Bell inequalities limit the possible observations of non-communicating parties. Here, we present analogous inequalities for any number of communicating parties under the causal constraints of static causal order,definite causal order,and bi-causal order.All derived inequalities are remarkably simple. They correspond to upper bounds on the winning chance in graphical games:Given a specific directed graph over the parties, the parties are challenged to communicate along a randomly chosen arc. In the case of definite causal order, every game that we find is specified by a kefalopoda digraph.Based on this we define weakly causal correlations as those that satisfy all kefalopoda inequalities. We show that the problem of deciding whether some correlations are weakly causal is solvable in polynomial time in the number of parties.

The Leggett-Garg inequalities were originally intro-duced for experimentally testing a possible break of the quantum evolution in meso scopic systems. In this paper, we take a different point of view by focusing on faithful classical simulations of sequential quantum measurements. In this context, the violation of Leggett-Garg inequalities implies that classically simulated quantum measurements induce perturbations into the subsequent evolution of the classical variables. We show that the implication is even stronger and a measurement erases previous information by performing a partial reset on the classical state. Thus, the measuring device acts as a low-temperature bath absorbing entropy from the measured system. Information erasure is a form of preparation contextuality. Our proof is straightforward if one assumes that maximal ignorance of the quantum state is compatible with maximal ignorance of the classical state. We also employ a weaker hypothesis.

We discuss a simple toy model which allows, in a natural way, for deriving central facts from thermodynamics such as its fundamental laws, including Carnot’s version of the second principle. Our viewpoint represents thermodynamic systems as binary strings, and it links their temperature to their Hamming weight. From this, we can reproduce the possibility of negative temperatures, the notion of equilibrium as the coïncidence of two notions of temperature — statistical versus structural —, as well as the zeroth law of thermodynamics (transitivity of the thermal-equilibrium relation), which we find to be redundant, as other authors, yet at the same time not to be universally valid.

In line with advances in recent years about realizing cryptographic functionalities in an information-theoretically secure way from physical phenomena and laws, we propose here to obtain useful tasks from the sole assumption of limited free energy. Specifically, based on that assumption — resulting in a setting loosely related to Maurer’s bounded-storage model — we derive protocols for unconditional proofs-of-thermodynamical-work, secret sharing of free energy, unforgeable money, and proofs-of-position. While our schemes can be considered classical and not quantum per se, they are resistant against both classes of adversaries.

The CHSH no-signalling game studies Bell nonlocality by showcasing a gap between the win rates of classical strategies, quantum-entangled strategies, and no-signalling strategies. Similarly, the CHSH* single-system game explores the advantage of irreversible processes by showcasing a gap between the win rates of classical reversible strategies, quantum reversible strategies, and irreversible strategies. The irreversible process of erasure rules supreme for the CHSH* single-system game, but this erasure advantage does not necessarily extend to every single-system game: We introduce the 32-Game, in which reversibility is irrelevant and only the distinction between classical and quantum operations matters. We showcase our new insight by modifying the CHSH* game to make it erasure-immune, while conserving its quantum advantage. We conclude by the reverse procedure: We tune the 32-Game to make it erasure-vulnerable, and erase its quantum advantage in the process. The take-home message is that, when the size of the single-system is too small for Alice to encode her whole input, quantum advantage and erasure advantage can happen independently.

It seems impossible to certify that a remote hosting service does not leak its users' data - or does quantum mechanics make it possible? We investigate if a server hosting data can information-theoretically prove its definite deletion using a "BB84-like" protocol. To do so, we first rigorously introduce an alternative to privacy by encryption: privacy delegation. We then apply this novel concept to provable deletion and remote data storage. For both tasks, we present a protocol, sketch its partial security, and display its vulnerability to eavesdropping attacks targeting only a few bits.

It was first observed by John Bell that quantum theory predicts correlations between measurement outcomes that lie beyond the explanatory power of local hidden variable theories. These correlations have traditionally been studied extensively in the probabilistic framework. A drawback of this perspective is that one is then forced to use in a single argument the outcomes of mutually-exclusive measurements. One of us has initiated an alternative approach, invoking only data at hand, in order to circumvent this issue. In this factual view, which is based on Kol-mogorov complexity, we introduce mechanisms such as complexity amplification. We establish that this functionality is realizable, just as its probabilistic counterpart, hereby underlining that Bell correlations are a precious information-processing resource.

