University of Southern California Dissertations and Theses

Quantum steganography and quantum error-correction

(USC Thesis Other)

Quantum steganography and quantum error-correction

PDF

Download a page range

Download transcript

Copy asset link

Request this asset

Transcript (if available)

Content QUANTUM STEGANOGRAPHY AND QUANTUM ERROR-CORRECTION by Bilal A. Shaw A Dissertation Presented to the FACULTY OF THE USC GRADUATE SCHOOL UNIVERSITY OF SOUTHERN CALIFORNIA In Partial Fulllment of the Requirements for the Degree DOCTOR OF PHILOSOPHY (COMPUTER SCIENCE) August 2010 Copyright 2010 Bilal A. Shaw Dedication To my parents Afzal and Yaqoot Shaw, and to my sister Husna Shaw. ii Acknowledgments There are many people in my life without whom I would not have been able to nd my way to the United States of America, and then to the University of Southern California (USC), and without whom I would not be writing my doctoral dissertation. The path toward my doctoral thesis has been a long and arduous one. My intellectual adventure would not have been possible without the undying support, will, generosity, passion, intellectual curiosity, and tough-love of my advisor. Thank-you Todd for giving me a chance, and believing in me. Had I not picked up Surely you are joking Mr. Feynman as a young boy growing up in Kashmir, I probably would never have enjoyed physics, let alone quantum physics. Feynman's exploits, adventures, and passion for physics led me to pursue my doctorate. His legacy continues to inspire me to strive for excellence in science, while at the same time reminding me to not take life too seriously. Thank-you Dick! I rst got a taste of quantum information science (QIS) when I attended Computing Beyond Silicon Summer School (CBSSS) at Caltech in the summer of 2002, which I later helped to organize in the summer of 2004. I had the pleasure of hearing John Preskill's talk on quantum fault-tolerance, and Isaac Chuang's talk on quantum computing. At Caltech I met a brilliant young post-doctoral fellow by the name of Dave Bacon with whom I talked at length about quantum error-correction, and with whom I continued talking over the ensuing years. I thank Dave for being my mentor. I was fortunate that USC decided to delve into QIS by hiring Todd. I was searching for Ph.D. advisors at iii the time, and having talked to Dave, I knew that Todd would be a perfect t for me. I am happy and fortunate in knowing that this came out to be true in the end. I thank Leonard Adleman who was my advisor during my undergraduate and Masters years at USC. He taught me the importance of mathematical rigor and maturity, doing good scientic research, and the art of giving an excellent talk. With him I learned rst-hand that we live in an increasingly multi-disciplinary world. It is not enough to be just a mathematician, or just a biologist, or a physicist. The new world demands young graduates to move seamlessly and eortlessly between various elds. It demands us to be both a frog and an eagle; to be able to wallow in the mud at the edges of a pond, and dive into its depth without fear, and at the same time to be able to soar like an eagle above mountain-tops, with courage. He taught me not to be afraid to work on \cool" ideas. I also thank Nickolas Chelyapov who during this time taught me many molecular biology techniques and the discipline required of a good scientist. I thank one of my best friends Paul Rothemund who gave me his full support while I was Len's student. I thank Daniel Lidar who taught me quantum error-correction (QEC) and the theory of open quantum systems at USC. The rst paper that I wrote was a direct result of a project he gave his students to complete in his QEC course. Later when I gave a talk based on this project at the American Physical Society's March meeting in 2008 in New Orleans, I won the best student presentation award. I am deeply grateful to Daniel for being an excellent educator and scientist. I thank Igor Devetak whom I met in 2005, and who later taught me quantum Shan- non theory. I thank him for his friendship and for the various discussions he and I had on information theory which helped shape my own intellectual landscape. I also thank him for being part of Todd's research group meetings where I was among the rst students to witness the birth of entanglement-assisted quantum codes. This cod- ing scheme ultimately allowed researchers to import all of classical coding theory into quantum information science. iv I thank my friend, collaborator, and colleague Mark Wilde. His passion for this eld helped kindle my own when I felt as if the re within me was starting to die. His brilliance and ambition has been a source of inspiration to me. I would also like to thank him while I was in New Orleans attending the American Physical Society's March meeting, for his parents opened the doors of their heart and their home to me. I thank Min-Hsiu Hsieh, Hari Krovi, Jose Gonzalez, Stephen Jordan, Zhicheng Luo, Ognyan Oreshkov, Shesha Raghunathan, and Martin Varbanov with whom I have had various discussions on quantum information science in particular, and life in general. Ognyan was a big help to me in completing my project on quantum error-correction. I had an excellent time working on one of Igor Devetak's class projects with Hari. I owe many thanks to Gerrielyn Ramos, Milly Montenegro, Anita Fung, Tim Boston, Lizsl DeLeon, Steve Schrader, and Jun Camacho who did an excellent job in taking care of my paperwork and making sure that I was on top of non-research related things. I would not have been able to complete my research at USC without the support that I received from the computer science department at USC. The teaching assistantships helped me to survive in an overly expensive city. I thank Michael Crowley and David Wilczynski for taking me on as their teaching assistant. I would like to thank the folks outside my USC circle who supported me with their kind words, thoughts, prayers and blessings. At face value the Ph.D. is an original piece of research, but to me it has been more than mere tinkering with ideas, writing papers and giving talks. To me it has signied my intellectual, spiritual, and emotional growth as a human being and as a scientist. I am indebted to my yoga instructors Travis Eliot and Jennifer Pastilo for introducing me to yoga. This has been my salvation when I needed to unhook and unplug from the vibe of Los Angeles and USC. I am deeply thankful to Los Angeles that nurtured my pursuits outside of academia. I have basked in her beautiful sunshine, enjoyed walks on her beaches and hiked in her mountains. I thank all the talented baristas at Peet's Coee and Tea in Brentwood who provided me with free coee while I was doing research. v Lastly I thank my friends Iftikhar Burhanuddin, Tony Barnstone, Matthew Harmon, and Jonathan Trachtman. Matt and J. T. expanded my musical horizons and allowed me to explore musical genres that helped me during the many hours I spent writing my thesis and my papers. My escape from science has been writing poetry and to that I owe much thanks to Tony. I thank Ifti for all the interesting conversations we had on algorithms. I also thank my uncle Bashir Shaw and my aunt Khursheed Shaw who provided a roof over my head for three years when I was an undergraduate at Whittier College. I thank all of my teachers in Burn Hall High School, Kashmir, Saint Columba's High School, New Delhi, and Whittier College, California. In the end none of this would have been possible without the unconditional and unwavering love of my father Afzal, my mother Yaqoot, my sister Husna, and the memory of my days as a child growing up in Kashmir. vi Table of Contents Dedication ii Acknowledgments iii List of Tables ix List of Figures xi Abstract xv Chapter 1: Introduction 1 1.1 A Brief History of Quantum Information Science . . . . . . . . . . . . . . 1 1.2 Thesis Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Chapter 2: Quantum Stabilizer Codes 9 2.1 The Stabilizer Formalism . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.2 Quantum Error-Correction . . . . . . . . . . . . . . . . . . . . . . . . . . 14 2.3 Encoding Unitary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.4 Concluding Remarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Chapter 3: The Six-Qubit Code 19 3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 3.2 Degenerate Six-Qubit Quantum Code . . . . . . . . . . . . . . . . . . . . 22 3.2.1 Subsystem Code Construction . . . . . . . . . . . . . . . . . . . . 25 3.3 Non-existence of a [[6; 1; 3]] CSS Code . . . . . . . . . . . . . . . . . . . . 27 3.4 Non-degenerate Six-Qubit CSS Entanglement-Assisted Quantum Code . . 31 3.5 Non-existence of [[n; 1; 3; 1]] CSS codes for n 5 . . . . . . . . . . . . . . 39 3.6 Entanglement-Assisted Encoding Circuit . . . . . . . . . . . . . . . . . . . 44 3.7 Concluding Remarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Chapter 4: Classical Steganography 53 4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 4.2 Syndrome Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 4.2.1 Noisy Bit-Flip Channel . . . . . . . . . . . . . . . . . . . . . . . . 63 4.2.2 Numerical Simulation . . . . . . . . . . . . . . . . . . . . . . . . . 68 vii 4.3 Inner-Outer Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 4.3.1 Classical Steganographic Protocol . . . . . . . . . . . . . . . . . . 79 4.3.2 Three Bits In N Bits Encoding . . . . . . . . . . . . . . . . . . . . 81 4.3.3 M Bits In N Bits Encoding . . . . . . . . . . . . . . . . . . . . . . 83 4.3.4 Key Consumption Rate . . . . . . . . . . . . . . . . . . . . . . . . 85 4.4 Concluding Remarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Chapter 5: Quantum Steganography 93 5.1 The Depolarizing Channel . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 5.2 The Diamond Norm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 5.3 Concluding Remarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Chapter 6: Hiding Quantum Information in the Perfect Code 114 6.1 Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 6.2 Average rate of steganographic transmission . . . . . . . . . . . . . . . . . 127 6.3 Key Consumption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Chapter 7: Conclusion and Future Directions 137 Bibliography 140 viii List of Tables 2.1 Hadamard transformation of the Pauli matrices. . . . . . . . . . . . . . . 16 2.2 Phase transformation of the Pauli matrices. . . . . . . . . . . . . . . . . . 16 2.3 CNOT transformation of two qubits. . . . . . . . . . . . . . . . . . . . . . 17 3.1 Stabilizer generators h 1 , . . . , h 5 , and logical operators X and Z for the six-qubit code. The convention in the above generators is that Y =ZX. . 23 3.2 Stabilizer generatorsh 1 ;h 2 ;h 3 andh 5 , gauge subgroup generatorsH X and H Z , and logical operators X and Z for the six-qubit code. The convention in the above generators is that Y =ZX. . . . . . . . . . . . . . . . . . . . 27 3.3 (a) The generators and logical operators for the unencoded state. Gen- erators g 0 3 and g 0 6 indicate that Alice and Bob share an ebit. Alice's half of the ebit is her rst qubit and Bob's qubit is the other half of the ebit. Generators g 0 1 , g 0 2 , g 0 4 , and g 0 5 indicate that Alice's second, third, fourth, and fth respective qubits are ancilla qubits in the statej0i. The unen- coded logical operators X 0 and Z 0 act on the sixth qubit and indicate that the sixth qubit is the information qubit. (b) The encoded generators and logical operators for the [[6; 1; 3; 1]] entanglement-assisted quantum error-correcting code. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 3.4 Distinct pairs of single-qubit Pauli errors for the [[6; 1; 3]] quantum code. Each double-lined column lists a pair of single-qubit errors and a corre- sponding anticommuting generator (AG) for the code. X 4 and Z 4 Z 6 lie in the gauge subgroup H. . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 4.1 The rst column represents message classical/quantum that we intend to hide. The second column represents the shared secret key between Alice and Bob. The third column represents the quantum error-correcting code. Here CQECC stands for Classically-Enhanced Quantum Error-Correcting Code; QECC stands for Quantum Error-Correcting Code and EAQECC stands for Entanglement-Assisted Quantum Error-Correcting Code . . . . 56 4.2 Channel model for the [3,1,3] repetition code . . . . . . . . . . . . . . . . 59 ix 4.3 Conditional Probabilities - [3,1,3] Repetition Code . . . . . . . . . . . . . 66 4.4 Channel model for the [5,1,5] code . . . . . . . . . . . . . . . . . . . . . . 73 4.5 N s is the number of steganographic bits that Alice can hide and subse- quently transmit to Bob. Column 2 shows the various encoding schemes that Alice can employ to successfully transmit steganographic bits to Bob. 75 4.6 The rst column shows the two bits that Alice transmits to Bob, whereas the second column shows the received bits by Bob, some of which have experienced an error due to the noisy bit- ip channel. . . . . . . . . . . . 78 4.7 Encoding for transmitting one steganographic bit over a bit- ip channel with [3; 1; 3] as an inner-code and [N; 1;N] as the outer code. . . . . . . . 81 6.1 Stabilizer generators g 1 , . . . , g 4 , and logical operators X and Z for the perfect code. The convention in the above generators is that Y =ZX. . . 116 6.2 Syndrome table of the perfect code. The error operators are ordered according to syndrome values. . . . . . . . . . . . . . . . . . . . . . . . . . 121 6.3 Encoded error operators of the perfect code. . . . . . . . . . . . . . . . . . 125 6.4 Table of two-qubit errors. . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 x List of Figures 2.1 Steps in quantum error-correction. Thin lines denote quantum informa- tion and thick lines denote classical information. Slanted bars denote multiple qubits. Alice the sender of quantum information encodes a multi- qubit statej i using ancilla qubitsj0i. She sends the encoded state over a noisy quantum channel. Bob on receiving the quantum information per- forms multi-qubit measurements to extract classical information about the errors. He nally performs a recovery operation R to reverse the channel error. This recovery operation is composed of rstly correcting the errors and secondly decoding the corrected state. . . . . . . . . . . . . . . . . . . 13 2.2 Alice encodes her one qubit of quantum information with the help of two ancilla qubits using the encoding unitary shown in the dashed red box in the left side of the gure. She sends the codeword to Bob who uses the error-diagnosis circuit shown in the dashed blue box. The result of this measurement is projected on to the two ancilla qubits at the bottom. The information from these ancillas (syndrome result) is then used to apply the recovery procedure. Bob can now nally decode the quantum state to obtain the original one qubit of quantum information. . . . . . . . . . . . 15 3.1 Encoding circuit for the rst six-qubit code. The H gate is a Hadamard gate. For example, we apply a Hadamard on qubit four followed by a CNOT with qubit four as the control qubit and qubit six as the target qubit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 3.2 Logical CNOT for the six-qubit quantum code. The rst six qubits repre- sent a logical source qubit and the last six represent a logical target qubit. For example we begin the circuit by applying a CZ (controlled-Z) gate from source qubit two to target qubit seven. . . . . . . . . . . . . . . . . . 25 3.3 Encoding circuit for the [[6,1,3;1]] code. The \H" gate is a Hadamard gate. 37 xi 4.1 There are three dierent inputs to the steganographic encoderE : a cover- messagejCi; the secret message that we would like to hide, which can be quantumjSi or classical S; a shared secret key which may be quantum (ebit)jKi or classicalK. Eve can monitor some part of the noisy quantum channelN shown in the red box. Bob can decode the steganographic message using the decoderD and the shared secret keyjKi orK and recoverjCi, andjSi or S with very high probability. . . . . . . . . . . . . 56 4.2 Average Number of Steganographic Bits vs. Error-Rate p . . . . . . . . . 64 4.3 Noiseless Three-Bit Code. We plot the error-rate on the X-axis and the average number of bits, N avg , on the Y-axis for various error sequences. Herek varies from 1 to 100. As the error-rate increases Alice can hide up to two bits. The red curve plots the Shannon entropy of the probability distribution of the syndromes. . . . . . . . . . . . . . . . . . . . . . . . . . 70 4.4 Noiseless Five-Bit Code. We plot the error-rate on the X-axis and the average number of bits, N avg , on the Y-axis for various error sequences. Herek varies from 1 to 100. As the error-rate increases Alice can hide up to six bits. The red curve plots the Shannon entropy of the probability distribution of the syndromes. . . . . . . . . . . . . . . . . . . . . . . . . . 76 4.5 Noisy Three-Bit Code. We plot the channel noise p on the X-axis and the average number of bits correctly received by Bob, N avg , on the Y-axis for various error-rates p which decrease by an order of magnitude. . . . . 77 4.6 Classical Steganographic Protocol. The protocol begins in the top half. Alice's steganographic bits are shown in red. The one-time pad is shown in as green discs. The bold dashed line shows that Alice and Bob are separated over space and Alice uses a BSC to transmit the codeword to Bob. The bits colored red comprise the inner [3,1,3] block code, and the blue discs comprise the [10,1,10] outer block code. The noisy channel ips the fourth and eighth bits. The shared key is used by Alice and Bob to specify the location of the steganographic bits and to generate the one-time pad. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 4.7 Three Bits in N Bits Encoding. We plot the channel error-rate p on the X-axis and the average number of transmitted steganographic bits , N avg , on the Y-axis. Here M refers to the length of the inner code while N refers to the length of the entire block code. The curves in black show the Shannon entropy of the channel with the corresponding block code. . . . . 90 xii 4.8 M Bits in N Bits Encoding. We plot the channel error-rate p on the X-axis and the average number of transmitted steganographic bits , N avg , on the Y-axis. Here M refers to the length of the inner code while N refers to the length of the entire block code. The black curve shows the Shannon entropy of the channel when N = 17 bits. . . . . . . . . . . . . . 91 4.9 Key Consumption Rate. We plot the channel error-rate p on the X- axis and the key consumption rate KCR on the Y-axis. Here p = 0:001; 0:005; 0:01; 0:05, and 0:1. . . . . . . . . . . . . . . . . . . . . . . . . 92 5.1 We plot the key consumption rate (KCR) as a function of the error-rate p of the channel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 5.2 Quantum Steganographic Protocol. Alice hides her information qubit (solid brown circle) by swapping it in with a qubit of her quantum code- word. She uses her shared secret key with Bob to determine which qubit to swap. She uses the shared key again to twirl the information qubit. She further applies random depolarizing errors to the rest of the qubits of the codeword (shown in green). She sends the codeword through a depolarizing channel to Bob who uses the shared secret to correctly apply the untwirling operation, followed by locating and swapping out Alice's original information qubit. . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 6.1 Encoding circuit for the perfect code. The H gate is a Hadamard gate, and the two-qubit gates are CNOT gates. The rst four qubits are ancilla qubits and the fth qubitj c i is the cover-qubit. . . . . . . . . . . . . . . 