXiv:1405.4558(2014). greesoffreedomofthephotons,e.g. correctfrequency
[10] J. Anders and D. E. Browne, Phys. Rev. Lett. 102, 050502 oflight.
(2009).
[11] R. Raussendorf and H. Briegel, Phys. Rev. Lett. 86, 5188 Next we show that the security is not jeopardized under a
(2001).
broaderchoiceofmalevolentactivitybytheserver,whichcan
[12] R.Raussendorf,D.E.Browne,andH.J.Briegel,Phys.Rev.A
bestraightforwardlyappliedtothecoherentlightsetting.
68,022312(2003).
[13] G.Harder,V.Ansari,B.Brecht,T.Dirmeier,C.Marquardt,and Thecumulativeactionofopticaldevicesontheclient’sside
C.Silberhorn,OpticsExpress21,13975(2013). are easily seen to implement a polarization rotation of zero
degrees, if NAND(a,b)⊕r = 0, and π otherwise. In other
words,themapitself,implementedbytheclient,isclassically
SupplementaryInformation one-timepadded. Thus,irrespectiveoftheoftheactualstate
prepared by the server, the action of such a map results in a
Correctnessoftheexperimentalimplementation statethatisone-timepaddedbytheparameterr,soindepen-
dentfromtheclient’sinputs,whenaveragedovertheclient’s
The original protocol requires gates to be applied condi- secretparameterr. Thelattermeanstheprotocolisblind.
tionedonthevaluesofaandb[9]. However,whenusingpo- We note that the security may be jeopardized if the server
larizationandwaveplates,thesemightapplystate-dependent utilizes other modes, e.g. frequency of light, which changes
phase shifts. For example, a half-wave plate (HWP) at “0” howtheopticaldevices,onthesideoftheclient,manipulate
setting is equivalent to a σ gate, at a setting of π/8, it is a thepolarizationdegreesoffreedom. However,suchbehavior
Z
Hadamardgate,andatπ/4itisanσ gate. Inordertoavoid can in principle be prevented by quality control, which spo-
X
thatthesestate-dependentphaseshiftsleakinformationtothe radicallychecksthecharacteristicsoflightusedbytheserver.
server, we need to choose the settings carefully and ensure Moregeneralanalysesofhowparticularimplementationsmay
thattheoutputstatecontainsnoinformationaboutaandb. bevulnerabletoattacksarebeyondthescopeofthiswork.