Remarkably, it has been shown that in principle, security proofs for quantum key-distribution (QKD) protocols can be independent of assumptions on the devices used and even of the fact that the adversary is limited by quantum theory. All that is required instead is the absence of any hidden information flow between the laboratories, a condition that can be enforced either by shielding or by space-time causality. All known schemes for such Causal Key Distribution (CKD) that offer noise-tolerance (and, hence, must use privacy amplification as a crucial step) require multiple devices carrying out measurements in parallel on each end of the protocol, where the number of devices grows with the desired level of security. We investigate the power of the adversary for more practical schemes, where both parties each use a single device carrying out measurements consecutively. We provide a novel construction of attacks that is strictly more powerful than the best known attacks and has the potential to decide the question whether such practical CKD schemes are possible in the negative.

Besides being one of the most puzzling aspects of quantum information theory, non-locality has been recognised as a valuable resource for various cryptographic protocols. We study the phenomenon of distillation of non-locality, which is the ability to generate a stronger instance of non-locality from weaker ones. We construct an eavesdropping third party who gains knowledge about the outputs of distillation protocols. This knowledge directly implies an upper bound on the degree of non-locality of the output of the protocol.

The paradigmatic view where information is seen as a more fundamental concept than the laws of physics leads to a different understanding of spacetime, where the causal order of events emerges from correlations between random variables representing physical quantities. In particular, such an information-theoretic approach does not enforce a global spacetime structure. By following this path, we conclude that perfect signaling correlations among three parties are possible which do not obey the restrictions imposed by global spacetime. We show this using a recent framework based on the sole assumptions that locally, quantum theory is valid and random variables can be described by probability distributions. Our result is of zero-error type and can be seen as an analog to a three-party appearance of quantum non-locality which manifests itself by satisfying a condition with certainty, whereas the same is impossible for any local theory.

Quantum theory puts forward phenomena beyond the explanatory power of classical physics-or information, for that matter. A prominent example is non-locality. Non-local correlations cannot explained, in classical terms, by shared information but only by communication. On the other hand, the phenomenon does not allow for (potentially faster-than-light) message transmission. The fact that some non-local and non-signaling correlations are predicted by quantum theory, whereas others fail to be, asks for a criterion, as simple as possible, that characterizes which joint input-output behaviors are “quantum” and which are not. In the context of the derivation of such criteria, it is of central importance to understand when non-local correlations can be amplified by a non-interactive protocol, i.e., whether some types of weak non-locality can be distilled into stronger by local operations. Since it has been recognized that the searched-for criteria must inherently be multi-partite, the question of distillation, extensively studied and understood two-party scenarios, should be adressed in the multi-user setting, where much less is known. Considering the space of intrinsically n-partite correlations, we show the possibility of distilling weak non-local boxes to the algebraically maximal ones without any communication. Our protocols improve on previously known methods which still required partial communication. The price we have to pay for dropping the need for communication entirely is the assumption of permutation invariance: Any correlation that can be realized between some set of players is possible between any such set. This assumption is natural since the laws of physics are invariant under spacial translation.

The process of state preparation, its transmission and subsequent measurement can be classically simulated through the communication of some amount of classical information. Recently, we proved that the minimal communication cost is the minimum of a convex functional over a space of suitable probability distributions. It is now proved that this optimization problem is the dual of a geometric programming problem, which displays some appealing properties. First, the number of variables grows linearly with the input size. Second, the objective function is linear in the input parameters and the variables. Finally, the constraints do not depend on the input parameters. These properties imply that, once a feasible point is found, the computation of a lower bound on the communication cost in any two-party process is linearly complex. The studied scenario goes beyond quantum processes. We illustrate the method by analytically deriving some non-trivial lower bounds. Finally, we conjecture the lower bound n2nfor a noiseless quantum channel with capacity n qubits.