115 6.2 Steganographic protocol to hide four qubits of information using the per- fect code. Based on a classical shared secret key with Bob, Alice hides four qubits,j 1 i;:::;j 4 i by applying the twirling procedure to each of her four qubits and transforms each qubit into a maximally mixed state. We call this system the stego subsystem S. The twirling procedure is applied by the yellow box. We label the rst four ancilla qubitsj0i along with the cover-qubitj C i as Alice's subsystem A. The rst unitaryU 1 depicted by the blue box is applied to the subsystemsA andS, followed by unitaryU 2 . Finally Alice applies the encoding unitaryE to subsystem A and sends it over a channel to Bob. She traces out subsystemS. Bob upon receiving the codeword decodes it by applying the decoding circuit D. He uses the shared secret key to undo the unitary transformationsU 1 andU 2 that were applied by Alice. He nally uses the shared secret key to untwirl the qubits to obtain the stego qubits. . . . . . . . . . . . . . . . 119 6.3 Swap circuit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 xiii 6.4 The red curve shows the Shannon entropy of the binary-symmetric chan- nel. The blue curve underneath the entropy curve is the rate of stegano- graphic information maximized for various values of the error-ratep of the channel. In the limit of large N, encoding in a single large block (rather than multiple sub-blocks) can achieve a rate of steganographic transmis- sion approaching the Shannon entropy [44]. For small p one doesn't do too much worse using multiple nite-sized code blocks. . . . . . . . . . . . 130 xiv Abstract Quantum error-correcting codes have been the cornerstone of research in quantum infor- mation science (QIS) for more than a decade. Without their conception, quantum com- puters would be a footnote in the history of science. When researchers embraced the idea that we live in a world where the eects of a noisy environment cannot completely be stripped away from the operations of a quantum computer, the natural way forward was to think about importing classical coding theory into the quantum arena to give birth to quantum error-correcting codes which could help in mitigating the debilitating eects of decoherence on quantum data. We rst talk about the six-qubit quantum error-correcting code and show its connections to entanglement-assisted error-correcting coding theory and then to subsystem codes. This code bridges the gap between the ve-qubit (perfect) and Steane codes. We discuss two methods to encode one qubit into six physical qubits. Each of the two examples corrects an arbitrary single-qubit error. The rst example is a degenerate six-qubit quantum error-correcting code. We explicitly provide the stabilizer generators, encoding circuits, codewords, logical Pauli operators, and logical CNOT operator for this code. We also show how to convert this code into a non-trivial subsystem code that saturates the subsystem Singleton bound. We then prove that a six-qubit code without entanglement assistance cannot simultaneously pos- sess a Calderbank-Shor-Steane (CSS) stabilizer and correct an arbitrary single-qubit error. A corollary of this result is that the Steane seven-qubit code is the smallest single- error correcting CSS code. Our second example is the construction of a non-degenerate six-qubit CSS entanglement-assisted code. This code uses one bit of entanglement (an xv ebit) shared between the sender (Alice) and the receiver (Bob) and corrects an arbitrary single-qubit error. The code we obtain is globally equivalent to the Steane seven-qubit code and thus corrects an arbitrary error on the receiver's half of the ebit as well. We prove that this code is the smallest code with a CSS structure that uses only one ebit and corrects an arbitrary single-qubit error on the sender's side. We discuss the advantages and disadvantages for each of the two codes. In the second half of this thesis we explore the yet uncharted and relatively undis- covered area of quantum steganography. Steganography is the process of hiding secret information by embedding it in an \innocent" message. We present protocols for hiding quantum information in a codeword of a quantum error-correcting code passing through a channel. Using either a shared classical secret key or shared entanglement Alice dis- guises her information as errors in the channel. Bob can retrieve the hidden information, but an eavesdropper (Eve) with the power to monitor the channel, but without the secret key, cannot distinguish the message from channel noise. We analyze how dicult it is for Eve to detect the presence of secret messages, and estimate rates of steganographic communication and secret key consumption for certain protocols. We also provide an example of how Alice hides quantum information in the perfect code when the underly- ing channel between Bob and her is the depolarizing channel. Using this scheme Alice can hide up to four stego-qubits. xvi Chapter 1 Introduction When I heard the learn'd astronomer; When the proofs, the gures, were ranged in columns before me; When I was shown the charts and the diagrams, to add, divide, and measure them; When I, sitting, heard the astronomer, where he lectured with much applause in the lecture-room, How soon, unaccountable, I became tired and sick; Till rising and gliding out, I wander'd o by myself, In the mystical moist night-air, and from time to time, Look'd up in perfect silence at the stars. |Walt Whitman 1.1 A Brief History of Quantum Information Science Although I am not sure what exactly was going through James Clerk Maxwell's (1831|1879) mind when he formulated his now famous laws of electromagnetism, I can certainly imagine that he had no idea that a few decades into the future Thomas Alva Edison residing in the New World would construct several devices operating on the physics that he [Maxwell] worked to unify, namely electricity and magnetism. Moreover, he probably had no idea that in the future universities would award doctoral degrees in 1 electrical engineering, and that there would be entire departments dedicated to under- standing and engineering this force of Nature. Maxwell's work on electromagnetism has often been dubbed as the \second great unication in physics" second only to Sir Isaac Newton's rst unication. Around the time that Edison was designing electrical machines in his copious note- books and subsequently inventing them, the world of physics was undergoing a revolution of its own. This revolution started when physicists observed phenomena (paradoxes) in Nature that could not be explained through classical physics. These included black-body radiation, the photoelectric eect, the stability of atoms (ultraviolet catastrophe), and matter waves (particle-wave duality). Through the eorts of brilliant scientists such as Einstein, Bohr, Schr odinger, Heisenberg, Pauli, Born and still others, these paradoxes were ultimately resolved. Their eorts led to the creation of the new eld of quantum mechanics, when nally researchers realized that the sub-atomic world is intrinsically probabilistic, and that there is an underlying uncertainty in simultaneously measuring certain real-world observables such as the momentum and position of a particle. While the physicists were thinking about the atomic world, Claude Shannon ushered the eld of information theory with his seminal paper of 1948 in which he established the source coding and channel coding theorems [43]. The former gives us the ultimate limit on the compressibility of information while the latter tells us that given a noisy channel, one can encode information in such a way that the receiver of information can reliably decode it. Of course this assumes that the designer of error-correcting codes has certain knowl- edge of the noise in the channel. Without Shannon's seminal work we would not have the modern communication devices that have become so ubiquitous, and which we take for-granted every day. While Claude Shannon was busy at Bell Labs solidifying his ideas on information theory and mathematical logic, Alan Turing was laying the foundation of modern computing theory. Turing wanted to know if there was a universal machine that could compute solutions to computable functions. All modern day computers from laptops to supercomputers are based on the simple notion that given a machine with 2 enough memory, a nite set of symbols and a read/write head that can store its own state, one can perform complex computations. Alan Turing's simple yet deep insight is a testament to the power of great ideas and their ability to transform society (for the better) [52]. In science, unication occurs when ideas in its various elds have had enough time to mature. Several researchers before Maxwell had separately worked on electricity and magnetism before he unied these two pictures into the electromagnetic wave. Among these researchers the notable ones were Andr e-Marie Ampere, Benjamin Franklin, J. J. Thompson, Oliver Heaviside, Joseph Henry, Nikola Tesla, and still others. Similarly, it took a few decades for quantum physics, information theory, and computer science to mature before these seemingly separate elds could be united into quantum information science. The story of this unication started when Richard Feynman and others asked the question of whether a computer operating on the laws of quantum physics might give an appreciable speed-up in simulating quantum physics problems that may be hard to solve on a classical computer [20, 3, 34]. This question was answered by Seth Lloyd in [33]. In the 1970s Charles Bennett (IBM) showed that any computation can in principle be done reversibly, based on earlier work by Rolf Landauer in the 1960s [31, 4]. Rolf Launder showed that if a computer erases a single bit of information, the amount of energy dissipated into the environment is at least k B T ln 2, where k B is Boltzmann's constant andT is the temperature of the environment of the computer [38]. If a computation can be performed reversibly then no information is erased and hence there is no dissipation of energy. To realize the theory of quantum computation it was crucial to make this connection between reversibility and energy dissipation. This was because we evolve closed quantum system via unitary operators which are themselves reversible. One of the hallmarks of quantum mechanics is that one can write superpositions of various quantum states. One can then imagine exploiting these states in a parallel fashion via operators that transform these states. Researchers quickly realized that naive 3 applications of quantum parallelism added nothing to the power of the computer. But in 1985, David Deutsch found a clever algorithm that exploited quantum parallelism indirectly to solve a problem more eciently than any possible classical computer [16]. The problem was articial, but it was the rst example where a quantum computer was shown to be more powerful than a classical computer. Richard Jozsa and David Deustch later generalized this problem and they showed that there was an exponential gap in query complexity between a quantum and a classical computer. We were starting to see a grand unication of quantum mechanics with computer science. Meanwhile in 1984 Charles Bennett and Gilles Brassard found a clever way to exploit the properties of quantum mechanics for information processing [5]. They were able to exploit the uncertainty principle as a way to distribute a cryptographic key to two parties, Alice and Bob, with perfect security. In their set-up single quanta were used to send bits of the cryptographic key in one of two possible complementary variables. If Eve tried to intercept the quantum bits and measure them, this would automatically disturb them in such a way that it could always be detected by Alice and Bob. Upon learning this, they would abort the protocol as it had been compromised. This scheme was aptly termed as the BB84 (Bennett-Brassard) protocol for quantum key distribution. We often hear people refer to the latter as quantum cryptography. We must make it clear that this is a misnomer. All that this protocol does is distribute keys securely to two parties. Alice and Bob can subsequently use their shared keys to send cryptographic messages to each other. We should also mention that this is the only quantum information protocol which has been realized commercially. Charles Bennett and his collaborators found even more interesting quantum communication protocols. In particular they found one where a sender could send an unknown quantum state to a receiver using a classical channel and consuming shared entanglement between the sender and the receiver. We call this quantum communication protocol as quantum teleportation [7]. Bennett along with Stephen Weisner engineered a protocol by which a sender could transmit classical information by consuming shared entanglement and utilizing a quantum channel between 4 the sender and the receiver [6]. We call this quantum communication protocol as super- dense coding. Even before Charles Bennett and company started exploiting the power of quantum physics to perform information theoretical tasks, Stephen Wiesner had indicated in a paper Conjugate Coding that it was impossible to perfectly duplicate or clone two or more unknown nonorthogonal quantum states. This paper which was submitted to IEEE Transactions on Information Theory in 1970 was summarily rejected as it was written in a language incomprehensible to computer scientists, information theorists, and electrical engineers. His work was nally published in its original form in [54] in 1983 in Association of Computing Machinery, Special Interest Group in Algorithms and Computation Theory. In the same paper Wiesner also suggested that his no-cloning theorem could also enable the possibility of money whose authenticity would be guaranteed by the laws of quantum physics. The no-cloning theorem places a severe constraint on what can be achieved by uniting ideas from quantum mechanics and information theory. This was one of the earliest concerns raised by researchers on the viability of an operational quantum computer. There was an uneasiness in the research community that perhaps a quantum com- puter would only be good for solving toy problems and, moreover, clever randomized algorithms could probably beat these toy quantum algorithms. In addition because of the sensitive nature of quantum systems and their susceptibility to noisy environ- ments researchers believed that any quantum state that one would prepare as input to a quantum computer would rapidly decohere because of unwanted interactions with its environment. Another major objection to a viable quantum computer was the quantum mechanical principle that measurement destroys a quantum state. As we shall see in sub- sequent chapters that despite these objections researchers were able to forge ahead and develop quantum error-correcting codes that reduced the negative eects of decoherence and got around the measurement problem. 5 In 1994 Daniel Simon discovered a quantum algorithm for another toy problem that provided an exponential separation in query complexity over a classical randomized algorithm [48]. The stage was being set for a major breakthrough. In the same year a mathematician by the name of Peter Shor at AT&T Bell Labs discovered two polynomial time quantum algorithms [45, 46]. The rst algorithm could factor integers in polyno- mial time, whereas the second algorithm gave an exponential speed-up over the discrete logarithm problem. Both factoring and the discrete logarithm problems are extremely hard problems. The reason why Shor's algorithm turned several heads was because rstly it became apparent that quantum algorithms were good at something other than solving mere toy problems, and secondly the security of well known cryptosystems such as RSA [41] relies on the hardness of factoring while the security of ElGamal cryp- tosystem [18] relies on the hardness of the discrete logarithm problem. Researchers in cryptography have been working on post-quantum cryptography. In the event when large-scale quantum computers become operational, which public-key schemes would be resistant to quantum computer attacks? The explosion in the number of papers being published in quantum information sci- ence is extraordinary. In just a few years the eld has matured to the point where it is no longer possible for a single researcher to keep track of all the papers being published. In the theoretical arena alone researchers are working on quantum error-correcting codes, fault-tolerant quantum computing, quantum algorithms, quantum Shannon the- ory, quantum entanglement, quantum complexity theory, and open quantum systems. There is of course a parallel eort to realize various quantum computing and quan- tum Shannon schemes experimentally through solid-state physics, nanophotonics, and Bose-Einstein condensates. So perhaps in the near future when quantum information science comes of age, the term \quantum computer" will be a household name, just as PCs or MACs are today. Perhaps in the future QIS will not be a loose conglomerate of such academic depart- ments as electrical engineering, computer science, physics, and mathematics, but will be 6 a department in its own right. Maybe we will routinely hear quantum states being tele- ported over quantum networks, or high school students running quantum simulations on their personal quantum computers, or big business deals being carried out using quan- tum cryptography and quantum steganography. Perhaps then the eorts and passion of all the hardworking researchers in this eld will be truly realized on a societal level; a triumph. 1.2 Thesis Organization This thesis is a major contribution to quantum error-correction theory and quantum Shannon theory. This thesis is essentially divided into two parts. In the rst half we present the theory of quantum error-correction starting with quantum stabilizer codes in the next chapter. The six-qubit code bridges the gap between the ve-qubit (perfect code) and the Steane codes. The ve-qubit has been extensively studied in [38] because it was the rst example of the smallest non-degenerate code that could correct an arbitrary single-qubit error [30]. The seven-qubit code, popularly known as the Steane code after its discoverer Andrew Steane, has also been studied extensively because it lends itself nicely to a fault-tolerant design of universal quantum gates [50]. In fact if we open [38] we nd that the authors provide a detailed study of these two codes, but none for the six- qubit code. We hope that when quantum computers become operational, the six-qubit code will provide a middle ground for encoding quantum data. In the second half of this thesis we present the theory of quantum steganography. It came as a surprise to us that this sub-area of quantum Shannon theory had barely been explored given that classical steganography has been around since Simmons rst posed the problem in 1983 using information-theoretic terminology [49]. In order to develop quantum steganography we needed to develop intuition about classical steganography using classical error-correcting codes. In Chapter 4 we present classical ideas on infor- mation hiding. After we develop our intuition for classical steganography we present our 7 full formalism for quantum steganography in Chapter 5. We provide the rate of stegano- graphic information and give specic examples of how to hide qubits using quantum error-correcting codes transmitted over the binary-symmetric and depolarizing channels. In Chapter 6 we show how one can use the second protocol detailed in Chapter 5 to hide up to four stego-qubits in the perfect code. For a specic encoding we give the optimal number of stego-qubits that Alice can send to Bob over the depolarizing channel as a function of the error-rate. In the same chapter we also show the amount of key consumed by Alice and Bob to realize this protocol. We hope that this work will blossom into a sub-eld of quantum information science just as quantum cryptography has in recent years. The mathematics behind these ideas is simple and straightforward, and all that one requires to fully comprehend this thesis is mathematical maturity, knowledge of college level linear algebra, and familiarity with Dirac notation used in quantum mechanics. We end the thesis with closing remarks in which we outline some further work that one can pursue in quantum steganography. 