Unconditionally secured classical cryptography using quantum superposition and unitary transformation

Over decades quantum cryptography has been intensively studied for unconditionally secured key distribution in a quantum regime. Due to the quantum loopholes caused by imperfect single photon detectors and/or lossy quantum channels, however, the quantum cryptography is practically inefficient and even vulnerable to eavesdropping. Here, a method of unconditionally secured key distribution potentially compatible with current fiber-optic communications networks is proposed in a classical regime for high-speed optical backbone networks. The unconditional security is due to the quantum superposition-caused measurement indistinguishability between paired transmission channels and its unitary transformation resulting in deterministic randomness corresponding to the no-cloning theorem in a quantum key distribution protocol.

is a schematic of the present unconditionally secured classical cryptography (USCC), where the unconditional security is based on deterministic randomness in a round-trip Mach-Zehnder interferometer (MZI) as presented in Fig. 2 with equations (4) and (5) in the main text. Each path in Fig. S1 represents a pair of MZI channels. Compared with quantum cryptography (QKD) based on canonical (non-orthogonal) bases for a key satisfying non-commuting relationship according to quantum mechanics, the unitary transformation in Fig. S1 is for non-canonical (orthogonal bases) bases in a pair of classical channels, where the deterministic randomness of USCC results from the MZI path superposition and its double unitary transformation. Here, the double unitary transformation represents time reversal process retrieving eigenvalues. The randomness results from the indistinguishability of the orthogonal bits in the superposed path of MZI. This is the heart of deterministic randomness. The path superposition of MZI is of course replaced by basis superposition as shown. By the way, the no-cloning theorem is the direct result of canonical variable-based Heisenberg's uncertainty principle in quantum mechanics and becomes the bedrock of the unconditional security in QKD. Likewise, the deterministic randomness resulting from the MZI path superposition and unitary transformation corresponds to the no-cloning theorem of QKD and becomes the heart of USCC.
In general unitary transformation supports the basic mechanism of an optical (quantum) memory. In Fig. S1, binary bases (orthogonal phases) are used for the deterministic randomness, where the round tripped basis is supposed to be either itself or the other depending on the basis choice by the other party (Alice). To work with the deterministic randomness Bob prepares random basis, and it to Alice. This a typical storage process in an optical memory. Then, Alice reads it out with her random basis choice. If it is the same as what Bob chose it results in the same basis (identity) to Bob when the signal is returned. If Alice chooses the opposite basis, it results in the opposite basis (inversion) to Bob, too. Such a result is automatically determined by the MZI directionality to both Alice and Bob. Here, the inversion stands for basis swapping in the binary system. Unlike QKD requiring a sifting process via post-measurements, the deterministic randomness in USCC is highly efficient due to its automatic process as discussed in Fig. 1. Moreover, USCC works for both quantum and classical bases, where MZI physics does not discriminates both. For the classical one, thus, USCC is compatible with current fiber-optic communication systems.
At each path in Fig. S1, Eve (MZI channel eavesdropper) has a 50% chance of eavesdropping like coin tossing due to the MZI path superposition, resulting in measurement indistinguishability as in the Young's double-slit experiment. The 50% eavesdropping chance is simply due to the use of equally weighted two-orthogonal bases. If N orthogonal basis pairs are involved for N paired remotely separated parties, USCC can also be applicable to semi-continuous variable version (discussed elsewhere). Thus, the novelty of the present USCC is that the quantum nature of the unconditional security in QKD can be achieved in a classical regime by using orthogonal bases. The potential of USCC is the application to the one-time-pad cryptography owing to ultrafast key distribution rate based on the classical compatibility with current optical systems.   Table 1(c). With the binary basis set, the determinacy through MZI is either identity inversion. The binary set is represented by orthogonal phase, 0 and π. Using matrix representation with the beam splitter (BS) and phase rotation (Φ), MZI physics for unitary transformation is as follows: For the same basis choice by Alice ( = ) satisfying the identity relation, the output of � 7 8 � is represented by: have the same value regardless of the basis choice, resulting in the measurement randomness to Eve.
If † A = I, A is proved to be unitary satisfying a reversible process in Fig. S1: Because the global phase of [ ] 2 has nothing to do with the unitary transformation, the MZI matrix in Fig.  S2 is proved to be unitary. Thus, the scheme of the round-trip MZI in Fig. S2 (also Fig. 2) represents the time reversibility such as in an optical memory. This is the novelty of USCC representing deterministic randomness. The followings are additional information for equation (S3): (i) For φ = 0, the matrix representation for the outputs of BS in Fig. S2 is as follows: (ii) For φ = π, the matrix representation for the outputs of BS in Fig. S2 is as follows: As shown above, Bob's detection for the round-trip light through the same MZI paths is identical regardless of basis choice, representing the unitary transformation. Thus, Alice's role is clear whether to keep the identity the same or opposite.  Table S1 is a comparison chart between USCC and QKD. Because USCC is based on the beamsplitter optics, it covers both coherence (bright light) and incoherence (single photon) optics. Thus, USCC includes a specific QKD based on single photons such as BB84. The fundamental difference between USCC and QKD is the origin of unconditional security. Unlike QKD based on on-cloning theorem of quantum mechanics and canonical bases, USCC is based on quantum superposition of two transmission paths for non-canonical bases of key carriers. As explained in Figs. S1 and S2, the unconditional security is resulted from random basis shuffling by one party for the prepared one by another party. Thus, USCC is compatible with classical optics in principle. Obviously the territory of USCC can be expanded from the binary system to N-ary one (many bases).

