Making Existing Quantum Position Verification Protocols Secure Against Arbitrary Transmission Loss

TL;DR

The paper tackles secure quantum position verification under realistic photon loss by introducing a commitment-based modification, producing a protocol $c-\mathsf P_{\eta_V,\eta_P}$ that renders the verifiers-to-prover loss $\eta_V$ irrelevant and concentrates security on the prover-lab loss $\eta_P$. For state-independent QPV protocols with classical prover responses that are secure under sequential repetition and allow slow quantum information, the authors prove that $c-\mathsf P$ inherits security from the underlying protocol with a bound $\mathbb P[\mathrm{attack}\, c-\mathsf P_{\eta_V,\eta_P}] \le \mathbb P[\mathrm{attack}\, \mathsf P_{\eta_P}] + \frac{1}{k}$, where $k=O(N^{1/7})$, enabling practical loss-tolerance. They detail a concrete instantiation for $\mathrm{QPV}_{\mathrm{BB84}}^{f}$, resulting in $c-\mathrm{QPV}_{\mathrm{BB84}}^{f}$, and provide a security analysis including non-adaptive and adaptive attacker models, sequential repetition, and parameter estimation. Two experimental pathways for photon-presence detection are analyzed: true non-demolition detection (QND) as a long-term option and a near-term partial Bell-measurement approach, with discussions of rates, distances, and hardware requirements. Altogether, the work paves the way for practical QPV demonstrations that resist loss, timing constraints, and entanglement-based attacks, linking theory to near-term experimental feasibility.

Abstract

Signal loss poses a significant threat to the security of quantum cryptography when the chosen protocol lacks loss-tolerance. In quantum position verification (QPV) protocols, even relatively small loss rates can compromise security. The goal is thus to find protocols that remain secure under practically achievable loss rates. In this work, we modify the usual structure of QPV protocols and prove that this modification makes the potentially high transmission loss between the verifiers and the prover security-irrelevant for a class of protocols that includes a practically-interesting candidate protocol inspired by the BB84 protocol ($\mathrm{QPV}_{\mathrm{BB84}}^{f}$). This modification, which involves photon presence detection, a small time delay at the prover, and a commitment to play before proceeding, reduces the overall loss rate to just the prover's laboratory. The adapted protocol c-$\mathrm{QPV}_{\mathrm{BB84}}^{f}$ then becomes a practically feasible QPV protocol with strong security guarantees, even against attackers using adaptive strategies. As the loss rate between the verifiers and prover is mainly dictated by the distance between them, secure QPV over longer distances becomes possible. We also show possible implementations of the required photon presence detection, making c-$\mathrm{QPV}_{\mathrm{BB84}}^{f}$ a protocol that solves all major practical issues in QPV. Finally, we discuss experimental aspects and give parameter estimations.

Figures (6)

• Figure 1: Schematic representation of the $\mathrm{QPV}_{\mathrm{BB84}}^{f}$ protocol. Undulated lines represent quantum information, whereas straight lines represent classical information. The slowly travelling quantum system $Q$ originated from $V_0$ in the past.
• Figure 2: Schematic representation of the c-$\mathrm{QPV}_{\mathrm{BB84}}^{f}$ protocol. Undulated lines represent quantum information, straight lines represent classical information. The slowly traveling quantum system $Q$ originated from $V_0$ in the past. The novel aspects are the time delay $\delta > 0$ at the prover and the prover commitment $c \in \{ 0, 1 \}$. We show that for the security of this protocol, the transmission $\eta_V$ becomes irrelevant.
• Figure 3: Schematic representation of a general attack on a c-QPV protocol, where straight lines represent classical information, and undulated lines represent quantum information, including $x$ and $y$.
• Figure 4: Graphical representation of converting the pair $(x,y)$ (red) to $(x',y')$ (green) via $(x',y)$ (orange). Vertices on the left correspond to possible inputs $x$, on the right to possible inputs $y$. A connection between two strings means that the probability of committing differently on this input is smaller than $\varepsilon$.
• Figure 5: 2-dimensional probability simplex $\Delta_2$ with secure subset $\mathcal{S}$ defined by the curve $\gamma$ for a protocol c-$\mathsf{P}_{\eta_{V},\eta_{P}}$.

Theorems & Definitions (34)

• Theorem : Informal
• Lemma 2.1
• Remark 2.2
• Definition 2.3
• Definition 3.1
• Definition 4.1
• Lemma 4.2
• proof
• Corollary 4.3
• Lemma 4.4