8 Chapter 2 Quantum Stabilizer Codes It is not knowledge, but the act of learning, not possession but the act of getting there, which grants the greatest enjoyment. |Carl Friedrich Gauss The stabilizer formalism is to quantum error-correction what additive codes are to clas- sical linear error-correction. It is a powerful mathematical framework based on group theory. Using this formalism a quantum-code engineer can import classical codes using the CSS construction (dual-containing codes) [50, 14, 38], and design quantum codes with good error-correcting properties and good rates. More recently the stabilizer for- malism has been used to design graph states [24]. It is used in cluster-state quantum computation [40], and the theory of entanglement [19]. It has also been extended to entanglement-assisted quantum codes [11]. Much of the stabilizer formalism was worked out be Daniel Gottesman in his brilliant thesis [22]. For more details we direct the reader to his thesis. In this chapter we review the stabilizer formalism for block-codes, the steps involved in error-correction, the Cliord operations that one uses to construct the encoding uni- tary circuits for these codes. We assume the reader is familiar with elementary group theory at the undergraduate college level [32]. In this chapter we have used Mark Wilde's thesis for some of the exposition [58]. 9 2.1 The Stabilizer Formalism One of the hallmarks of the stabilizer formalism is that it gives us a compact represen- tation of a quantum error-correcting code. Instead of keeping track of the amplitudes of complicated superpositions of quantum codewords, we can just keep track of the stabi- lizer generators of the code (which are linear in the number of qubits). As an example consider the following GHZ state: j i GHZ j000i +j111i p 2 : (2.1) The following operators leave the GHZ state unchanged: I 1 I 2 I 3 I I I; Z 1 Z 2 Z Z I; Z 1 Z 3 Z I Z; Z 2 Z 3 I Z Z; X 1 X 2 X 3 X X X: We say that the GHZ state is xed or stabilized by the operators above. The main idea in the stabilizer formalism is that one can just think of these operators and their transformation as they are acted upon by error operators, encoding unitary operators, and measurement operators. The stabilizer is a subgroup of the general Pauli group G n on n qubits. More specically G n is an n-fold tensor product of the matrices from the Pauli setP =fI;X;Y;Zg: I 2 4 1 0 0 1 3 5 ; X 2 4 0 1 1 0 3 5 ; Y 2 4 0 i i 0 3 5 ; Z 2 4 1 0 0 1 3 5 : 10 We write the setG n as: G n = n e i A 1 A n :8j2f1;:::;ng; A j 2P; 2f0;=2;; 3=2g o : (2.2) An example of an element from G n is X 1 X I ::: I, where X acts on the rst qubit, while the n 1 identity operators act on rest of the n 1 qubits. While writing these n-fold tensor operators we will often omit the tensor product sign, and just indicate the operator as X 1 or as XI:::I. We need the factors1;i in front of the group elements so that the group is closed under multiplication. Three interesting properties of the elements ofG n are that they either commute or anticommute with each other, each has eigenvalue +1 or -1, and the product of each element with itself is the n-fold identity operator. The stabilizer is a subgroupS n ofG n such that all the elements in it commute with each other. Each element of S n stabilizes some number of quantum states. The intersection of all these subspaces xed by each element of S n constitutes the codespace. In group theory one can reconstitute the entire group by the underlying group operation between some specic elements of the group called generators. So this way we get a very compact representation of the group. Instead of listing all the elements of the group, we just specify its generators. As an example, consider the the group G 3 whose members 3-fold tensor product of Pauli operators and whose members operate on three qubits. This group has 4 3 4 = 256 members. We enumerate some of the members of this group below: G 3 fIII;iIII;XII;iXII;:::;ZZZ;iZZZg: Let S 3 = fIII;ZZI;IZZ;ZIZg be a subgroup of G 3 . Each member of S 3 xes a subspace. ZZI xes the statesj000i;j001i;j110i, andj111i. Similarly,IZZ stabilizes the statesj000i;j011i;j100i, andj111i. III stabilizes the statesj000i andj111i, while ZIZ stabilizesj000i;j010i;j101i, andj111i. The codespace is the intersection of the subspaces spanned by all the members ofS 3 . So the codespaceC 3 =fj000i;j111ig. Notice that we 11 did not really need to write all the four members of S 3 . We can representS 3 compactly through its generatorsZZI andIZZ. We write the generator set asG S 3 =hZZI;IZZi. With these two generators we can generate S 3 as follows: III = (ZZI)(ZZI) and ZIZ = (ZZI)(IZZ). So when we give a description of a code in terms of its stabilizers, we mean the stabilizer generators. The stabilizer generators form an independent set, in the sense that no generator is a product of two or more generators. In the section on the conversion of stabilizer generators to binary matrices, this translates into the rows of the matrix being linearly independent|no row in the matrix can be obtained by the product of two or more rows. The stabilizer for a quantum error-correcting code cannot contain the elementI. To see this assume that the codespace is not the trivial subspace. Let j i be a state that is stabilizedI. This implies thatIj i =j i, which would mean thatj i is the trivial state, and hence a trivial subspace which we assumed was not the case. The stabilizer generators must all commute to constitute a valid codespace. These stabilizer generators for quantum codes function as parity check matrices for classical linear codes. An element g 1 6=I from the set G n has two eigenspaces labeled by eigenvalue +1 and -1 of equal size 2 n =2 = 2 n1 . Now pick another element g 2 from G n dierent from bothI and g 1 , but which commutes with g 1 . g 2 also has two eigenspaces of equal size 2 n1 labeled by eigenvalue +1 and -1. But since g 1 and g 2 commute they have simultaneous eigenspaces. So both operators can now stabilize quantum states in four eigenspaces which we label asf++; +;+;g. Each eigenspace has size 2 n =2 2 = 2 n2 . In this way we can keep picking up elements from G n and subdividing the 2 n dimensional Hilbert space into subspaces of equal sizes. These subspaces are all orthogonal to each other. So if we choose nk elements g 1 ;g 2 ;:::;g nk from G n such that they all commute with each other and none is equal toI, then we end up dividing the Hilbert space into 2 nk subspaces each of size 2 k . Call this setS n . ClearlyS n G n . We can label these subspaces asf+ +::: +; +::: +;:::;:::g. So each subspace can contain a Hilbert space of k qubits. We choose a special subspace represented by 12 Figure 2.1: Steps in quantum error-correction. Thin lines denote quantum information and thick lines denote classical information. Slanted bars denote multiple qubits. Alice the sender of quantum information encodes a multi-qubit statej i using ancilla qubits j0i. She sends the encoded state over a noisy quantum channel. Bob on receiving the quantum information performs multi-qubit measurements to extract classical information about the errors. He nally performs a recovery operationR to reverse the channel error. This recovery operation is composed of rstly correcting the errors and secondly decoding the corrected state. the label + +::: + which is the simultaneous +1 eigenspace of the elements of S n . We call this subspace the codespace and it represents a quantum error-correcting code that encodes k logical qubits into n physical qubits, and we indicate this as [[n;k]]. There is nothing special about the simultaneous +1 eigenspace. We could have easily chosen any of the other subspaces as well. So in addition to the commutation property, the stabilizer generators must all have eigenvalues equal to +1. When an error occurs it moves the codeword out of the simultaneous +1 eigenspace into one of the orthogonal subspaces. It is this orthogonality property of these subspaces that allows us to detect the error and safely recover from it. We can multiply the stabilizer generators and obtain an equivalent representation. This operation would be equivalent to adding bases together in vector notation. In the next section we list the steps of how a quantum error-correcting code operates. 13 2.2 Quantum Error-Correction An [[n;k]] quantum error-correcting code operates when: (i). Alice encodes herk qubits of quantum information along with nk ancilla qubits j0i nk into the general multi-qubit statej i. She encodes this into the simulta- neous +1-eigenspace of the stabilizer generators g 1 ;g 2 ;:::;g nk as shown in Fig- ure 2.1. In this way, Alice has encoded k logical qubits into n physical qubits. (ii). Alice sends her n-qubit state (quantum codeword) over a noisy quantum channel to Bob, using the channel n times. (iii). Bob on receiving the codeword performs a measurement of thenk stabilizer gen- erators to determine if an error has occurred. Recall that the stabilizer generators are composed from Pauli matrices which are Hermitian and hence valid observables on which one can perform measurements and obtain classical information. In the ideal case when no errors occur, the measurement will give Bob a bit-string ofnk +1 values. When an error occurs the codeword moves out of the +1-eigenspace to one of the the other 2 nk 1 subspaces. When a measurement of a stabilizer generators gives Bob a value of -1, then he knows exactly which error has occurred as this new bit-string diers from the all +1 bit-string, and he can undo that error by reapplying the error on that particular qubit. These measurements performed by Bob do not disturb the original quantum state. Moreover it suces to correct only a discrete set of errorsE even though errors in quantum information can be continuous [47, 38].E is a subset of the general Pauli groupG n . Bob can uniquely identify which error has occurred if the following condition holds: 8E a ;E b 2E 9 g i 2S n : n g i ;E y a E b o = 0 or E y a E b 2S n : (2.3) What the above condition is stating is that as long as an error anticommutes with one of the stabilizer generators, Bob ought to be able to detect this. This is 14 Figure 2.2: Alice encodes her one qubit of quantum information with the help of two ancilla qubits using the encoding unitary shown in the dashed red box in the left side of the gure. She sends the codeword to Bob who uses the error-diagnosis circuit shown in the dashed blue box. The result of this measurement is projected on to the two ancilla qubits at the bottom. The information from these ancillas (syndrome result) is then used to apply the recovery procedure. Bob can now nally decode the quantum state to obtain the original one qubit of quantum information. the active correction part. The second condition says that there can be \error" operators that commute with the stabilizer generators. These are undetectable by Bob, however, Bob does not care about them. This is the passive correction part. (iv). If Bob can diagnose which error has occurred, he can correct for it during the recovery procedure as shown in Figure 2.1. Once he obtains the corrected codeword, he can decode it to obtain the original k information qubits. We now give a specic example of the [[3; 1]] stabilizer code that can correct a single bit- ip error. With this code Alice can encode one logical qubit into three physical qubits. So n = 3 and k = 1. This code has nk = 3 1 = 2 stabilizer generators. These are g 1 =ZZI and g 2 =IZZ. The codewords for this code arej000i andj111i. Figure 2.2 shows the encoding unitary, the error diagnosis and recovery circuits as well as the decoding unitary. The bit patterns corresponding to bit- ip errors are: X 1 = XII = f1; +1g;X 2 = IXI =f1;1g;X 3 = IIX =f+1;1g;I = III =f+1; +1g. Since the [[3; 1]] code is a very simple code, the encoding unitary circuits are sparse. In a later 15 Target Conjugation Target I HIH y I X HXH y Z Y HYH y Y Z HZH y X Table 2.1: Hadamard transformation of the Pauli matrices. Target Conjugation Target I PIP y I X PXP y Y Y PYP y X Z PZP y Z Table 2.2: Phase transformation of the Pauli matrices. chapter when we exploit quantum error-correcting codes to hide quantum information we will deal with the [[7; 1]] Steane code whose encoding unitary circuit consists of thirty-six quantum gates! 2.3 Encoding Unitary The stabilizer generators also give us a way to generate the encoding circuit for any stabilizer code. These unitaries belong to a special class called Cliord unitaries. What makes them special is that when we conjugate an element from G n with a Cliord unitary, it produces another element of G n . Specically, given a Cliord unitary U and an element G fromG n , UGU y =G 0 , where G 0 is an element of G n . Gottesman showed in his thesis [22] that CNOT, Hadamard, and Phase gates are sucient to construct any Cliord unitary. The CNOT acts on two qubits, whereas the Hadamard and Phase gates act on a single qubit. In Section 3.6 of Chapter 3, we detail an algorithm that generates the encoding circuit for the six-qubit code. The matrix corresponding to the Hadamard gate is: H = 1 p 2 2 4 1 1 1 1 3 5 : (2.4) 16 Target Control Conjugation Target Control I I CNOT (I I)CNOT y I I I X CNOT (I X)CNOT y X I I Y CNOT (I Y )CNOT y X Y I Z CNOT (I Z)CNOT y I Z X I CNOT (X I)CNOT y X I X X CNOT (X X)CNOT y I X X Y CNOT (X Y )CNOT y I Y X Z CNOT (X Z)CNOT y X Z Y I CNOT (Y I)CNOT y Y Z Y X CNOT (Y X)CNOT y Z Y Y Y CNOT (Y Y )CNOT y Z X Y Z CNOT (Y Z)CNOT y Y I Z I CNOT (Z I)CNOT y Z Z Z X CNOT (Z X)CNOT y Y Y Z Y CNOT (Z Y )CNOT y Y X Z Z CNOT (Z Z)CNOT y Z I Table 2.3: CNOT transformation of two qubits. The matrix for the Phase gate is: P = 2 4 1 0 0 i 3 5 : (2.5) The matrix for the CNOT is slightly more complicated: CNOT = 2 6 6 6 6 6 6 6 4 1 0 0 0 0 1 0 0 0 0 0 1 0 0 1 0 3 7 7 7 7 7 7 7 5 : (2.6) The standard basis for the one qubit Pauli group G 1 is X and Z. We list the transfor- mation of this basis under conjugation with the Hadamard and Phase gates in Table 2.1 and in Table 2.2 respectively. We list the conjugate transformation of two-qubit Pauli matrices with the CNOT gate in Table 2.3. These tables will be useful in the thesis later when we calculate the encoding of various error operators. 17 2.4 Concluding Remarks The theory of error-correcting codes is vast and the number of papers published in this sub-eld of quantum information science is unprecedented. We only provided the mathematical framework necessary to understand the results of Chapter 3. There is a further mathematical tool called the Pauli-to-binary isomorphism that is important in understanding and appreciating the results of the next chapter. Instead of reproducing the tool here, we refer the reader to [10]. 18 Chapter 3 The Six-Qubit Code It matters if you just don't give up. |Stephen Hawking 3.1 Introduction It has been more than a decade since Peter Shor's seminal paper on quantum error correction [47]. He showed how to protect one qubit against decoherence by encoding it into a subspace of a Hilbert space larger than its own. For the rst time, it was possible to think about quantum computation from a practical standpoint. Calderbank and Shor then provided asymptotic rates for the existence of quantum error-correcting codes and gave upper bounds for such rates [14]. They dened a quantum error-correcting code as an isometric map that encodes k qubits into a subspace of the Hilbert space ofn qubits. As long as onlyt or fewer qubits in the encoded state undergo errors, we can decode the state correctly. The notation for describing such codes is [[n;k;d]], where d represents the distance of the code, and the code encodes k logical qubits into n physical qubits. These earlier codes are examples of additive or stabilizer codes. Additive codes encode quantum information into the +1 eigenstates ofn-fold tensor products of Pauli operators [23, 22]. Gottesman developed an elegant theory, the stabilizer formalism, that describes error correction, detection, and recovery in terms of algebraic group theory [22]. 19 Steane constructed a seven-qubit code that encodes one qubit, corrects an arbitrary single-qubit error, and is an example of a Calderbank-Shor-Steane (CSS) code [50]. The ve-qubit quantum error-correcting code is a \perfect code" in the sense that it encodes one qubit with the smallest number of physical qubits while still correcting an arbitrary single-qubit error [30, 8]. Even though every stabilizer code is useful for fault-tolerant computation [23, 22], CSS codes allow for simpler fault-tolerant procedures. For example, an encoded CNOT gate admits a transversal implementation without the use of ancillas if and only if the code is of the CSS type [22]. The ve-qubit code is not a CSS code and does not possess the simple fault-tolerant properties of CSS codes [38]. The Steane code is a CSS code and is well-suited for fault-tolerant computation because it has bitwise implementations of the Hadamard and the phase gates as well (the logicalX andZ operators have bitwise implementations for any stabilizer code [23]). However, an experimental realization of the seven-qubit code may be more dicult to achieve than one for the ve-qubit code because it uses two additional physical qubits for encoding. Calderbank et al. discovered two distinct six-qubit quantum codes [13] which encode one qubit and correct an arbitrary single-qubit error. They discovered the rst of these codes by extending the ve-qubit code and the other one through an exhaustive search of the encoding space. Neither of these codes is a CSS code. The ve-qubit code and the Steane code have been studied extensively [38], but the possibility for encoding one qubit into six has not received much attention except for the brief mention in Ref. [13]. In this thesis, we bridge the gap between the ve-qubit code and the Steane code by discussing two examples of a six-qubit code. We also present several proofs concerning the existence of single-error-correcting CSS codes of a certain size. One of our proofs gives insight into why Calderbank et al. were unable to nd a six-qubit CSS code. The other proofs use a technique similar to the rst proof to show the non-existence of a CSS entanglement-assisted code that uses fewer than six local 20 physical qubits where one of the local qubits is half of one ebit, and corrects an arbitrary single-qubit error. We structure our work according to our four main results. We rst present a degen- erate six-qubit quantum code and show how to convert this code to a subsystem code. Our second result is a proof for the non-existence of a single-error-correcting CSS six- qubit code. Our third result is the construction of a six-qubit CSS entanglement-assisted quantum code. This code is globally equivalent to the Steane code. We nally show that the latter is the smallest example of an entanglement-assisted CSS code that corrects an arbitrary single-qubit error. In Section 3.2, we present a degenerate six-qubit quantum error-correcting code that corrects an arbitrary single-qubit error. We present the logical Pauli operators , CNOT and encoding circuit for this code. We also prove that a variation of this code gives us a non-trivial example of a subsystem code that saturates the subsystem Singleton bound [27]. In Section 3.3, we present a proof that a single-error-correcting CSS six-qubit code does not exist. Our proof enumerates all possible CSS forms for the ve stabilizer generators of the six-qubit code and shows that none of these forms corrects the set of all single-qubit errors. Section 3.4 describes the construction of a six-qubit non-degenerate entanglement- assisted CSS code and presents its stabilizer generators, encoding circuit, and logical Pauli operators. This code encodes one logical qubit into six local physical qubits. One of the physical qubits used for encoding is half of an ebit that the sender shares with the receiver. The six-qubit entanglement-assisted code is globally equivalent to the seven- qubit Steane code [50] and thus corrects an arbitrary single-qubit error on all of the qubits (including the receiver's half