Non-local correlations are among the most fascinating features of quantum theory from the point of view of information, such correlations, although not allowing for signaling, are unexplainable by pre-shared information. The correlations have applications in cryptography, communication complexity, and sit at the very heart of many attempts of understanding quantum theory-and its limits-in terms of classical information. In this paper, the question is crucial whether such correlations can be amplified or distilled, i.e., whether and how weak correlations can be used for generating (a smaller amount of) stronger. Whereas the question has been studied quite extensively for bipartite correlations (yielding both pessimistic and optimistic results), only little is known in the multi-partite case. We introduce a general framework of reductions between multi-party input-output systems. Within this formalism, we show that a natural n-party generalization of the well-known Popescu-Rohrlich box can be distilled, by an adaptive protocol, to the algebraic maximum. We use this result further to show that a much broader class of correlations, including all purely three-partite correlations, can be distilled from arbitrarily weak to almost maximal strength with partial communication, i.e., using only a subset of the channels required for the creation of the same correlation from scratch. Alternatively, this means that arbitrarily weak non-local correlations can have a “communication value” in the context of the generation of maximal non-locality.

Non-local correlations are one of the most fascinating consequences of quantum physics from the point of view of information: Such correlations, although not allowing for signaling, are unexplainable by pre-shared information. The correlations have applications in cryptography, communication complexity, and sit at the very heart of many attempts of understanding quantum theory - and its limits - better in terms of classical information. In these contexts, the question is crucial whether such correlations can be distilled, i.e., whether weak correlations can be used for generating (a smaller amount of) stronger. Whereas the question has been studied quite extensively for bipartite correlations (yielding both pessimistic and optimistic results), only little is known in the multi-partite case. We show that a natural generalization of the well-known Popsecu-Rohrlich box can be distilled, by an adaptive protocol, to the algebraic maximum. We use this result further to show that a much bigger class of correlations, including all purely three-partite correlations, can be distilled from arbitrarily weak to maximal strength with partial communication, i.e., using only a subset of the channels required for the creation of the same correlation from scratch. In other words, we show that arbitrarily weak non-local correlations can have a “communication value” in the context of the generation of maximal non-locality.

Quantum theory is, in some sense, “non-classical.” For instance, the behavior of entangled systems (i.e., shared quantum information) under measurements cannot, in general, be explained by shared classical information. With classical communication, on the other hand, both the correlations entanglement leads to as well as quantum channels can be reproduced in principle. Here, crucial questions are whether the required communications is finite; if so, then its exact amount is related to the “degree of non-classicality” of the quantum primitive. We apply information-theoretic results such as the reverse Shannon theorem for determining the required communication in the asymptotic limit. The communication complexity of a quantum channel is the minimal amount of classical communication required for classically simulating the process of preparation, transmission through the channel, and subsequent measurement of a quantum state. At present, only little is known about this quantity. Our generic procedure allows for systematically evaluating the communication complexity of channels in any general probabilistic theory, in particular quantum theory. The procedure is constructive and provides the most efficient classical protocols. We illustrate it by evaluating the communication complexity of sending single qubits over a noiseless quantum channel with some finite sets of quantum states and measurements. As a second application, we determine the classical-communication rate required for the simulation of the behavior under measurements of entangled states. Here, the communication cost can be directly interpreted as the “non-classicality” of the correlation. A particular example is the simulation of non-maximally entangled pure qubit pairs, where we find the required communication rate to behave monotonically with the strength of the entanglement. For different measures of non-locality, such as the number of required non-local (PR) boxes, another behavior had been reported for the single-shot scenario.

Central cryptographic functionalities such as encryption, authentication, or secure two-party computation cannot be realized in an information-theoretically secure way from scratch. This serves as a motivation to study what (possibly weak) primitives they can be based on. We consider as such starting points general two-party input-output systems that do not allow for message transmission and show that they can be used for realizing unconditionally secure bit commitment as soon as they are nontrivial, i.e., cannot be securely realized from distributed randomness only.

In the interactive communication model, two parties$P_{\cal X}$and$P_{\cal Y}$possess respective private but correlated inputs$x$and$y$, and$P_{\cal Y}$wants to learn$x$from$P_{\cal X}$while minimizing the communication required for the worst possible input pair$(x,y)$. Our contribution is the analysis of four nonzero-error models in this correlated data setting. In the private coin randomized model, both players are allowed to toss coins, and$P_Y$must learn$x$with high probability for every input pair. The second and third models are similar to the first one, but the players are allowed to use a common source of randomness and to solve several independent instances of the same problem simultaneously, respectively. In the fourth model,$P_{\cal Y}$is allowed to answer incorrectly for a small fraction of the inputs. We show that one round of communication is nearly optimal for the private coin randomized model. We also prove that the last three models are equivalent and can be arbitrarily better than the original worst case deterministic model when interaction is not allowed. Finally, we show that the deterministic model and all the nonzero-error models are equivalent for a class of symmetric problems arising from several practical applications, although nonzero-error and randomization allow efficient one-way protocols.