Section S2. Key distribution procedure of USCC without sifting (post-measurement)
The USCC key distribution procedure without sifting results in 100% key rate due to the MZI determinacy if there is no network error (red). However, each key must follow the network reset protocol mentioned in Discussion to avoid of classical memory-based attack.
Prepared key: Final key: m The numbers in red refer to network errors or eavesdropping. ** Only error bits are announced publically to discard the corresponding bit from the final key set { }. Here, D represents an error bit and can be set to any number, e.g., D=9 for a computing algorithm. Here, ≠ ±1 stands for an error due to eavesdropping or network problem: see the red number in Table S2. 4. Alice randomly selects her phase ψ ∈ {0, } to create a ψ −controlled light pulse via the phase shifter Ψ and sends it back to Bob. Here, the ψ −phase control is performed on the reflected φ −controlled light pulse(s). 5. Alice converts her chosen ψ into a key in { } for a record: z ∈ {0,1}, where z = 0 if ψ = 0, and z = 1 if ψ = π. 6. Bob measures his detectors B3 and B4 for visibility VB: Here, ≠ ±1 stands for an error due to eavesdropping or network problem. 7. Alice and Bob publically announce their error bits (D) for ≠ ±1 and ≠ ±1. Alice and Bob now share the same key { }. For Alice, m = (y + z) ⊕ 1 at modulus 2. For Bob, m=1 V = −1 and m=0 if V = 1; D if ≠ ±1 or ≠ ±1.

Section S3. Example of the memory-based attack
For a given n-bit long key whose basis is binary, the maximum number of representation is 2 n . For n=126, thus, the total number of representation is 2 128 = 3.4x10 38 . Recalling the universe age is 1.38 × 10 10 years or 4.35 × 10 17 seconds, the eavesdropping chance for the 128-bit long key by using the most powerful supercomputer (IBM Summit) whose performance is 1.43 × 10 17 flops/s is as follows: where 6.2 × 10 34 is from the universe age (1.43 × 10 17 )(4.35 × 10 17 ).
Even with a personal computer whose operating system is 64-bit based, the brute force attack for the randomness in USCC takes more than 100 seconds: 2 64 = 1.8 × 10 19 . This means that the proposed USCC is effective even with personal computers for the applications of the one-time-pad cryptography, where the key never be reused and the key distribution speed is a few microseconds limited by the transmission distance rather than optical devices or CPU clock speed higher than 1 GHz. The flight time ∆t of a light pulse for a 10 km optical fiber is as follows: where n is the refractive index of the optical fiber, n~1.5. This channel-bandwidth bottleneck can also be solved by multi-channel configuration in current fiber-optic communications networks.

Section S4. Network initialization
As mentioned in the main text, Alice has two options of added δ setting for her phase shifter Ψ either she gets a constructive or destructive fringe. Table S3 is the opposite case of Table 3 in the main text for the network initialization, where Alice sets for maxima with δ as destructive interference in the network reset process. The eavesdropper Eve can do the same job as Alice does. However, Eve's best chance is 50% of what Alice does. The network initialization results in bit-by-bit randomness preventing Eve from the memory-based attack.  Table S2 is for π−added δ.

Sequence:
1. Initially Alice resets the MZI network by adjusting a path length and scan δ added to her phase basis ψ ∈ {0, } until she gets = ±1 for the same test keys provided by Bob. 2. Bob randomly selects ∈ {0, }, encodes his optical key with , and sends it to Alice.
3. Alice measures VA for maxima with δ− added ψ and publically announces the result. 4. Bob measures his VB and publically announces whether it is correct (O) or not (X). 5. Alice resets her phase basis ψ ∈ {0, } to either ψ ∈ { , + } or ψ ∈ {− , − } depending on the correctness. 6. The sequence 1~5 is repeated for the next order (column). Here the next order is for either each block { } with sifting or each bit (column) without sifting in Table 2.
[Network initialization flow chart for each key in Table S3] The following flow chart is for each sequence in Table S3, where each bit of an N-sized key is repeated sequentially. By doing this, Eve's memory-based attack is not effective anymore. Figure S3 shows an application of the round-trip MZI-based USCC in Fig. 2 for multi-core fiber-optic networks. Although double single-core fibers can replace the multi-core fiber without losing network stability [23], the multi-core fiber may give a technical simplicity due to the frozen relative phase drift.