of the ebit). This ability to correct errors on the receiver's qubits in addition to the sender's qubits is not the usual case with codes in the entanglement-assisted paradigm, a model that assumes the receiver's halves of the ebits are noise free because they are already on the receiving end of the channel. We 21 show that our example is a trivial case of a more general rule|every [[n; 1; 3]] code is equivalent to a [[n 1; 1; 3; 1]] entanglement-assisted code by using any qubit as Bob's half of the ebit. Finally, in section 3.5, we present a proof that the Steane code is an example of the smallest entanglement-assisted code that corrects an arbitrary single-qubit error on the sender's qubits, uses only one ebit, and possesses the CSS form. Section 3.6 gives a procedure to obtain the encoding circuit for the six-qubit CSS entanglement-assisted code. It also lists a table detailing the error-correcting properties for the degenerate six-qubit code. 3.2 Degenerate Six-Qubit Quantum Code This section details an example of a six-qubit code that corrects an arbitrary single-qubit error. We explicitly present the stabilizer generators, encoding circuit, logical codewords, logical Pauli operators and CNOT operator for this code. We also show how to convert this code into a subsystem code where one of the qubits is a gauge qubit. We nish this section by discussing the advantages and disadvantages of this code. Calderbank et al. mention the existence of two non-equivalent six-qubit codes [13]. Their rst example is a trivial extension of the ve-qubit code. They append an ancilla qubit to the ve-qubit code to obtain this code. Their second example is a non-trivial six-qubit code. They argue that there are no other codes \up to equivalence." Our example is not reducible to the trivial six-qubit code because every one of its qubits is entangled with the others. It therefore is equivalent to the second non-trivial six-qubit code in Ref. [13] according to the arguments of Calderbank et al. Five generators specify the degenerate six-qubit code. Table 3.1 lists the generators h 1 , . . . ,h 5 in the stabilizerS, and the logical operators X andZ for the six-qubit code. Figure 3.1 illustrates an encoding circuit for the six-qubit code. 22 h 1 Y I Z X X Y h 2 Z X I I X Z h 3 I Z X X X X h 4 I I I Z I Z h 5 Z Z Z I Z I X Z I X I X I Z I Z I I Z Z Table 3.1: Stabilizer generators h 1 , . . . , h 5 , and logical operators X and Z for the six-qubit code. The convention in the above generators is that Y =ZX. The quantum error-correcting conditions guarantee that the six-qubit code corrects an arbitrary single-qubit error [38]. Specically, the error-correcting conditions are as follows: a stabilizerS with generators s i where i = 1;:::;nk (in our case n = 6 and k = 1), corrects an error setE if every error pair E y a E b 2E either anticommutes with at least one stabilizer generator 9 s i 2S : n s i ;E y a E b o = 0; (3.1) or is in the stabilizer, E y a E b 2S: (3.2) These conditions imply the ability to correct any linear combination of errors in the setE [38, 36]. At least one generator from the six-qubit stabilizer anticommutes with each of the single-qubit Pauli errors,X i ;Y i ;Z i wherei = 1;:::; 6, because the generators have at least one Z and one X operator in all six positions. Additionally, at least one generator from the stabilizer anticommutes with each pair of two distinct Pauli errors (exceptZ 4 Z 6 , which is in the stabilizerS). Table 3.4 lists such a generator for every pair of distinct Pauli errors for the six-qubit code. These arguments and the table listings prove that the code can correct an arbitrary single-qubit error. The logical basis states 23 j0i H j0i H j0i H H H j0i H H j0i j i H Figure 3.1: Encoding circuit for the rst six-qubit code. The H gate is a Hadamard gate. For example, we apply a Hadamard on qubit four followed by a CNOT with qubit four as the control qubit and qubit six as the target qubit. for the six-qubit code are as follows: j0i = j000000ij100111i +j001111ij101000i j010010i +j110101i +j011101ij111010i ; j1i = j001010i +j101101i +j000101i +j100010i j011000ij111111i +j010111i +j110000i ; where we suppress the normalization factors of the above codewords. A series of CNOT and controlled-Z operations implement the logical CNOT operation for the six-qubit code. Let CN(i;j) denote a CNOT acting on physical qubits i and j with qubit i as the control and qubit j as the target. Let CZ(i;j) denote controlled-Z operations. The logical CNOT for the six-qubit code is as follows: CNOT = CZ (2; 7) CZ (5; 7) CZ (6; 7) CN (1; 9) CN (3; 9) CN (4; 9) CN (2; 11) CN (4; 11) CN (5; 11) Figure 3.2 depicts the logical CNOT acting on two logical qubits encoded with the six- qubit code. 24 1 2 3 4 5 6 7 Z Z Z 8 9 10 11 12 Figure 3.2: Logical CNOT for the six-qubit quantum code. The rst six qubits represent a logical source qubit and the last six represent a logical target qubit. For example we begin the circuit by applying a CZ (controlled-Z) gate from source qubit two to target qubit seven. Both the six-qubit code and the ve-qubit code correct an arbitrary single-qubit error. But the six-qubit code has the advantage that it corrects a larger set of errors than the ve-qubit code. This error-correcting capability comes at the expense of a larger number of qubits|it corrects a larger set of errors because the Hilbert space for encoding is larger than that for the ve-qubit code. In comparison to the Steane code, the six-qubit code uses a smaller number of qubits, but the disadvantage is that it does not admit a simple transversal implementation of the logical CNOT. In addition, the Steane code admits a bitwise implementation of all logical single-qubit Cliord gates whereas the six-qubit code does not. 3.2.1 Subsystem Code Construction We convert the degenerate six-qubit code from the previous section into a subsystem code. The degeneracy inherent in the code allows us to perform this conversion. The 25 code still corrects an arbitrary single-qubit error after we replace one of the unencoded ancilla qubits with a gauge qubit. We brie y review the history of subsystem codes. The essential insight of Knill et al. was that the most general way to encode quantum information is into a subsystem rather than a subspace [28]. In the case when the information is encoded in a single subsystem, the Hilbert space decomposes asH = (H A H B )H C where the subsystem H A stores the protected information. Errors that act on subsystemH B , also known as the gauge subsystem, do not require active correction becauseH B does not store any valuable information. This passive error-correction ability of a subsystem code may lead to a smaller number of stabilizer measurements during the recovery process and may lead to an improvement of the accuracy threshold for quantum computation [1]. Kribs et al. recognized in Ref. [29] that this subsystem structure of a Hilbert space is useful for active quantum error-correction as well (Knill et al. did not explicitly recognize this ability in Ref. [28].) We now detail how to convert the six-qubit code from the previous section into a subsystem code. The sixth unencoded qubit is the information qubit and the encoding operation transforms it into subsystemH A . We convert the fourth unencoded ancilla qubit to a gauge qubit. We simply consider it as a noisy qubit so that the operators X 4 and Z 4 have no eect on the quantum information stored in subsystemH A . The operators X 4 and Z 4 generate the unencoded gauge group. The encoding circuit in Figure 3.1 transforms these unencoded operators into X 4 and Z 4 Z 6 respectively. These operators together generate the encoded gauge subgroup H =hX 4 ;Z 4 Z 6 i. Errors in this subgroup do not aect the encoded quantum information. The code is still able to correct an arbitrary single-qubit error because each one of the single-qubit Pauli error pairs anticommutes with at least one of the generators from the new stabilizer e S =hh 1 ;h 2 ;h 3 ;h 5 i, or belong toH [39]. Table 3.4 shows this property for all error pairs. The code passively corrects the error pairs X 4 , Z 4 Z 6 , Y 4 Z 6 because they belong to the gauge subgroup. 26 h 1 Y I Z X X Y h 2 Z X I I X Z h 3 I Z X X X X h 5 Z Z Z I Z I H X I I I X I I H Z I I I Z I Z X Z I X I X I Z I Z I I Z Z Table 3.2: Stabilizer generators h 1 ;h 2 ;h 3 and h 5 , gauge subgroup generators H X and H Z , and logical operators X and Z for the six-qubit code. The convention in the above generators is that Y =ZX. The six-qubit single-error-correcting subsystem code discussed above saturates the Singleton bound for subsystem codes [27], nkr 2(d 1); (3.3) where for our code,n = 6,k = 1,r = 1, andd = 3. This code is the smallest non-trivial subsystem code that corrects an arbitrary single-qubit error 1 . One of the advantages of using the subsystem construction is that we only need to perform four stabilizer measurements instead of ve during the recovery process. 3.3 Non-existence of a [[6;1;3]] CSS Code Our proposition below proves that it is impossible for a six-qubit code to possess the CSS structure while correcting an arbitrary single-qubit error. An immediate corollary of this proposition is that the seven-qubit code is the smallest single-error-correcting CSS code. Proposition3.3.1. There is no six-qubit code that encodes one qubit, possesses the CSS structure, and corrects an arbitrary single-qubit error. 1 A trivial way to saturate this bound is to add a noisy qubit to the ve-qubit code! 27 Proof. We rst suppose that a code with the above properties exists. If a [[6; 1; 3]] CSS code exists, its stabilizerS must have ve generators: S =hg 1 ;:::;g 5 i: (3.4) The CSS structure implies that each of these generators includes X operators only orZ operators only (except for the identity). The set of correctable Pauli errorsfE j g in the Pauli group acting on six qubits satisesfE i E j ;Sg = 0 unlessE i E j 2S, for alli;j. We show below that no set of ve CSS stabilizer generators acting on six qubits can correct an arbitrary single-qubit error and possess the CSS structure. First assume that such generators exist. It is not possible that all generators consist of the same type of operators (allX or allZ) because single-qubit errors of the same type (X or Z) are then not correctable. Consider the possibility that there is one generator of one type, sayX, and four generators of the other type, sayZ. If the generator of type X has an identity acting on any qubit, say the rst one, then the error Z 1 commutes with all generators. This error is not correctable unless it belongs to the stabilizer. But if it belongs to the stabilizer, the rst qubit of the code must be xed in the statej0i, which makes for a trivial code. The other possibility is that the X-type generator has the formg 1 =XXXXXX. But then any combination of twoZ-errors (Z i Z j ) commutes with it, and so they have to belong to the stabilizer. But there are ve independent such combinations of errors (Z 1 Z 2 , Z 1 Z 3 , Z 1 Z 4 , Z 1 Z 5 , Z 1 Z 6 ) and only four generators of the Z type. Therefore, it is impossible for the code to have four generators of one type and one generator of the other type. The only possibility left is that there are two generators of one type, sayX, and three generators of the other type, say Z. The two X-type generators should not both have identity acting on any given qubit because a Z error on that qubit commutes with all generators. Such an error cannot belong to the stabilizer because it would again make 28 for a trivial code. Specically, we write the twoX-type generators (g 1 andg 2 ) one above the other g 1 g 2 = ; (3.5) where we leave the entries unspecied in the above equation, but they are either X or I. Both generators cannot have the column I I in (3.5) because both generators cannot have identities acting on the same qubit. Thus, only three dierent columns can build up the generators in (3.5): I X ; X I ; X X We distinguish the following cases: (i). Each column appears twice. (ii). One column appears three times, another column appears twice, and the third column appears once. (iii). One column appears three times and another column appears three times. (iv). At least one column appears more than three times. If one and the same column appears on two dierent places, say qubit one and qubit two as in the following example, g 1 g 2 = X X I I ; (3.6) 29 then a pair ofZ errors on these qubits (Z 1 Z 2 ) commutes with all generators, and therefore belongs to the stabilizer. In the rst case considered above, there are three such pairs of errors, which up to a relabeling of the qubits can be taken to be Z 1 Z 2 , Z 3 Z 4 , Z 5 Z 6 . They can be used as stabilizer generators because these operators are independent. But then the following pairs of single-qubit X errors commute with all generators: X 1 X 2 , X 3 X 4 , X 5 X 6 . This possibility is ruled out because the latter cannot be part of the stabilizer generators. In the second case, up to a relabeling of the qubits, we have the following pairs of Z errors that commute with the stabilizer: Z 1 Z 2 ,Z 1 Z 3 ,Z 2 Z 3 ,Z 4 Z 5 . Only three of all four are independent, and they can be taken to be stabilizer generators. But then all three generators ofZ-type have the identity acting on the sixth qubit, and therefore the error X 6 is not correctable (and it cannot be a stabilizer generator because it would make for a trivial code). In the third case, the pairsZ 1 Z 2 ,Z 1 Z 3 ,Z 2 Z 3 ,Z 4 Z 5 ,Z 4 Z 6 ,Z 5 Z 6 (up to a relabeling), four of which are independent, commute with the stabilizer. But they cannot all belong to the stabilizer because there are only three possible generators of the Z-type. Finally, in the fourth case, we have three or more independent pairs of Z errors commuting with the stabilizer (for example Z 1 Z 2 , Z 1 Z 3 , Z 1 Z 4 , which corresponds to the rst four columns being identical). If the independent pairs are more than three, then their number is more than the possible number of generators. If they are exactly three, we can take them as generators. But then Z-type generators act trivially upon two qubits, and therefore X errors on these qubits are not correctable. This last step completes the proof. 30 3.4 Non-degenerate Six-Qubit CSS Entanglement- Assisted Quantum Code We detail the construction of a six-qubit CSS entanglement-assisted quantum code in this section. We rst review the history of entanglement-assisted quantum coding and discuss the operation of an entanglement-assisted code. We then describe our construction. It turns out that the code we obtain is equivalent to the Steane code [50] when including Bob's qubit, and therefore is not a new code. It suggests, however, a general rule for which we present a proof|every [[n; 1; 3]] code is equivalent to a [[n 1; 1; 3; 1]] entanglement-assisted code with any qubit serving as Bob's half of the ebit. Even though our code is a trivial example of this rule, it is instructive to present its derivation from the perspective of the theory of entanglement-assisted codes. Bowen constructed an example of a quantum error-correcting code that exploits shared entanglement between sender and receiver [9]. Brun, Devetak, and Hsieh later generalized Bowen's example and developed the entanglement-assisted stabilizer formal- ism [10, 11]. This theory is an extension of the standard stabilizer formalism and uses shared entanglement to formulate stabilizer codes. Several references provide a review [10, 11, 26] and generalizations of the theory to entanglement-assisted operator codes [12, 26], convolutional entanglement distillation protocols [56], continuous-variable codes [57], and entanglement-assisted quantum convolutional codes [55]. Gilbert et al. also generalized their \quantum computer condition" for fault tolerance to the entanglement- assisted case [21]. Entanglement-assisted codes are a special case of \correlation-assisted codes", where Bob's qubit is also allowed to be noisy. Such codes are in turn instances of general linear quantum error-correcting codes [42]. An entanglement-assisted quantum error-correcting code operates as follows. A sender and receiver share c ebits before communication takes place. The sender pos- sesses her half of the c ebits, nkc ancilla qubits, and k information qubits. She 31 performs an encoding unitary on hern qubits and sends them over a noisy quantum com- munication channel. The receiver combines his half of the c ebits with the n encoded qubits and performs measurements on all of the qubits to diagnose the errors from the noisy channel. The generators corresponding to the measurements on all of the qubits form a commuting set. The generators thus form a valid stabilizer, they do not disturb the encoded quantum information, and they learn only about the errors from the noisy channel. The notation for such a code is [[n;k;d;c]], whered is the distance of the code. The typical assumption for an entanglement-assisted quantum code is that noise does not aect Bob's half of the ebits because they reside on the other side of a noisy quantum communication channel between Alice and Bob. Our [[6; 1; 3; 1]] entanglement- assisted code is globally equivalent to the [[7; 1; 3]] Steane code and thus corrects errors on Bob's side as well. From a computational perspective, a code that corrects errors on all qubits is more powerful than a code that does not. From the perspective of the entanglement-assisted paradigm, however, this feature is unnecessary and may result in decreased error-correcting capabilities of the code with respect to errors on Alice's side. We construct our code using the parity check matrix of a classical code. Consider the parity check matrix for the [7; 4; 3] Hamming code: 2 6 6 6 6 4 1 0 0 1 0 1 1 0 1 0 1 1 0 1 0 0 1 0 1 1 1 3 7 7 7 7 5 (3.7) The Hamming code encodes four classical bits and corrects a single-bit error. We remove one column of the above parity check matrix to form a new parity check matrix H as follows: H = 2 6 6 6 6 4 1 0 0 1 0 1 0 1 0 1 1 0 0 0 1 0 1 1 3 7 7 7 7 5 : (3.8) 32 The code corresponding to H encodes three bits and still corrects a single-bit error. We begin constructing the stabilizer for an entanglement-assisted quantum code by using the CSS construction [12, 26]: 2 4 H 0 0 H 3 5 : (3.9) The left side of the above matrix is the \Z" side and the right side of the above matrix is the \X" side. The isomorphism between n-fold tensor products of Pauli matrices and n-dimensional binary vectors gives a correspondence between the matrix in (3.9) and the set of Pauli generators below [22, 38, 10]: Z I I Z I Z I Z I Z Z I I I Z I Z Z X I I X I X I X I X X I I I X I X X (3.10) The above set of generators have good quantum error-correcting properties because they correct an arbitrary single-qubit error. These properties follow directly from the proper- ties of the classical code. The problem with the above generators is that they do not form a commuting set and thus do not correspond to a valid quantum code. We use entan- glement to resolve this problem by employing the method outlined in Ref. [10, 11, 26]. Three dierent but related methods determine the minimum number of ebits that the entanglement-assisted quantum code requires: (i). Multiplication of the above generators with one another according to the \sym- plectic Gram-Schmidt orthogonalization algorithm" forms a new set of generators 33 Bob Alice g 0 1 I I Z I I I I g 0 2 I I I Z I I I g 0 3 Z Z I I I I I g 0 4 I I I I Z I I g 0 5 I I I I I Z I g 0 6 X X I I I I I X 0 I I I I I I X Z 0 I I I I I I Z Bob Alice g 1 I Z I Z Z Z I g 2 I Z Z I I Z Z g 3 Z Z I I Z I Z g 4 I X X I I X X g 5 I I X X X I X g 6 X X I I X I X X I I I I X X X Z I I Z Z I Z I (a) (b) Table 3.3: (a) The generators and logical operators for the unencoded state. Generators g 0 3 and g 0 6 indicate that Alice and Bob share an ebit. Alice's half of the ebit is her rst qubit and Bob's qubit is the other half of the ebit. Generatorsg 0 1 ,g 0 2 ,g 0 4 , andg 0 5 indicate that Alice's second, third, fourth, and fth respective qubits are ancilla qubits in the statej0i. The unencoded logical operators X 0 and Z 0 act on the sixth qubit and indicate that the sixth qubit is the information qubit. (b) The encoded generators and logical operators for the [[6; 1; 3; 1]] entanglement-assisted quantum error-correcting code. [10, 11]. The error-correcting properties of the code are invariant under these mul- tiplications because the code is an additive code. The resulting code has equivalent error-correcting properties and uses the minimum number of ebits. We employ this technique in this work. (ii). A slightly dierent algorithm in the appendix of Ref. [56] determines the minimum number of ebits required, the stabilizer measurements to perform, and the local encoding unitary that Alice performs to rotate the unencoded state to the encoded state. This algorithm is the most useful because it \kills three birds with one stone." (iii). The minimum number of ebits for a CSS entanglement-assisted code is equal to the rank of HH T [12, 26]. This simple formula is useful if we are only concerned with computing the minimum number of ebits. It does not determine the stabilizer generators or the encoding circuit. Our code requires one ebit to form a valid stabilizer code because the rank of HH T for our code is equal to one. 34 Table 3.3(b) gives the nal form of the stabilizer for our entanglement-assisted six- qubit code. We list both the unencoded and the encoded generators for this code in Table 3.3. Our code uses one ebit shared between sender and receiver in the encoding process. The sender performs a local encoding unitary that encodes one qubit with the help of four ancilla qubits and one ebit. The symplectic Gram-Schmidt algorithm yields a symplectic matrix that rotates the unencoded symplectic vectors to the encoded symplectic vectors. The symplectic matrix corresponds to an encoding unitary acting on the unencoded quantum state [10, 11]. This correspondence results from the Stone-von Neumann Theorem and unies the Schr odinger and Heisenberg pictures for quantum error correction [17]. The symplectic Gram-Schmidt algorithm also determines the logical operators for the code. Some of the vectors in the symplectic matrix that do not correspond to a stabilizer generator are equivalent to the logical operators for the code. It is straightforward to determine which symplectic vector corresponds to which logical operator (X or Z) by observing the action of the symplectic matrix on vectors that correspond to the unencoded X or Z logical operators. 