Since oblivious transfer, a primitive of paramount importance in secure two- and multiparty computation, cannot be realized in an unconditionally secure way for both parties from scratch, reductions to weak information-theoretic primitives as well as between different variants of the functionality are of great interest. In this context, various monotones-quantities that cannot be increased by any protocol-are introduced and then used to derive lower bounds on the possibility and efficiency of such reductions.

A fundamental result in information-theoretic fault-tolerant distributed computing is that unconditionally secure broadcast (or Byzantine agreement) among three players is impossible if one player is misbehaving. In particular, imperfect broadcast with failure probability epsi is achievable if and only if epsi ges (3 - radic5)/2. In this paper, we examine to what extent the failure probability of imperfect broadcast can be reduced. As a main result, we show that, among three players, broadcast with failure probability epsi can be turned into broadcast with negligible failure probability if and only if epsi < 1/3. This result is finally extended to the more general case of n players and any number of misbehaving players

In this paper we provide the answer to the following question: given a noisy channel PY|Xand epsi > 0, how many bits can be transmitted with an error of at most epsi by a single use of the channel

We show that oblivious transfer can be seen as the classical analogue to a quantum channel in the same sense as non-local boxes are for maximally entangled qubits.

Oblivious transfer, a central functionality in modern cryptography, allows a party to send two one-bit messages to another who can choose one of them to read, remaining ignorant about the other, whereas the sender does not learn the receiver's choice. Oblivious transfer the security of which is information-theoretic for both parties is known impossible to achieve from scratch. The joint behavior of certain bi-partite quantum states is non-local, i.e., cannot be explained by shared classical information. In order to better understand such behavior, which is classically explainable only by communication, but does not allow for it, Popescu and Rohrlich have described a "non-locality machine": Two parties both input a bit, and both get a random output bit the XOR of which is the AND of the input bits. We show a close connection, in a cryptographic sense, between OT and the "PR primitive." More specifically, unconditional OT can be achieved from a single realization of PR, and vice versa. Our reductions, which are single-copy, information-theoretic, and perfect, also lead to a simple and optimal protocol allowing for inverting the direction of OT

In the interactive communication model, two distant parties possess correlated inputs such as strings of bits, and the goal is for one party to learn his interlocutor's input while minimizing the communication. Our main contribution is to analyze the power of randomization in this correlated data setting. We show that the deterministic, amortized deterministic, private coin randomized, and public coin randomized models are all equivalent for a large class of problems arising from several practical applications. Furthermore, we conjecture that the private coin randomized model and the deterministic model are equivalent for every problem, and show that a proof of this statement solves the direct-sum problem for interactive communication

We introduce a new entropy measure, called smooth Renyi entropy. The measure characterizes fundamental properties of a random variable Z, such as the amount of uniform randomness that can be extracted from Z or the minimum length of an encoding of Z.

There are different approaches to proving the impossibility of classical hidden-variable explanations of quantum-mechanical behavior. Whereas Kochen and Specker proved that a three-or higher-dimensional quantum-mechanical system cannot be "classically" prepared for all possible alternative measurements in a consistent way, Bell showed that the behavior of certain two-partite systems is nonlocal, i.e., inexplicable by shared classical information. We show a close connection between deterministic manifestations of such nonlocality-called "pseudotelepathy" games-and Kochen and Specker's theorem: Every such game leads to a Kochen-Specker contradiction, and vice versa

In analogy to the zero-error variant of the channel capacity, the zero-error information between two random variables is defined. We show that our definition is natural in the sense that the representation of the channel capacity with respect to mutual information carries over to the zero-error variants of the quantities. It is shown that the new notion, together with two operators introduced in the same context, namely the common random variable of two random variables and the dependent part of a random variable with respect to another, is useful for giving characterizations of the possibility of realizing cryptographic tasks - such as bit commitment, coin tossing, or oblivious transfer - from correlated pieces of information.