35 For our code, the symplectic matrix is as follows: 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 1 0 1 1 0 1 1 1 0 1 1 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 1 1 0 1 1 1 0 1 0 0 0 0 0 0 1 0 0 1 0 1 0 0 1 1 1 1 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.11) The index of the rows of the above matrix corresponds to the operators in the unencoded stabilizer in Table 3.3(a). Therefore, the rst ve rows correspond to the encoded Z operators in the stabilizer and the sixth row corresponds to the logical Z operator. As an example, we can represent the unencoded logical Z operator in Table 3.3(a) as the following binary vector: h 0 0 0 0 0 1 0 0 0 0 0 0 i : (3.12) Premultiplying the above matrix by the above row vector gives the binary form for the encoded logicalZ operator. We can then translate this binary vector to a six-fold tensor product of Paulis equivalent to the logical Z operator in Table 3.3(b). Using this same idea, the rst row of the above matrix corresponds to Alice's Paulis in g 3 , the second row to g 1 , the third row to g 2 , the fourth row to g 4 , the fth row to g 5 , and the seventh 36 8 < : j + i BA H H j0i A H H j0i A H H j0i A H H H H H j0i A H H H j i A H H H Figure 3.3: Encoding circuit for the [[6,1,3;1]] code. The \H" gate is a Hadamard gate. row tog 6 . The last six rows in the above matrix correspond to encodedX operators and it is only the last row that is interesting because it acts as a logical X operator. Figure 3.3 gives the encoding circuit for the code. We now detail the operations that give the equivalence of this code to the seven-qubit Steane code. Consider the generators in Table 3.3(b). Label the columns from left to right as 1, 2, . . . , 7 where \1" corresponds to Bob's column. Replace the generator g 1 by g 1 g 2 g 3 , and the generator g 5 by g 5 g 6 . Switch the new generators g 4 and g 5 . Switch columns 2 and 3. Switch columns 1 and 5. Cyclically permute the columns once so that 1 becomes 7, 2 becomes 1, 3 becomes 2, ..., 7 becomes 6. The resulting code is exactly the Steane code if one reads it from right to left (i.e., up to the permutation 1$ 7, 2$ 6, 3$ 5). Inspection of the encoded logical operators in Table 3.3(b) reveals that Alice can perform logical X and Z operations locally. Since the CNOT has a transversal imple- mentation for the Steane code, if Alice and Bob possess two logical qubits each encoded with this entanglement-assisted code, they can apply an encoded CNOT transversally by the use of classical communication to coordinate their actions. We point out, how- ever, that the idea of computation in the entanglement-assisted paradigm is not well motivated, since if classical communication is allowed, Alice could send the initial state 37 to Bob and inform him of the operations that need to be applied. An interesting open question is if there exist codes that allow fault-tolerant computation on Alice's side only. From this example, we observe that some subset of the entanglement-assisted codes correct errors on Bob's side. This phenomenon can be understood as an instance of the more general correlation-assisted codes and linear quantum error-correction theory detailed in Ref. [42]. It may be useful from a practical standpoint to determine which entanglement-assisted codes satisfy this property. Here we provide an answer for the case of single-error-correcting codes that use one bit of entanglement. Proposition 3.4.1. Every [[n; 1; 3]] code is equivalent to a [[n 1; 1; 3; 1]] code with any qubit serving as Bob's half of the ebit. Proof. We prove this proposition by showing that any column in the table of stabilizer generators for such a code can be reduced to the standard form of Bob's column in an entanglement-assisted code (containing exactly one X and one Z operator). Without loss of generality, consider the column corresponding to the rst qubit. This column generally may containX,Y ,Z, orI operators, but if the code corrects any error on the rst qubit, there must be at least two dierent Pauli operators in this column. We can reduce this column to the desired form as follows. Choose one of the generators that contains X on the rst qubit, and replace each of the other generators that contain an X there by its product with the chosen generator. Do the same for Y and Z. Thus we are left with at most one generator withX, one withY and one withZ. To eliminateY , we replace it by its product with the X and Z generators. If either X or Z is missing, we replace the Y generator with its product with the other non-trivial generator. This result can be understood as a re ection of the fact that in a code that corrects arbitrary single-qubit errors, every qubit is maximally entangled with the rest and there- fore can be thought of as part of an ebit. The latter can also be seen to follow from the property that every single-qubit error must send the code space to an orthogonal subspace. 38 Note that for the case of [[n; 1; 3;c]] codes with c > 1, the relation could be more complicated. If such a code corrects an arbitrary single-qubit error, it is equivalent to an [[n +c; 1; 3]] code, but it is not obvious whether a [[n +c; 1; 3]] code can be interpreted as a [[n; 1; 3;c]] code because the type of entanglement that exists between c qubits and the rest n qubits may not be the same as that of c e-bits. 3.5 Non-existence of [[n;1;3;1]] CSS codes for n5 We now show that there does not exist a smaller entanglement-assisted CSS code that uses only one ebit and corrects an arbitrary single-qubit error on Alice's side. The proof is similar to that for the non-existence of a [[6; 1; 3]] CSS code. Proposition 3.5.1. There does not exist an [[n; 1; 3; 1]] entanglement-assisted CSS code for n 5. Proof. We being this proof by giving a dimensionality argument for the non-existence of quantum codes (CSS or non-CSS) withn< 4. This can be easily seen as follows. Assume that the code is non-degenerate. There are 3n dierent single-qubit errors on Alice's side, which means that there must exist 3n + 1 orthogonal subspaces of dimension 2 inside the entire 2 n+1 -dimensional Hilbert space, i.e., (3n + 1)2 2 n+1 . This is impossible for n< 4. Since for n 3 the number of generators is at most 3, and two of the generators have to act non-trivially on Bob's side, we can have degeneracy with respect to errors on Alice's side only forn = 3 with exactly one of the generators being equal to a pair of errors on Alice's side. These two errors would be the only indistinguishable single-qubit errors on Alice's side (no other pair of errors on Alice's side can belong to the stabilizer), which reduces the number of required orthogonal subspaces from 3 3 + 1 = 10 to 9. The required dimensions are 2 9 = 18 and they cannot t in the 2 4 = 16-dimensional Hilbert space. 39 Suppose that there exists a [[5; 1; 3; 1]] CSS code. Its stabilizer must have 5 generators (S =hg 1 ;:::;g 5 i), each consisting of only X and I operators or Z and I operators. For an entanglement-assisted code, the generators must be of the form g 1 = X g 2 = Z g 3 = I g 4 = I g 5 = I (3.13) where we have left the entries on Alice's side unspecied. The set of correctable Pauli errors on Alice's sidefE j 2P 5 g (whereP 5 is the ve-qubit Pauli group) must satisfy fE i E j ;Sg = 0 unless E i E j 2S, for all i;j = 1; 2; 3; 4; 5. All generators cannot be of the same type (X orZ). The possibility that there is one generator of one type, say X, and four generators of the other (Z) type, is also ruled out because the X-type generator would have to be of the form g 1 =XXXXXjX in order that every qubit is acted upon non-trivially by at least one X operator from the stabilizer. This would mean, however, that any combination of two Z-errors (Z i Z j , i;j = 1; 2; 3; 4; 5) would commute with the stabilizer, and so it would have to belong to the stabilizer. There are four independent such combinations of errors (Z 1 Z 2 ,Z 1 Z 3 ,Z 1 Z 4 ,Z 1 Z 5 ) which would have to be the other four generators. But then there would be no possibility for a Z operator on Bob's side (as in g 2 ). Therefore, this is impossible. The only possibility is that there are 2 generators of one type, sayX, and 3 generators of the other type (Z). The two X-type generators should not both have identity acting on any given qubit on Alice's side because a Z error on that qubit would commute with all generators. Consider the following form for the two X-type generators: g 1 = X g 3 = I (3.14) 40 There are three dierent columns that can ll the unspecied entries in the above table: I X ; X I ; X X : We distinguish the following cases: two columns appear twice and one column appears once, one column appears three times and another column appears twice, one column appears three times and each of the other columns appears once, at least one column appears more than three times. In the rst case, up to relabeling of the qubits, we distinguish the following possibil- ities: g 0 1 = I I X X X X g 0 3 = X X I I X I (3.15) g 00 1 = X X I I X X g 00 3 = X X X X I I (3.16) g 000 1 = X X X X I X g 000 3 = X X I I X I (3.17) For each possibility, the pairs of errors Z 1 Z 2 andZ 3 Z 4 commute with the stabilizer and therefore they would have to be equal to the stabilizer generators g 4 and g 5 . But the pairs of errorsX 1 X 2 andX 3 X 4 would commute withg 1 ,g 3 ,g 4 andg 5 . Since these errors do not belong to the stabilizer, they would have to anti-commute with g 3 . Therefore, up to interchanging the rst and second, or the third and fourth qubits, the generator g 2 must have the form g 3 = Z I Z I Z Z : (3.18) (Note that the fth entry must be Z because there must be at least one generator that has a Z acting on that qubit.) But it can be veried that for each of the possibilities 41 (3.15), (3.16) and (3.17),g 3 anti-commutes with one of theX-type generators. Therefore, the rst case is impossible. In the second case, one of the possible columns appears three times and another column appears twice, e.g., g 1 = X X X X X X g 3 = X X X I I I (3.19) In such a case we would have three independent pairs ofZ errors (Z 1 Z 2 ,Z 1 Z 3 andZ 4 Z 5 ) which commute with the stabilizer and therefore have to belong to it. But then there would be no possibility for aZ operator on Bob's side (the generatorg 2 ). Therefore this case is impossible. In the third case, one column appears three times and each other column appears once, as in g 1 = X X X X I X g 3 = X X X I X I (3.20) In this case, the pairs of errorsZ 1 Z 2 andZ 1 Z 3 commute with the stabilizer and must be equal to g 4 and g 5 . But in order for the fourth and fth qubits to be each acted upon by at least one Z operator from the stabilizer, the generator g 2 would have to be of the form g 2 = Z Z Z (3.21) This means that the pair of errors X 4 X 5 commutes with the stabilizer, and since it is not part of the stabilizer, this case is also impossible. Finally, if one column appears more than three times, there would be at least three independent pairs of Z errors on Alice's side which have to belong to the stabilizer. This leaves no possibility for a Z operator on Bob's side, i.e., this case is also ruled out. Therefore, a [[5; 1; 3; 1]] CSS code does not exist. 42 In a similar way we can show that a [[4; 1; 3; 1]] CSS code does not exist. Such a code would have 4 generators of the form g 1 = X g 2 = Z g 3 = I g 4 = I (3.22) The possibilities that all of the generators are of the same type, or that one generator is of one type and the other three are of the other type, are readily ruled out by arguments similar to those for the [[5; 1; 3; 1]] code. The only possibility is two X-type generators and two Z-type generators. The table of the X-type generators g 1 = X g 3 = I (3.23) has to be lled by the same three columns we discussed before. As we saw in our previous arguments, in the case when one column appears three or more times there are at least two independent pairs of errors on Alice's side which commute with the stabilizer. These errors would have to belong to the stabilizer, but this leaves no possibility for aZ operator on Bob's side. In the case when one column appears twice and another column appears twice, the situation is analogous. The only other case is when one column appears twice and each of the other two columns appears once, as in g 1 = X X I X X g 3 = X X X I I (3.24) Since in this case the pair of errors Z 1 Z 2 would commute with the stabilizer, this pair would have to be equal to the generatorg 4 . The third and fourth qubits each have to be 43 acted upon by at least oneZ operators from the stabilizer. Thus the generatorg 2 would have to have the form g 2 = Z Z Z : (3.25) But then the pairX 3 X 4 which does not belong to the stabilizer would commute with all stabilizer generators. Therefore a [[4; 1; 3; 1]] CSS code does not exist. We point out that a [[4; 1; 3; 1]] non-CSS code was found in Ref. [11]. This is the smallest possible code that can encode one qubit with the use of only one ebit, and at the same time correct an arbitrary single-qubit error on Alice's side. Here we have identied an example of the smallest possible CSS code with these characteristics. 3.6 Entanglement-Assisted Encoding Circuit Here we detail an algorithm that generates the encoding circuit for the [[6; 1; 3; 1]] code. We follow the recipe outlined in the appendix of Ref. [56]. We begin by rst converting the stabilizer generators in Table 3.3(b) into a binary form which we refer to as a ZjX matrix. We obtain the the left Z submatrix by inserting a \1" wherever we see a Z in the stabilizer generators. We obtain the X submatrix by inserting a \1" wherever we see a corresponding X in the stabilizer generator. If there is a Y in the generator, we insert a \1" in the corresponding row and column of both the Z and X submatrices. The idea is to convert matrix 3.26 to matrix 3.42 through a series of row and column operations. The binary form of the matrix in 3.26 corresponds to the stabilizer generators in Table 3.3(a). We can use CNOT, Hadamard, Phase, and SWAP gates. (i). When we apply a CNOT gate from qubit i to qubit j, it adds column i to column j in the X submatrix, and in the Z submatrix it adds column j to column i. (ii). A Hadamard on qubit i swaps column i in the Z submatrix with column i in the X submatrix. 44 (iii). A Phase gate on qubit i adds column i in the X submatrix to column i in the Z submatrix. (iv). When we apply a SWAP gate from qubit i to qubit j, we exchange column i with column j in Z submatrix and column i and column j in the X submatrix. Row operations do not change the error-correcting properties of the code. They do not cost us in terms of gates. They are also crucial in determining the minimum number of ebits for the code. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 1 0 1 1 0 1 1 1 0 1 1 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 1 1 1 0 1 1 1 0 1 0 0 1 0 1 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.26) We begin the algorithm by computing the symplectic product [10] between the various rows of the matrix. The rst row is symplectically orthogonal to the second row. More- over, it is symplectically orthogonal to all the rows except row six. So we swap the second row with the sixth row. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 1 0 1 0 0 0 0 0 0 1 1 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 1 1 0 0 0 0 0 0 0 1 0 0 1 0 1 0 0 0 0 0 0 1 1 0 0 1 1 1 0 1 1 1 0 0 0 0 0 0 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.27) 45 Now apply Hadamard gates to qubits, one, four and six. This operation swaps the columns one, four and six on the Z side with columns one, four and six on the X side. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 0 0 0 0 0 0 1 0 0 1 0 1 0 1 0 0 1 0 1 0 0 0 0 1 1 0 0 1 0 0 0 0 1 0 1 0 1 0 0 1 0 1 0 0 0 0 0 0 1 0 0 0 0 1 0 1 0 0 1 0 0 0 1 0 1 0 1 0 0 1 0 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.28) Apply a CNOT from qubit one to qubit four and a CNOT from qubit one to qubit six. This operation adds column one to four and column one to column six on the X side. On theZ side of the matrix, the CNOT operation adds column four to column one and column six to column one. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 0 0 0 0 0 0 1 0 0 1 0 1 0 1 0 0 1 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 1 0 0 1 0 0 0 1 0 1 0 1 0 0 0 0 1 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.29) Now apply a Hadamard gate on qubit one. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 1 0 1 0 1 0 0 1 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 1 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 1 0 0 0 1 0 1 0 0 0 0 0 0 1 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.30) 46 Apply a Hadamard gate on qubit four and qubit six. This operation swaps columns four and six on Z side with respective columns on the X side. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 1 0 0 0 0 0 0 1 0 0 1 0 1 0 0 0 0 0 0 0 1 0 0 1 1 0 0 1 1 1 0 0 0 0 0 0 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.31) Finally, we apply a CNOT gate from qubit one to qubit four and another CNOT gate from qubit one to qubit six. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 1 0 0 1 1 1 0 0 0 0 0 0 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.32) At this point we are done processing qubit one and qubit two. We now proceed to manipulate columns two through six on the Z and X side. We apply a Hadamard gate on qubit two, four and ve. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 1 1 0 0 0 1 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 1 1 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 1 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.33) 47 Perform a CNOT gate from qubit two to qubit four and from qubit two to qubit ve. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 1 0 0 0 1 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 1 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.34) Perform a Hadamard on qubit two. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 1 1 0 0 0 1 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 1 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.35) We have processed qubit three. Now look at the submatrix from columns three to six on the Z and X side. Perform a SWAP gate between qubit three and qubit ve. This operation swaps column three with ve in the Z submatrix and column three and ve in the X submatrix. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 1 1 0 0 0 1 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 1 0 0 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.36) 48 Perform a Hadamard gate on qubit three, followed by a CNOT gate from qubit three to qubit six, and another Hadamard on qubit three. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 1 1 0 0 0 0 0 0 1 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.37) Add row four to ve. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 1 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.38) We have completed processing qubit four. Now focus on columns four to six. Apply a Hadamard gate on qubit four, followed by CNOT gate from qubit four to qubit ve, and again from qubit four to qubit six. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.39) 49 Perform a Hadamard gate on qubit four. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 1 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.40) Now look at columns ve and six. Apply a Hadamard gate on qubit ve and qubit six, followed by a CNOT gate from qubit ve to qubit six. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.41) Perform a Hadamard on qubit ve. 2 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3 7 7 7 7 7 7 7 7 7 7 7 7 7 7 5 (3.42) We have nally obtained a binary matrix that corresponds to the canonical stabilizer generators in Table 3.3(a). Figure 3.3 gives the encoding circuit for the all the quantum 50 Error AG Error AG Error AG Error AG Error AG Error AG X 1 X 2 h 1 X 1 X 3 h 2 X 1 X 4 h 1 X 1 X 5 h 1 X 1 X 6 h 5 X 1 Y 2 h 1 X 1 Y 3 h 2 X 1 Y 4 h 2 X 1 Y 5 h 3 X 1 Y 6 h 1 X 1 Z 2 h 1 X 1 Z 3 h 1 X 1 Z 4 h 2 X 1 Z 5 h 3 X 1 Z 6 h 2 X 2 X 3 h 1 X 2 X 4 h 3 X 2 X 5 h 3 X 2 X 6 h 1 X 2 Y 3 h 1 X 2 Y 4 h 1 X 2 Y 5 h 1 X 2 Y 6 h 2 X 2 Z 3 h 5 X 2 Z 4 h 1 X 2 Z 5 h 1 X 2 Z 6 h 1 X 3 X 4 h 1 X 3 X 5 h 1 X 3 X 6 h 2 X 3 Y 4 h 3 X 3 Y 5 h 2 X 3 Y 6 h 1 X 3 Z 4 h 3 X 3 Z 5 h 2 X 3 Z 6 h 3 X 4 X 5 h 5 X 4 X 6 h 1 X 4 Y 5 h 1 X 4 Y 6 h 2 X 4 Z 5 h 1 X 4 Z 6 h 1 X 5 X 6 h 1 X 5 Y 6 h 2 X 5 Z 6 h 1 Y 1 X 2 h 2 Y 1 X 3 h 1 Y 1 X 4 h 2 Y 1 X 5 h 2 Y 1 X 6 h 1 Y 1 Y 2 h 3 Y 1 Y 3 h 1 Y 1 Y 4 h 1 Y 1 Y 5 h 1 Y 1 Y 6 h 3 Y 1 Z 2 h 5 Y 1 Z 3 h 2 Y 1 Z 4 h 1 Y 1 Z 5 h 1 Y 1 Z 6 h 1 Y 2 X 3 h 1 y 2 X 4 h 2 Y 2 X 5 h 2 Y 2 X 6 h 1 Y 2 Y 3 h 1 Y 2 Y 4 h 1 Y 2 Y 5 h 1 Y 2 Y 6 h 5 Y 2 Z 3 h 5 Y 2 Z 4 h 1 Y 2 Z 5 h 1 Y 2 Z 6 h 1 Y 3 X 4 h 1 Y 3 X 5 h 1 Y 3 X 6 h 2 Y 3 Y 4 h 5 Y 3 Y 5 h 2 Y 3 Y 6 h 1 Y 3 Z 4 h 5 Y 3 Z 5 h 2 Y 3 Z 6 h 5 Y 4 X 5 h 1 Y 4 X 6 h 2 Y 4 Y 5 h 2 Y 4 Y 6 h 1 Y 4 Z 5 h 2 Y 4 Z 6 h 4 Y 5 X 6 h 3 Y 5 Y 6 h 1 Y 5 Z 6 h 2 Z 1 X 2 h 1 Z 1 X 3 h 5 Z 1 X 4 h 1 Z 1 X 5 h 1 Z 1 X 6 h 2 Z 1 Y 2 h 1 Z 1 Y 3 h 3 Z 1 Y 4 h 3 Z 1 Y 5 h 2 Z 1 Y 6 h 1 Z 1 Z 2 h 1 Z 1 Z 3 h 1 Z 1 Z 4 h 3 Z 1 Z 5 h 2 Z 1 Z 6 h 3 Z 2 X 3 h 1 Z 2 X 4 h 2 Z 2 X 5 h 2 Z 2 X 6 h 1 Z 2 Y 3 h 1 Z 2 Y 4 h 1 Z 2 Y 5 h 1 Z 2 Y 6 h 3 Z 2 Z 3 h 2 Z 2 Z 4 h 1 Z 2 Z 5 h 1 Z 2 Z 6 h 1 Z 3 X 4 h 3 Z 3 X 5 h 3 Z 3 X 6 h 1 Z 3 Y 4 h 1 Z 3 Y 5 h 1 Z 3 Y 6 h 2 Z 3 Z 4 h 1 Z 3 Z 5 h 1 Z 3 Z 6 h 1 Z 4 X 5 h 1 Z 4 X 6 h 2 Z 4 Y 5 h 2 Z 4 Y 6 h 1 Z 4 Z 5 h 2 Z 4 Z 6 h 4 Z 5 X 6 h 3 Z 5 Y 6 h 1 Z 5 Z 6 h 2 X 1 h 1 X 2 h 3 X 3 h 1 X 4 h 4 X 5 h 5 X 6 h 1 Y 1 h 2 Y 2 h 2 Y 3 h 3 Y 4 h 3 Y 5 h 3 Y 6 h 3 Z 1 h 1 Z 2 h 2 Z 3 h 3 Z 4 h 3 Z 5 h 3 Z 6 h 1 Table 3.4: Distinct pairs of single-qubit Pauli errors for the [[6; 1; 3]] quantum code. Each double-lined column lists a pair of single-qubit errors and a corresponding anticommuting generator (AG) for the code. X 4 and Z 4 Z 6 lie in the gauge subgroup H. operations that we performed above. Multiplying the above operations in reverse takes us from the unencoded canonical stabilizers to the encoded ones. 3.7 Concluding Remarks We have discussed two dierent examples of a six-qubit code and have included a subsys- tem construction for the degenerate six-qubit code. Our proof explains why a six-qubit 51 CSS code does not exist and claries earlier results in Ref. [13] based on a search algo- rithm. An immediate corollary of our result is that the seven-qubit Steane code is the smallest CSS code capable of correcting an arbitrary single-qubit error. An interesting open problem is to generalize this tight lower bound to the setting of CSS codes with a higher distance. We expect that our proof technique may be useful for this purpose. Our rst example is a degenerate six-qubit code that corrects an arbitrary single- qubit error. The presentation of the encoding circuit and the operations required for a logical X, Z, and CNOT should aid in the implementation and operation of this code. We have converted this code into a subsystem code that is non-trivial and saturates the subsystem Singleton bound. Our six-qubit subsystem code requires only four stabilizer measurements during the recovery process. This reduction in measurements may have implications for improving fault-tolerance thresholds. Our second example is an entanglement-assisted [[6; 1; 3; 1]] CSS code that is globally equivalent to the Steane seven-qubit code. We have presented the construction of this code from a set of six non-commuting generators on six qubits. We have further shown that every [[n; 1; 3]] code can be used as a [[n 1; 1; 3; 1]] entanglement-assisted code. Based on the proof technique that we used for the earlier six-qubit code, we have shown that the Steane code is an example of the smallest entanglement-assisted code that possesses the CSS structure and uses exactly one ebit. Here too, an interesting open problem is the generalization of this tight lower bound to higher distance entanglement- assisted codes or to codes that use more than one ebit. From the next chapter we begin the theory of quantum steganography. It was impor- tant for us to introduce the reader to stabilizer codes as we use them extensively in quantum steganography to hide quantum information. 52 Chapter 4 Classical Steganography What is that confers the noblest delight? What is that which swells a man's breast with pride above that which any other experience can bring to him? Discovery! To know that you are walking where none others have walked; that you are beholding what human eye has not seen before; that you are breathing a virgin atmosphere. To give birth to an idea { to discover a great thought { an intellectual nugget, right under the dust of a eld that many a brain { plow had gone over before. To nd a new planet, to invent a new hinge, to nd the way to make the lightnings carry your messages. To be the rst { that is the idea. To do something, say something, see something, before any body else { these are the things that confer a pleasure compared with which other pleasures are tame and commonplace, other ecstasies cheap and trivial. |Mark Twain 4.1 Introduction We begin the second half of the thesis with a classical model of steganography which we later extend to a quantum one in Chapter 5. Steganography is the science of hid- ing a message within a larger innocent-looking plain-text message, and communicat- ing the resulting data over a communications channel or through a courier so that the steganographic message is readable only by the intended receiver. The word comes from the Greek words steganos which means \covered," and graphia which means \writing." 53 The art of information hiding dates back to 440 B.C. to the Greeks. In The Histo- ries, Herodotus records two incidents of the use of steganography. In the rst incident Demaratus a Greek king uses a wax tablet to warn the Spartans of an impending attack by the Persian king Xerxes [25]. Wax tablets were used as reusable surfaces to write on, which were constructed on wooden bases. Demaratus scratched the steganographic message on the wood, and then covered it with beeswax. Once the Spartans received the wax tablet from the courier, all that they needed to do was to melt the beeswax and read the hidden warning. In another story Herodotus records how Histiaeus tattoos a secret message on the shaved scalp of his slave, and then waits for the hair to grow back before dispatching him to the Ionian city of Miletus. After arriving in Miletus, the slave shaves his head and reveals the secret message to the city's regent, Aristagorus, who upon seeing the message is encouraged to rise up against the Persian king. The ancient Chinese used a wooden mask with holes cut out at random places to use as a steganographic device. They would place the wooden block on a blank sheet of paper and after writing the secret message in the holes they would ll in the blanks in the paper with regular text. The mask acted as a secret key to unlock the hidden message. In the seventeenth and eighteenth centuries people used logarithmic tables to hide secret messages by introducing errors in the least signicant digits. The term steganography was rst used in 1499 by Johannes Trithemius in his Trithemius which was one of the rst treatises on the use of cryptographic and stegano- graphic techniques. The study of modern steganography was initiated by Simmons and can be stated as follows [49]. Alice and Bob are imprisoned in two dierent cells that are far apart. They would like to devise an escape plan but the only way they can com- municate with each other is through a courier who is loyal to and under the command of the warden (Eve - adversary) of the penitentiary. The courier leaks all information to the warden. If the warden suspects that either Alice or Bob are conspiring to escape from the penitentiary, she will cut o all communication between them, and move both of them to a maximum security cell. It is assumed that prior to their incarceration Alice 54 and Bob had access to a shared secret key which they will later exploit to send secret messages hidden in a cover text. Can Alice and Bob devise an escape plan without arousing the suspicion of the warden? We should point out that steganography is inherently dierent from cryptography. In the latter, using an encryption algorithm the sender encrypts the secret message utilizing a key (private or public). The resulting message from such an encrypting procedure is called a \cipher-text." To an eavesdropper such as Eve, who does not have access to the secret key, the cipher-text looks like gibberish. If Eve observes that the transmitted cipher-text message is gibberish, she might realize that the message contains private information. In stark contrast to the latter is steganography where we do not necessarily need to encrypt the intended secret message. We merely hide it within a larger plain-text message, often referred to as the \cover-text" or \cover-work." The resulting message, called the \stego-text" must appear as an oblivious or benign message to Eve. In the usual steganographic protocol we assume that Alice and Bob have access to a secure, shared secret key. Alice uses this key and an embedding function to hide a secret message, while Bob uses the same key to extract the secret message. Alice can take this a step further by rst encrypting the message and then hiding the resulting cipher-text inside the cover-text. She may use the same key to encrypt the secret message producing a cipher-text and then hide it within a cover-text to produce a stego-text message. Bob, on receiving the stego-text message would rst have to extract the secret cipher-text and then run a decryption algorithm to obtain the nal secret message. In this work we assume that Eve is a passive observer and all she can do is measure codewords. The whole point of a steganographic protocol is not to apprise Eve that Alice and Bob are transmitting steganographic messages to each other. The way to achieve this is for the message to look \innocent" to Eve. Alice must be smart in applying the errors to the codewords and fool Eve into believing that the errors on the codewords are the result of an actual noise model on the quantum channel. One of our major contributions to this theory is the notion of the security of a steganographic protocol 55 Figure 4.1: There are three dierent inputs to the steganographic encoderE : a cover- messagejCi; the secret message that we would like to hide, which can be quantumjSi or classical S; a shared secret key which may be quantum (ebit)jKi or classicalK. Eve can monitor some part of the noisy quantum channelN shown in the red box. Bob can decode the steganographic message using the decoderD and the shared secret keyjKi orK and recoverjCi, andjSi or S with very high probability. Hidden Message Key Code Classical Bit-string CQECC Classical E-bit EAQECC Quantum Bit-string QECC Quantum E-bit EAQECC Table 4.1: The rst column represents message classical/quantum that we intend to hide. The second column represents the shared secret key between Alice and Bob. The third column represents the quantum error-correcting code. Here CQECC stands for Classically-Enhanced Quantum Error-Correcting Code; QECC stands for Quantum Error-Correcting Code and EAQECC stands for Entanglement-Assisted Quantum Error- Correcting Code which we elaborate in Chapter 5 by exploiting the properties of the diamond norm. We emphasize that a steganographic protocol is considered broken if Eve detects the presence of any sort of covert activity on the channel. Figure 4.1 gives a schematic description of a general steganographic protocol between Alice and Bob, who share a secret keyK which may be classical or quantum (an ebit). Table 4.1 shows the various scenarios of how one can hide a secret message in quantum codewords by using appropriate quantum error-correcting codes. 56 We organize the current chapter by rst presenting a classical model of steganography by detailing two protocols that Alice uses to transmit steganographic information to Bob. In Section 4.2 we give two examples of how Alice uses the syndromes of an error-correcting code to optimize the transmission of steganographic bits over a binary symmetric channel with bit- ip error-rate p. In Section 4.3 we take a coding-theoretic approach to the problem. Instead of encoding her steganographic data into the syndromes of an error- correcting code, Alice encodes her information into the codewords themselves using two dierent error-correcting codes which we refer to as the \outer" and \inner" codes. The former is used as a cover-data, while we use the latter to encode steganographic bits. We give numerical results on the optimal number of bits that Alice can send to Bob with the syndrome encoding using the three-bit and ve-bit repetition codes over a noiseless binary-symmetric channel. We also give numerical results when the BSC has noise for the three-bit repetition code. We were unable to extend this to the ve-bit code because the analysis became complicated and there were too many variables to optimize over. We give numerical evidence of the optimal number of steganographic bits that Alice sends to Bob using the inner-outer coding technique. We end the chapter with concluding remarks before proceeding to detail quantum steganography. 4.2 Syndrome Encoding How do I work? I grope. |Albert Einstein We begin with a very simple example of a classical steganographic protocol where Alice would like to hide a single bit of information, called a steganographic bit, in the syn- dromes of a classical error-correcting code. Alice and Bob a priori decide on a particular code. After encoding her information by disguising them as errors, she uses a noiseless binary symmetric-channel (BSC) to send the information to Bob. For this example let 57 us assume that they are using the [3,1,3] repetition code that encodes three physical bits into one logical bit, and can correct up to a single bit- ip error. Here n = 3, k = 1, and the distance d = 3. This code can correct a single bit- ip error. The codewords for this code are straightforward. 0 = 000 ; (4.1) 1 = 111 : (4.2) The number of syndromes for this code are 2 nk = 2 2 = 4. We label the syndromes s 0 ;:::;s 3 , where the rst syndrome s 0 always corresponds to no error on the codeword. The rest of the syndromess 1 ;s 2 , ands 3 correspond to single bit- ips on each of the three physical bits of the codeword. We need a natural error model for the bit- ip channel. We assume that single bit- ips occur with probability p independently of each other. The probability of no bit- ip is (1p), while as the probability of a bit- ip error is p. There is no intrinsic noise in the channel. The point of this protocol is for Alice to emulate a realistic noise model for the bit- ip channel and fool Eve into thinking the noise is actually coming from the environment or is due to the physics of the channel. Later we will analyze the case where there is also intrinsic noise in the channel. We give the channel probability distribution in Table 4.2. Notice that for each of the transformed codewords we give a sum of the probabilities of correctable and uncorrectable errors. For example if we observe the rst row of Table 4.2 we see that we can obtain the codeword in two dierent ways - when there is no error on 000, which gives the probability (1p) 3 , and when the codeword 111 is ipped to 000 by three independent errors on each of the three physical bits. The probability of the latter occurring is p 3 . Similar reasoning gives us the total probabilities for the rest of the rows in Table 4.2. Alice and Bob have access to a shared binary string (the secret key) with a uniform probability distribution. They also have a function that takes as input shared secret bits from this key, and outputs an 58 Error Corrupted Codeword Syndrome Probability of Error Probability No Error 000 s 0 (1p) 3 +p 3 p 0 Error on bit 1 001 s 1 p(1p) 2 +p 2 (1p) p 1 Error on bit 2 010 s 2 p(1p) 2 +p 2 (1p) p 2 Error on bit 3 100 s 3 p(1p) 2 +p 2 (1p) p 3 Table 4.2: Channel model for the [3,1,3] repetition code ordered pair (j;k) where j;k2f0; 1; 2; 3g with a non-uniform probability distribution, q jk . The ordered pair (j;k) provides both parties with the following map: 0!s j ; (4.3) 1!s k : (4.4) If Alice wants to transmit a steganographic bit (say the bit 0), she applies the single- bit error corresponding to syndrome s j with probability q jk , or s k with probability q kj . When Bob gets the codeword, he knows how to decode the syndromes because he has access to the same mapping (4.3) that Alice does. As an example, imagine that Alice and Bob have access to a shared secret key and a function which they use to generate, say, the ordered pair (1; 0) with probability q 10 . If Alice wants to hide the bit 0, she applies a single bit- ip error to the least-signicant-bit (LSB) of her codeword, (or two bit- ips to the second and third bits of her codeword) and transmits it to Bob. This corresponds to syndrome s 1 . If she wants to send the bit 1, then she does nothing to her codeword, which corresponds to the syndrome s 0 . (Of course, Alice could have picked the reverse map as well with probability q 01 , where she would have hidden bit 0 in syndrome s 0 and bit 1 in syndrome s 1 .) The point of steganography is not to apprise Eve that Alice is sending steganographic bits to Bob over codewords. Imagine the scenario where Alice sends several single-bit steganographic messages to Bob. It would be a disaster if she kept using the same syndromes for her steganographic bits. After a few rounds Eve would immediately guess that the channel was being used to send steganographic messages, for each time Eve would just see either 59 no error or error on the rst bit. This