This is the first part of a three-part paper on secret-key agreement secure against active adversaries. In all three parts, we address the question whether two parties, knowing some correlated pieces of information X and Y, respectively, can generate a string S about which an adversary, knowing some information Z and having read and write access to the communication channel used by the legitimate partners, is almost completely ignorant. Whether such key agreement is possible, and if yes at which rate, is an inherent property of the joint probability distribution P/sub XYZ/. In this part, we first prove a number of general impossibility results. We then consider the important special case where the legitimate partners as well as the adversary have access to the outcomes of many independent repetitions of a fixed tripartite random experiment. In this case, the result characterizing the possibility of secret-key agreement secure against active adversaries is of all-or-nothing nature: either a secret key can be generated at the same rate as in the (well-studied) passive-adversary case, or such secret-key agreement is completely impossible. The exact condition characterizing the two cases is presented.

For pt.I see ibid., vol.49, no.4, p.822-31(2003). In the first part, we showed that when two parties, willing to generate a secret key, but connected only by a completely insecure communication channel, have access to independent repetitions of some random experiment, then the possibility of secret-key agreement depends on a certain property, called simulatability, of the probability distribution modeling the parties' initial knowledge. More generally, the simulatability condition is important in the context of identification and authentication among parties sharing some correlated but not necessarily identical partially secret keys. Unfortunately, this condition is a priori not very useful since it is not clear how to decide efficiently whether it is satisfied or not for a given distribution P/sub XYZ/. We introduce a new formalism, based on a mechanical model for representing the involved quantities, that allows for dealing with discrete joint distributions of random variables and their manipulations by noisy channels. We show that this representation leads to a simple and efficient characterization of the possibility of secret-key agreement secure against active adversaries.

For pt. II see ibid., vol.49, no.4, p.832-38 (2003). Here, we consider the special case where the legitimate partners already share a mutual string which might, however, be partially known to the adversary. The problem of generating a secret key in this case has been well studied in the passive-adversary model - for instance, in the context of quantum key agreement - under the name of privacy amplification. We consider the same problem with respect to an active adversary and propose two protocols, one based on universal hashing and one based on extractors, allowing for privacy amplification secure against an adversary whose knowledge about the initial partially secret string is limited to one third of the length of this string. Our results are based on novel techniques for authentication secure even against adversaries knowing a substantial amount of the "secret" key.

Both uniform and nonuniform results concerning the security of the Diffie--Hellman key-exchange protocol are proved. First, it is shown that in a cyclic group G of order |G|=\prod{p_i^{e_i}}$, where all the multiple prime factors of |G| are polynomial in log|G|, there exists an algorithm that reduces the computation of discrete logarithms in G to breaking the Diffie--Hellman protocol in G and has complexity $\sqrt{\max\{\nu(p_i)\}}\cdot(\log|G|)^{O(1)}$, where $\nu(p)$ stands for the minimum of the set of largest prime factors of all the numbers d in the interval $[p-2\sqrt{p}+1,p+2\sqrt{p}+1]$. Under the unproven but plausible assumption that $\nu(p)$ is polynomial in log p, this reduction implies that the Diffie--Hellman problem and the discrete logarithm problem are polynomial-time equivalent in G. Second, it is proved that the Diffie--Hellman problem and the discrete logarithm problem are equivalent in a uniform sense for groups whose orders belong to certain classes: there exists a polynomial-time reduction algorithm that works for all those groups. Moreover, it is shown that breaking the Diffie--Hellman protocol for a small but nonnegligible fraction of the instances is equally difficult as breaking it for all instances. Finally, efficient constructions of groups are described for which the algorithm reducing the discrete logarithm problem to the Diffie--Hellman problem is efficiently constructible.

This paper is concerned with secret-key agreement by public discussion. Assume that two parties Alice and Bob and an adversary Eve have access to independent realizations of random variables X, Y, and Z, respectively, with joint distribution P/sub XYZ/. The secret-key rate S(X;Y/spl par/Z) has been defined as the maximal rate at which Alice and Bob can generate a secret key by communication over an insecure, but authenticated channel such that Eve's information about this key is arbitrarily small. We define a new conditional mutual information measure, the intrinsic conditional mutual information between S and Y when given Z, denoted by I(X;Y/spl darr/Z), which is an upper bound on S(X;Y/spl par/Z). The special scenarios are analyzed where X, Y, and Z are generated by sending a binary random variable R, for example a signal broadcast by a satellite, over independent channels, or two scenarios in which Z is generated by sending X and Y over erasure channels. In the first two scenarios it can be shown that the secret-key rate is strictly positive if and only if I(X;Y/spl darr/Z) is strictly positive. For the third scenario, a new protocol is presented which allows secret-key agreement even when all the previously known protocols fail.