would be a very unnatural error model for the bit- ip channel. So Alice has to apply errors in such as a way as to emulate a natural error model. In applying errors she must match the probability distribution detailed in Table 4.2. This amounts to nding a solution to the following system of linear equations: p j = 1 2 3 X k=0 (q jk +q kj ); (4.5) where j;k 2f0; 1; 2; 3g. If the probability p of an error is very low, then Alice will not be able to hide information without apprising Eve because the Shannon entropy of the channel will be very low. For the probability distribution given in Table 4.2, the maximum entropy H(p) = 2 is achieved when p = 1=2. Therefore, this is not a good code to send steganographic information to Bob, because most of the time Eve will be expecting no errors on the codewords. So Alice can only occasionally transmit a steganographic bit in a codeword in order not to alert Eve to any covert activity on the channel. Alice and Bob get around this problem by including the possibility that they will send no bit in a given code-block. This is represented by the diagonal elements q jj . In this case Alice just applies the syndromes j , and sends the codeword (with no steganographic bit) to Bob. Since Bob shares the secret key, he knows when to expect a steganographic bit. How should Alice chooseq jk andq kj in order to emulate the probability distribution on the channel? We proceed with the solution to Equation 4.5 as follows. We rst set all the diagonal terms except q 00 to zero: i.e., q 11 =q 22 =q 33 = 0. We do this to maximize the probability of sending a steganographic bit. Now we expand Equation (4.5) forj = 1, to get the following: p 1 = 1 2 q 10 +q 11 +q 12 +q 13 +q 01 +q 11 +q 21 +q 31 ; p(1p) 2 +p 2 (1p) = 1 2 q 10 +q 12 +q 13 +q 01 +q 21 +q 31 : (4.6) 60 A solution to the above equation can be: q 10 =q 12 =q 13 =q 01 =q 21 =q 31 = p(1p) 2 +p 2 (1p) 3 : (4.7) The above solution gives Alice a better chance of sending a steganographic bit without apprising Eve, because Alice is spreading the likelihood of transmitting a steganographic bit among dierent syndromes. So there is a good chance of applying a dierent error each time that Alice sends a steganographic bit to Bob, and moreover, the probability of applying this error matches the expected distribution on the channel. The solution for p 2 and p 3 can be worked out similarly: q 20 =q 21 =q 23 =q 02 =q 12 =q 32 = p(1p) 2 +p 2 (1p) 3 ; (4.8) q 30 =q 31 =q 32 =q 03 =q 13 =q 23 = p(1p) 2 +p 2 (1p) 3 : (4.9) Now we go back and nd the value for q 00 by solving Equation (4.5). For j = 0 this corresponds to: (1p) 3 +p 3 = 1 2 q 00 +q 01 +q 02 +q 03 +q 00 +q 10 +q 20 +q 30 : (4.10) We already have the values for each of the terms in Equation (4.10) except q 00 . We, therefore, can solve for q 00 : q 00 = 4p 2 4p + 1 (4.11) We would like the probability of sending no steganographic bits to be as low as possible and so we would likeq 00 to be as low as possible. The average steganographic information N avg that Alice transmits to Bob is the sum of the non-diagonal q-terms: 61 N avg = X j6=k q jk ; (4.12) = q 01 +q 02 +q 03 +q 10 +q 12 +q 13 +q 20 +q 21 +q 23 +q 30 +q 31 +q 32 ; = 12 p(1p) 2 +p 2 (1p) 3 ; = 4(p(1p) 2 +p 2 (1p)) ; = 4p(1p) : We now proceed to give a more ecient solution to Equation (4.5). As in the previous solution we would like to make q 00 as small as possible. So let q 01 ;q 02 ;q 03 ;q 10 ;q 20 , and q 30 be non-zero and let all other q-terms be equal to zero. In order to solve for q 00 , we must solve: p 0 = 1 2 q 00 +q 00 + 3 X j=1 q 0j +q j0 : (4.13) Equation (4.13) can be simplied as follows: p 0 =q 00 + 3 X j=1 1 2 q 0j +q j0 : (4.14) We need the quantity within the sum in Equation (4.14) in order to nd q 00 . We set all the non-zero q-terms q 01 ;q 02 ;q 03 ;q 10 ;q 20 , and q 30 equal to the probability of a single bit- ip error, p 2 (1p) + (1p) 2 p, as follows, p j = 1 2 q 0j +q j0 =p 2 (1p) + (1p) 2 p ; (4.15) q 0j = q j0 =p 2 (1p) + (1p) 2 p ; (4.16) for j = 1; 2; 3. Substituting Equation (4.16) into Equation (4.14) we obtain: q 00 = 6p 2 6p + 1 (4.17) 62 Since the Shannon entropy for this channel is very low, p 1, most of the time the codewords will go uncorrupted through the channel. We know that Eve is expecting to see this behavior on the channel. Any large deviation from this expectation will apprise Eve. So Alice takes advantage of this knowledge and uses the syndrome s 0 as often as she can in order to hide single bits. We can calculate the average amount of information that Alice transmits to Bob: N avg = X j6=k q jk ; = q 01 +q 02 +q 03 +q 10 +q 12 +q 13 +q 20 +q 21 +q 23 +q 30 +q 31 +q 32 ; = 6(p 2 (1p) + (1p) 2 p) ; = 6p(1p) : (4.18) Comparing with the rst example, we can see that Alice is able to send more stegano- graphic information in the latter example because she is utilizing the syndromes 0 which corresponds to no error on the codeword. This is evident from Figure 4.2. When she hides one bit in this syndrome, she's able to do more because most of the time Eve expects this channel to not corrupt the codewords and so Eve will be expecting codewords 000 or 111. Alice knows this and thus takes advantage by packing in more steganographic information. 4.2.1 Noisy Bit-Flip Channel We now investigate the case where Alice would like to transmit a steganographic bit to Bob in the presence of extra bit- ip noise on the channel. In this example, as opposed to the previous noiseless case, when Alice sends her codewords through the channel, the channel may ip a bit and change the syndrome that corresponds to a steganographic bit. As in the noiseless example in Section 4.2, Alice and Bob have access to a shared binary string and a generating function which inputs some of these key bits and outputs 63 Figure 4.2: Average Number of Steganographic Bits vs. Error-Rate p an ordered pair (j;k) with a non-uniform probability distribution q jk . Alice and Bob both have access to the following map: 0!s j ; (4.19) 1!s k : (4.20) If Alice wants to hide the bit 0, she applies the error corresponding to syndrome s j on her codeword with probability q jk . Unlike the example in Section 4.2, now when the codeword passes through the channel there is a non-zero probability that the channel 64 will apply its own error to the corrupted codeword that Alice is transmitting. This gives rise to the following map: s j !s l ; (4.21) s k !s l 0 : (4.22) There is a non-zero conditional probability p(ljj) and p(ljk) with which the channel transforms Alice's intended syndrome s j (if she's hiding bit 0) or s k (if she's hiding bit 1) to s l , respectively. Alice would like to simulate this binary symmetric channel which now has additional noise from the environment. In order to achieve this, we would have to solve the following set of equations: p 0 l = 1 2 3 X j;k=0 q jk p(ljj) +p(ljk) ; (4.23) where l = 0; 1;:::; 3. p 0 > p is the error rate of the eective channel. The eective probability distribution, corresponding to no ip, and bit- ips on bits one, two, and three of the noisy channel may be written as: p 0 0 = p 03 + (1p 0 ) 3 ; (4.24) p 0 1 = p 0 2 =p 0 3 =p 0 (1p 0 ) 2 +p 02 (1p 0 ) =p 0 (1p 0 ) : (4.25) As in the example in Section 4.2, we would like to determine the probability q 00 which corresponds to Alice not sending any bit to Bob. Our goal is to minimize this probability, because we want Alice to transmit steganographic bits to Bob. We begin by rewriting Equation (4.23) for l = 0. Note that we do not include diagonal q-terms (exceptq 00 ) in the following equation, as that corresponds to sending no steganographic bit. p 0 0 = 1 2 3 X j;k=0 q jk p(0jj) +p(0jk) : (4.26) 65 Conditional Probability Corrupted Codeword Probability of Error p(0j0) 000 III ! 000 + 111 XXX ! 000 (1p) 3 +p 3 =p 0 p(0j1) 001 IIX ! 000 + 110 XXI ! 000 p(1p) 2 +p 2 (1p) =p 1 p(0j2) 010 IXI ! 000 + 101 XIX ! 000 p(1p) 2 +p 2 (1p) =p 1 p(0j3) 100 XII ! 000 + 011 IXX ! 000 p(1p) 2 +p 2 (1p) =p 1 Table 4.3: Conditional Probabilities - [3,1,3] Repetition Code After expanding Equation (4.26), we obtain the following equation: p 0 0 = 1 2 q 00 p(0j0) +p(0j0) +::: +q 32 p(0j3) +p(0j2) : (4.27) In order to solve Equation (4.27), we need to determine the conditional probabilities, p(0j0);p(0j1);p(0j2), and p(0j3) which we have calculated in Table 4.3. After substitut- ing the value of the conditional probabilities from Table 4.3 into Equation (4.27) and rearranging the terms, we get the following: q 00 = p 0 0 p 0 1 2 (p 0 +p 1 ) p 0 q 01 +q 02 +q 03 +q 10 +q 20 +q 30 p 1 p 0 q 12 +q 13 +q 21 +q 23 +q 31 +q 32 : (4.28) In order to solve Equation (4.28), we need to determine the values for the various q-terms. We begin by expanding the following equation: p 0 1 = 1 2 3 X j=1 3 X k=0 q jk p(ljj) +p(ljk) ; p 0 1 = 1 2 q 10 p(1j1) +p(1j0) +::: +q 32 p(1j3) +p(1j2) : (4.29) We determine the conditional probabilities appearing in Equation (4.29) in the same way as in Table 4.3. After calculating and substituting the values for the conditional probabilities into Equation (4.29) we get the following: p 0 1 = 1 2 (p 0 +p 1 )(q 10 +q 12 +q 13 +q 21 +q 31 ) +p 1 (q 20 +q 23 +q 30 +q 32 ) : (4.30) 66 From Equation (4.30), we can easily set the q-terms to the following: q 10 =q 12 =q 13 =q 21 =q 31 = 1 5 p 0 1 (p 0 +p 1 ) ; (4.31) q 20 =q 23 =q 30 =q 32 = 1 8 p 0 1 p 1 : (4.32) We still need to determine the values for q 01 ;q 02 , and q 03 . We begin by writing the following equation: p 0 2 = 1 2 3 X j=0 3 X k=1 q jk p(2jj) +p(2jk) : (4.33) After expanding Equation (4.33), and rewriting, we get the following equation: p 1 (q 01 +q 03 )+ 1 2 p 0 +p 1 q 02 =p 0 2 1 2 (p 0 +p 1 ) q 12 +q 21 +q 23 +q 32 p 1 (q 13 +q 31 ): (4.34) But we already know the values of all the q-terms that appear on the right side of Equation (4.34). We substitute the values of these q-terms from Equation (4.31): p 1 q 01 + 1 2 p 0 +p 1 q 02 +p 1 q 03 =p 0 2 1 2 p 0 +p 1 2 5 p 0 1 (p 0 +p 1 ) + 1 4 p 0 1 p 1 p 1 2 5 p 0 1 (p 0 +p 1 : (4.35) Let us rewrite Equation (4.35) as follows: p 0 2 =p 1 q 01 + 1 2 p 0 +p 1 q 02 +p 1 q 03 + ; (4.36) where = 1 2 p 0 +p 1 2 5 p 0 1 (p 0 +p 1 ) + 1 4 p 0 1 p 1 +p 1 2 5 p 0 1 (p 0 +p 1 : (4.37) Now it is quite easy to set the values for q 01 ;q 02 ; and q 03 . q 01 =q 03 = 1 3p 1 p 0 2 = 1 3p 1 p 0 1 ; (4.38) q 02 = 2 3 p 0 2 p 0 +p 1 = 2 3 p 0 1 p 0 +p 1 : (4.39) 67 We can now nally substitute the values of the q-terms into Equation (4.28): q 00 = p 0 0 p 0 1 5 ( + 4) p 0 1 p 0 +p 1 1 4 ( +) p 0 1 p 1 2 3 p 0 1 p 1 p 0 p 0 +p 1 (4.40) where = 1 2 p 0 +p 1 p 0 ; (4.41) = p 1 p 0 ; (4.42) and where we obtain p 0 0 and p 0 1 in terms of p and p by expanding Equation (4.24): p 0 0 = 1 3p(1p) 3p(1 2p) ; (4.43) p 0 1 =p 0 2 =p 0 3 =p(1pp) +p(1p) : (4.44) Next we would like to determine the amount of average information that Alice can transmit to Bob if the eective error rate p 0 =p +p>p. The sum of the non-diagonal q-terms will give us the average information: N avg = 3 X j6=k q jk : (4.45) After expanding Equation (4.45), we get: N avg = 2 3 (p 0 1 ) p 0 +2p 1 p 1 (p 0 +p 1 ) +p 0 1 p 0 +3p 1 2p 1 (p 0 +p 1 ) (4.46) 4.2.2 Numerical Simulation We would like to optimize the average number of bits that Alice can hide in a three- bit repetition code for both the noiseless and the noisy bit- ip channel. In order to do this we set up the problem as a linear-optimization one, where the objective function (also known as the cost or prot function) that we would like to optimize is the average 68 number of steganographic bits that Alice can transmit to Bob. We would further like to extend this example to the ve-bit repetition code that encodes one logical bit into ve physical bits, and can correct up to two arbitrary bit- ips. While we can implement the three-bit repetition code from Section 4.2, it turns out that if we extend this naively to the ve-bit case, we run into the problem of optimizing over several thousand variables. This happens because unlike the three-bit case, the ve-bit code has sixteen syndromes. This gives Alice and Bob many ways to encode their steganographic bits. With the three-bit code Alice and Bob can in addition to hiding a single bit, hide two bits. They would use the following encoding map: 00!s 0 ; (4.47) 01!s 1 ; (4.48) 10!s 2 ; (4.49) 11!s 3 : (4.50) However, if the error-rate of the channel is very low, then Alice will rarely transmit two steganographic bits. On the average Alice will transmit one steganographic bit to Bob. If Eve knows that the error-rate of the channel is low, where a single bit is ipped occasionally, she would be apprised of covert activity on the channel if Alice applies the two-bit encoding most of the time. The ideal situation for Alice would be where she minimizes sending no bit at all through the channel, but where she can occasionally (rarely) hide two bits, thereby boosting her transmission rate to little over one bit over several uses of the channel. The latter depends on the value of p. We summarize the 69 linear equality/inequality constraints along with the objective function N avg (average number of hidden bits) that we optimize, below: p j = 1 2 3 X k=0 (q jk +q kj ); (4.51) X j;k q jk = 1; (4.52) q jk 0;8j;k; (4.53) N avg = X j6=k q jk + 2 X j6=k6=l6=m q jklm : (4.54) So we end up with ve linear equality constraints and sixteen linear inequality con- Figure 4.3: Noiseless Three-Bit Code. We plot the error-rate on the X-axis and the average number of bits, N avg , on the Y-axis for various error sequences. Here k varies from 1 to 100. As the error-rate increases Alice can hide up to two bits. The red curve plots the Shannon entropy of the probability distribution of the syndromes. 70 straints. We can already see that with the three-bit code we are optimizing over sixteen dierent variables, with several linear constraints. When we try to extend this naive approach to the ve-bit problem, we end up optimizing over several thousand variables as we mentioned earlier. In the previous approach Alice and Bob use the sixteen variablesq jk to keep track of the various ways in which they can encode their steganographic bits. We also know that Alice must apply errors in such a way that she matches the probability distribution p of the bit- ip channel. In the second approach Alice groups her syndromes by probabilities. From Table 4.2 it is clear that syndromess 1 ;s 2 , ands 3 have the same probabilityp 2 (1 p)+p(1p) 2 , while syndromes 0 has the probabilityp 3 +(1p) 3 . We reduce the number of variables over which we must optimize by introducing the notion of a syndrome class. Instead of the variablesq jk , we now useQ j 0 ;:::;j M1 , wherej 0 is the number of syndromes Alice uses from the rst group, and the number of syndromes she uses from the second group and so on, and where M = 2, tells us the total number of syndrome classes. So theQ variables give us the total probability of using an encoding scheme to hide a bit. Moreover, we use the variables n 0 ;n 1 ;:::;n M1 to denote the various syndrome classes, and to keep track of the total number of syndromes in each group. So for the three- bit case we have n 0 = 1 for we only have the syndrome s 0 , and n 1 = 3 for we have three dierent syndromes s 1 ;s 2 , and s 3 . With this new denition the linear equality constraints that Alice must now satisfy are as follows: p k = X j 0 ;j 1 ;:::;j M1 j k =n k j 0 +j 1 +::: +j M1 Q j 0 j 1 :::j M1 ; (4.55) and X j 0 ;j 1 ;:::;j M1 Q j 0 ;j 1 ;:::;j M1 = 1 : (4.56) While as the linear inequality constraints that she must satisfy are: Q j 0 ;j 1 ;:::;j M1 0 : (4.57) 71 The average number of bits that she can hide without apprising Eve of steganographic activity are: N avg = X j 0 ;j 1 ;:::;j M1 blog 2 (j 0 +j 1 +::: +j M1 )cQ j 0 j 1 :::j M1 : (4.58) With the above denition we can frame our noiseless three-bit linear optimization prob- lem as follows: p 0 =Q 10 + 1 2 Q 11 + 1 4 Q 13 ; (4.59) p 1 = 1 3 Q 01 + 1 6 Q 11 + 1 3 Q 02 + 1 4 Q 13 ; (4.60) X j 0 ;j 1 Q j 0 j 1 = 1 ; (4.61) Q j 0 j 1 0 ; 8j 0 ;j 1 ; (4.62) N =Q 11 +Q 02 + 2Q 13 : (4.63) We have reduced our problem from optimizing over sixteen variables to optimizing over ve variables. We summarize our result from this optimization in Figure 4.3. In this example Alice can hide a maximum of two bits at an error-rate of 0.5. We plot the Shannon entropy of the various syndrome probabilities in red. In the limit of large block codes, we can essentially close the gap between the Shannon curve and the curves for the optimal solution. We now detail the ve-bit code, [5,1,5] example. This is a distance-ve code and can correct up to two bit- ip errors. The [5,1,5] code has sixteen distinct syndromes, s 0 ;s 1 ;:::;s 15 . As in the previous example, s 0 corresponds to no error. Syndromes s 1 ;s 2 ;:::;s 5 correspond to single bit- ip errors on each of the ve physical bits of the corrupted codeword. Syndromes s 6 ;s 7 ;:::;s 15 correspond to double bit- ip errors. We summarize the error model for the bit- ip channel for the [5,1,5] code in Table 4.4. Notice that as in Table 4.2 we have included the probabilities for both correctable and uncorrectable errors in each of the rows of Table 4.4. In the ve-bit example we have 72 Error Codeword Syndrome Prob of Error Error No Error 00000 s 0 (1p) 5 +p 5 p 0 Error on bit 1 00001 s 1 (1p) 4 p +p 4 (1p) p 1 Error on bit 2 00010 s 2 (1p) 4 p +p 4 (1p) p 2 Error on bit 3 00100 s 3 (1p) 4 p +p 4 (1p) p 3 Error on bit 4 01000 s 4 (1p) 4 p +p 4 (1p) p 4 Error on bit 5 10000 s 5 (1p) 4 p +p 4 (1p) p 5 Error on bits 1 and 2 00011 s 6 (1p) 3 p 2 +p 3 (1p) 2 p 6 Error on bits 1 and 3 00101 s 7 (1p) 3 p 2 +p 3 (1p) 2 p 7 Error on bits 1 and 4 01001 s 8 (1p) 3 p 2 +p 3 (1p) 2 p 8 Error on bits 1 and 5 10001 s 9 (1p) 3 p 2 +p 3 (1p) 2 p 9 Error on bits 2 and 3 00110 s 10 (1p) 3 p 2 +p 3 (1p) 2 p 10 Error on bits 2 and 4 01010 s 11 (1p) 3 p 2 +p 3 (1p) 2 p 11 Error on bits 2 and 5 10010 s 12 (1p) 3 p 2 +p 3 (1p) 2 p 12 Error on bits 3 and 4 01100 s 13 (1p) 3 p 2 +p 3 (1p) 2 p 13 Error on bits 3 and 5 10100 s 14 (1p) 3 p 2 +p 3 (1p) 2 p 14 Error on bits 4 and 5 11000 s 15 (1p) 3 p 2 +p 3 (1p) 2 p 15 Table 4.4: Channel model for the [5,1,5] code three distinct syndrome classes, no error, a single bit- ip error, and two bit- ip errors. We label these classes by n 0 ;n 1 , and n 2 respectively. If we observe Table 4.4, we see that n 0 = 1;n 1 = 5, and n 2 = 10. The probability of using a particular encoding is represented by the variableQ j 0 j 1 j 2 . With the ve-bit code, Alice can hide up to four steganographic bits. We summarize the various encoding schemes that Alice can employ to send zero, one, two, three, and four bits to Bob in Table 4.5. The rst linear equality that Alice must satisfy is that the total probability of using all the various encoding schemes must sum up to 1: X j 0 j 1 j 2 Q j 0 j 1 j 2 = 1 : (4.64) 73 The second set of linear equality constraints deals with satisfying the probability distri- bution of the channel, as follows: p 0 =Q 100 + 1 2 Q 110 +Q 101 + 1 4 Q 130 +Q 121 +Q 103 +Q 112 + 1 8 Q 152 +Q 143 +Q 134 +Q 125 +Q 116 +Q 107 + 1 16 Q 1;5;10 ; (4.65) p 1 = 1 5 Q 010 +Q 020 +Q 040 + 1 10 Q 110 +Q 011 +Q 121 +Q 022 +Q 044 +Q 143 + 3 20 Q 130 +Q 031 + 1 8 Q 152 +Q 053 + 3 40 Q 035 +Q 134 + 1 20 Q 013 +Q 026 +Q 125 +Q 112 + 1 40 Q 017 +Q 116 + 1 16 Q 1;5;10 ; (4.66) p 2 = 1 10 Q 001 +Q 004 +Q 008 +Q 002 + 3 80 Q 053 +Q 143 + 1 20 Q 011 +Q 101 +Q 022 +Q 044 +Q 112 + 7 80 Q 017 +Q 107 + 1 40 Q 121 +Q 031 +Q 152 + 3 40 Q 013 +Q 026 +Q 116 +Q 103 + 1 16 Q 035 +Q 125 +Q 1;5;10 : (4.67) The linear inequality constraints that Alice must satisfy are: Q j 0 j 1 j 2 0;8j 0 ;j 1 ;j 2 : (4.68) The objective function that Alice must maximize is the average number of steganographic bits that she can transmit to Bob: N avg = X j0+j 1 +j 2 =2 Q j 0 j 1 j 2 + X j0+j 1 +j 2 =4 2Q j 0 j 1 j 2 + X j0+j 1 +j 2 =8 3Q j 0 j 1 j 2 + X j0+j 1 +j 2 =16 4Q j 0 j 1 j 2 : (4.69) 74 N s Encoding N s Encoding N s Encoding N s Encoding N s Encoding 0 Q 010 1 Q 011 2 Q 031 3 Q 053 4 Q 1;5;10 0 Q 001 1 Q 020 2 Q 022 3 Q 044 0 Q 100 1 Q 002 2 Q 013 3 Q 035 1 Q 101 2 Q 004 3 Q 026 1 Q 110 2 Q 040 3 Q 017 2 Q 121 3 Q 008 2 Q 130 3 Q 143 2 Q 103 3 Q 143 2 Q 112 3 Q 125 3 Q 116 3 Q 107 3 Q 152 Table 4.5: N s is the number of steganographic bits that Alice can hide and subsequently transmit to Bob. Column 2 shows the various encoding schemes that Alice can employ to successfully transmit steganographic bits to Bob. The result of optimizing the ve-bit code is shown in Figure 4.4. The gure is qualitatively similar to the noiseless three-bit example. Once again the maximum number of steganographic bits that Alice can hide is at an error-rate of 0.5. This happens because at that rate the Shannon entropy of the channel is maximized which means that almost all of the codewords are experiencing bit- ips, and so Alice can on the average can transmit more steganographic bits. In the limit of large code-blocks, the number of steganographic bits that Alice can transmit to Bob reaches the Shannon capacity. Even though we don't prove this statement, one can infer this by eye-balling the gap between the steganographic curves and the Shannon curve in Figures 4.3, and 4.4. We now move on to the case where Alice hides up to two steganographic bits in a three-bit code and transmits it through a noisy bit- ip channel with error-rate p 0 =p +p, wherep 0 is the noise that the channel experiences from the environment, and where p is the error- rate that Eve expects of the channel. The idea here is that Alice ought to be able to utilize the extra noise in the channel to send a steganographic bit to Bob more frequently. We implement this linear optimization problem in terms of encoding classes following along the lines of noiseless three-bit example stated previously. In Table 4.6, we show the 75 Figure 4.4: Noiseless Five-Bit Code. We plot the error-rate on the X-axis and the average number of bits, N avg , on the Y-axis for various error sequences. Here k varies from 1 to 100. As the error-rate increases Alice can hide up to six bits. The red curve plots the Shannon entropy of the probability distribution of the syndromes. number of correct steganographic bits that Bob receives from Alice, when she encodes two steganographic bits in the three-bit code. Suppose Alice and Bob agree on a particular encoding, say, (j;k) with probability q jk , the encoding that we state in Equation (4.3). One can divide this scenario into two cases: the rst case where Alice transmits the codeword corresponding to syndrome j, and Bob receives the codeword corresponding to syndrome l, and the second case where Alice sends the codeword corresponding to syndrome k, but Bob receives the codeword corresponding to syndrome l. Based on these two notions we dene the probability of receiving a correct bit by Bob as follows: p corr (j;k) = 1 2 X p(ljj)>p(ljk) p(ljj) + X p(ljj)<p(ljk) p(ljk) : (4.70) 76 Figure 4.5: Noisy Three-Bit Code. We plot the channel noise p on the X-axis and the average number of bits correctly received by Bob, N avg , on the Y-axis for various error-rates p which decrease by an order of magnitude. The linear equality and inequality constraints for the noisy example are exactly the same as those for the noiseless case in Equation (4.59). The objective functionN avg that Alice must optimize is: N avg = X j6=k p corr (j;k)q jk + X j6=k6=l6=m 2 (p 0 +p 1 )q jklm : (4.71) The above objective function, in the encoding classes setting, gets transformed to: N avg =p 0 (Q 11 +Q 02 ) + 2(p 0 +p 1 )Q 13 : (4.72) 77 Transmitted Bits Received Bits # of Correct Bits 00 2 00 01 1 10 1 11 0 00 1 01 01 2 10 0 11 1 00 1 10 01 0 10 2 11 1 00 0 11 01 1 10 1 11 2 Table 4.6: The rst column shows the two bits that Alice transmits to Bob, whereas the second column shows the received bits by Bob, some of which have experienced an error due to the noisy bit- ip channel. We expect that with the extra noise Alice ought to be able to sneak in steganographic bits more frequently, and that is what we our results show in Figure 4.5 4.3 Inner-Outer Codes Information is the resolution of uncertainty. |Claude Shannon In this section we generalize the notion of transmitting steganographic bits over bit- ip channels by utilizing coding theory to our advantage. The strategy of straightforwardly encoding steganographic bits into the syndromes of an error-correcting code can only go so far. Transmitting steganographic bits over a ve-bit code by utilizing syndromes becomes infeasible because the noisy environment can transform Alice's intended syn- drome to any of the other fteen syndromes. The main reason that the strategy worked 78 for the three-bit case is because it is a very simple example, the conditional probabil- ities are easy to calculate, and there are not too many ways by which the noise can transform the syndromes of the three-bit code. In this chapter we present a dierent protocol for transmitting steganographic bits over a bit- ip channel. The protocol still uses error-correcting codes, but Alice and Bob no longer encode steganographic bits into syndromes. One of the main advantages of developing this protocol is that it generalizes in a straightforward fashion to the quantum setting. 4.3.1 Classical Steganographic Protocol In any steganographic protocol the sender, Alice, embeds her steganographic information into an innocent-looking cover-text message, and transmits it to the receiver Bob over a binary symmetric channel with bit- ip ratep. She could for example use a passage from Hamlet to encode steganographic information into Shakespeare's poetry via a secret key shared between Bob and her. When this message is intercepted by Eve she does not suspect that there is any covert activity between them because, after all, the message is just a few passages from Hamlet. Our biggest challenge was to extend this latter notion of an innoncent-looking message to the information-theoretic setting. As we demonstrated in the previous chapter, we achieve this via a set linear equality constraints that Alice must satisfy so that she can match the probability distribution p of the bit- ip channel. The protocol begins as follows: (i). Alice chooses an [N;k c ] error-correcting code, where N 1, as her cover-code. We also refer to this cover-code as an \outer" code. (ii). Alice chooses a random M-bit subset from among the N bits of the outer code, where M < N, and M 1. The locations of these M bits is specied by the secret key that Alice and Bob share with each other. (iii). Alice applies errors to the subset ofM bits using an [M;k s ] code, which we refer to as the \inner" code, thereby encodingk s steganographic bits. An average codeword 79 of an [M;k s ] code has weight approximately M 2 . By applying these errors on the N-bit code-block, the eective binary symmetric channel has a bit- ip rate of q M 2N . (iv). For an extra layer of protection Alice applies a one-time pad to the M-bit subset. In addition to the original key, Alice and Bob also share these extraM bits of their one-time pad. (v). Alice transmits her N-bit code-block through the channel. (vi). Bob measures the syndromes of the cover-code and extracts the pattern of bit- ip errors. (vii). Bob reapplies the one-time pad to the M-bit subset and recovers the errors on the M bits. (viii). Bob decodes the M-bit codeword and correctly recovers k s steganographic bits. Let us clarify the protocol above with a simple example which is shown in Figure 4.6. Suppose Alice chooses the ten-bit repetition code, [10; 1; 10], as her cover-code. She encodes 1 into 1111111111 which is one of the codewords of the [10; 1; 10] code. So the [10; 1; 10] is her \outer" code. She then chooses three bits randomly from this ten-bit code-block. In this example she chooses the third, sixth, and eighth bits to represent the codeword for her [3; 1; 3] inner-code. She then ips the rest of the bits to 0. She ends up with 0010010100. Suppose the one-time pad is 0010000100. She then applies this one-time pad to 0010010100, and gets 0000010000. She nally encodes this into the cover-code by XORing the latter with 1111111111. She ends up with the bit-string 1111101111 which she then transmits through a binary-symmetric channel to Bob. Let us say that this bit-string experiences bit- ips on fourth and eighth bits. Bob receives the bit-string 1101100111. Since he knows that Alice used the [10; 1; 10] code as her cover- code, he knows that to unmask the cover he needs to XOR with 1111111111, which he does and obtains the string 0010011000 to which he now applies the one-time pad to 80 Steganographic Bit Encoding Bit Bit String 0 0 000 1 0 111 001 0 1 010 001 110 1 1 101 011 Table 4.7: Encoding for transmitting one steganographic bit over a bit- ip channel with [3; 1; 3] as an inner-code and [N; 1;N] as the outer code. recover 0000011100. He now uses the shared secret key in order to determine the bit locations of the inner [3; 1; 3] code. He knows that the three-bit code comprises of the third, sixth, and eighth bits. So he recovers the bit-string 011, to which he applies error- correction and obtains 111, which he correctly decodes as 1. If the channel had ipped two bits of the inner code, then Bob would have incorrectly decoded the steganographic bit. Alice can avoid this problem by using a bigger code for her inner-code block. In this example had she used the [5; 1; 5] code as her inner-code, then Bob would have been able to correct for up to two errors. Moving to larger block codes unfortunately leads to a decrease in the transmission rate. 4.3.2 Three Bits In N Bits Encoding We now give a specic example where Alice uses the [3; 1; 3] repetition code as her inner code, while using an N-bit repetition code as her outer code. As in the previous chapter, we frame the problem as a linear-optimization one. We present the encoding in Table 4.7. We introduce the variableY ijk , which is the probability of choosing to hide steganographic biti using the encoding bitj, and where we allowk bit- ips on the outer-code. Soi refers to the rst column of Table 4.7, whilej, andk refer to the second and third columns, respectively. With probabilityQ Alice uses the encodingY ijk to transmit a steganographic bit, and with probability 1Q she sends no steganographic 81 bit to Bob. However, when she chooses to send no steganographic bit to Bob, she applies l errors randomly to theN-bit code block with probabilityq l . Alice does this because in case the error-rate of the channel is small and she cannot hide no steganographic bit, she may as well fool Eve by applying random errors which would still match the probability distributionp of the channel. The set of linear equality constraints that she must satisfy are: p 0 = N 0 (1p) N =Y 000 +q 0 ; (4.73) p 1 = N 1 p(1p) N1 =Y 010 +Y 001 +q 1 ; (4.74) p 2 = N 2 p 2 (1p) N2 =Y 010 +Y 001 +Y 002 +q 2 ; (4.75) . . . p N = N N p N =Y 10(N3) +q N : (4.76) We also insist that the steganographic bit that Alice chooses to transmit to Bob should be independent of her choice of encoding. To match the latter constraints Alice must satisfy: ~ Y 00 = ~ Y 10 ; (4.77) ~ Y 01 = ~ Y 11 ; (4.78) where ~ Y ij = N3 X k=0 Y ijk : (4.79) In addition to the above equality constraints, we also want conservation of probabilities: X ijk Y ijk + X l q l = 1 : (4.80) 82 Alice must satisfy the following linear inequality constraints: Y ijk 0;8i;j;k ; (4.81) q l 0;8l : (4.82) Alice wants to maximize the probability of transmitting a stegaongraphic bit to Bob with each use of the channel. So she must maximize the following objective function: N avg = X ijk Y ijk : (4.83) We simulated the above protocol keeping the inner [3,1,3] code xed, while using the outer code [N; 1;N] forN = 5; 7; 9; 11; 13, and 15. From Figure 4.7 it is clear that as we increase the length of the outer code block from N = 5 to N = 15, she can utilize more of the error-rate region in order to transmit a steganographic bit to Bob. In the next section we generalize this by allowing an arbitrary inner-code. 4.3.3 M Bits In N Bits Encoding In this section we detail how Alice can transmit M steganographic bits to Bob over a noisless binary symmetric channel with a bit- ip rate of p. Once again we frame this problem as a linear optimization one, where we are optimizing over the average number of steganographic bits that Alice can transmit to Bob without apprising Eve of any suspicious activity|making the whole protocol look innoncent to Eve. Let S M be the subset of the bits that comprise the inner-code. Let S = S N be the subset of the bits that comprise the outer [N;k c ] code. LetY ij be the probability of ipping i bits of S M , and j bits of S N where 0jNM. When Alice decides to send no steganographic bits to Bob she applies random bit- ips to her N-block code with probability q l , where 0lN. LetQ = P ij Y ij , be the total probability of sending aM steganographic bits to Bob, and let 1Q = P l q r be the total probability of transmitting no steganographic 83 bits to Bob. We would like to minimize the latter quantity or equivalently maximizeQ. For this scheme to be useful Bob must be able to decode Alice's messages, which means that the outer code should be able to correct up to t s = ds1 2 errors. The rst set of linear equality constraints that Alice must satisfy is the probability distribution that must match the error-rate of the bit- ip channel. These are: p 0 = N 0 (1p) N =Y 00 +q 0 ; (4.84) p 1 = N 1 p(1p) N1 =Y 01 +Y 10 +q 1 ; (4.85) p 2 = N 2 p 2 (1p) N2 =Y 20 +Y 11 +Y 02 +q 2 ; (4.86) . . . p N = N N p N =Y M(NM) +q N : (4.87) The second set of linear equality constraints is on the bits that comprise the inner-code: ~ Y k = 1 2 M M k M X i=0 NM X j=0 Y ij ; (4.88) where ~ Y k = NM X j=0 Y kj : (4.89) Alice must also satisfy the following: X ij Y ij + X l q l = 1 : (4.90) As in the previous optimization problems, Alice must satisfy the following linear inequal- ity constraints: Y ij 0;8i;j ; (4.91) q l 0;8l : (4.92) 84 Alice wishes to maximize the average number of steganographic bits that she can transmit to Bob. So the objective function is: N avg = X ij Y ij : (4.93) From Figure 4.8 it is clear that the three-bit code outperforms both the ve and seven bit codes initially, but is then outperformed by the higher bit codes when the channel bit- ip rate increases. One can also infer from the plot (though we have not proved this) that with increasing block-size the average number of steganographic bits will reach the Shannon capacity of the channel. The protocol above is for a bit- ip channel which has no intrinsic noise. The ips that Eve observes are articially induced by Alice and are incorporated in such a way as to match with Eve's belief of the error-rate of the channel. For the inner-code above, Alice and Bob do not use an actual error-correcting code. However, if there is intrinsic noise in the channel due to the environment, then they must use an error-correcting code for their inner-bits. This could be an [M;k s ] code, where MN, and where now Alice instead of transmitting M bits to Bob, can only transmit k s bits. Clearly the transmission rate goes down, but that is the price Alice must pay for Bob to have any chance of decoding the message properly, and correctly acquiring the right steganographic bits. We now proceed to give an exact formula for the amount of secret key consumed in each round of the protocol as a function of p and the intrinsic noise p. 4.3.4 Key Consumption Rate In this section we detail how many bits of the shared secret key Alice and Bob consume per block of code that Alice transmits to Bob. We dene this quantity as the key- consumption rateK p p . There are N M ways of choosing M locations out of N in an N bit code-block. So the total number of bits that Alice and Bob need to specify the subset S M which comprises the bits for the inner code is log N M . They also needM bits of key 85 for the one-time pad to encrypt their steganographic bits. So the total bit-lengthjKj of the shared secret key is: jKj = log N M +M : (4.94) After applying Stirling's approximation to the right hand side of Equation (4.94), we get the following: jKjN logNM logM (NM) log(NM) +M : (4.95) Replace M in Equation (4.95) by M 2Nq, where q is the rate at which Alice applies errors to the N-bit code-block in order to emulate the actual probability distribution of the binary symmetric channel with bit- ip rate p. We get the following: jKj N logN 2Nq log(2Nq) (N 2Nq) log(N 2Nq) + 2Nq N logN 2Nq (log 2 + logN + logq)N(1 2q) logN(1 2q) + 2Nq N logN 2Nq 2Nq logN 2Nq logq N(1 2q) logNN(1 2q) log(1 2q) + 2Nq : (4.96) Now collect all the logN terms in Equation (4.96). (N 2NqN + 2Nq) logN 2Nq 2Nq logqN log(1 2q) + 2Nq log(1 2q) + 2Nq : (4.97) 86 The rst term in Equation (4.97) is zero. Moreover the two 2Nq terms cancel each other. We proceed further with the simplication below: jKj 2Nq log(1 2q) logq 1 2q log(1 2q) 2Nq log(1 2q) logq log(1 2q) 1 2q 2Nq log(1 2q) logq + log(1 2q) 1 2q 2Nq log(1 2q) logq(1 2q) 1 2q 2Nq log (1 2q) q(1 2q) 1 2q N 2q log (1 2q) q(1 2q) 1 2q : (4.98) We want to express the key-consumption rate in terms of the error-ratep of the channel, and the extra noise p. We can substitute q = p 12p in Equation (4.98): jKjN 2p 1 2p log p 12p 12p 2p ! : (4.99) where = 12(p+p) 12p . So the key-consumption rateK p p = jKj N is: K p p = 2p 12p log p 12p 12p 2p ! (4.100) From Figure (4.9) one can see that as the error-rate increases Alice and Bob consume key at a faster rate. They need more bits to specify the subset S M as Alice needs to ip more bits in order to emulate the additional noise. For a higher p our intuition tells us that Alice and Bob ought to use a longer key-length, as Alice would be choosing more bits to ip (on the average). 87 4.4 Concluding Remarks We presented two dierent protocols on how to hide classical bits by rst encoding Alice's steganographic information into the syndromes of an error-correcting code and then later using the codewords themselves to encode the hidden information. Both techniques have their pros and cons. The syndrome encoding quickly fails if we try to determine the optimal number of stego bits that Alice would like to send to Bob. The second technique of encoding stego bits as codewords of an error-correcting code gives gives us a better handle on the steganographic rate and the rate of key consumption. While we have presented these two encodings for a nite sized code block, we would like to extend these ideas to the case whereN is large. In Chapter 5 we present results on the steganographic rate using syndrome encoding in the asymptotic sense. We have pushed the asymptotic results to a later chapter because we need to introduce the notion of the diamond norm. We use this norm to dene the security of our quantum steganographic protocols. Our main aim in constructing a model of classical steganography was to gain intuition on how we can extend our classical model to a quantum one. In the next chapter we present our formalism for quantum steganography. 88 Figure 4.6: Classical Steganographic Protocol. The protocol begins in the top half. Alice's steganographic bits are shown in red. The one-time pad is shown in as green discs. The bold dashed line shows that Alice and Bob are separated over space and Alice uses a BSC to transmit the codeword to Bob. The bits colored red comprise the inner [3,1,3] block code, and the blue discs comprise the [10,1,10] outer block code. The noisy channel ips the fourth and eighth bits. The shared key is used by Alice and Bob to specify the location of the steganographic bits and to generate the one-time pad. 89 Figure 4.7: Three Bits in N Bits Encoding. We plot the channel error-rate p on the X-axis and the average number of transmitted steganographic bits ,N avg , on the Y-axis. Here M refers to the length of the inner code while N refers to the length of the entire block code. The curves in black show the Shannon entropy of the channel with the corresponding block code. 90 Figure 4.8: M Bits in N Bits Encoding. We plot the channel error-rate p on the X-axis and the average number of transmitted steganographic bits , N avg , on the Y-axis. Here M refers to the length of the inner code while N refers to the length of the entire block code. The black curve shows the Shannon entropy of the channel when N = 17 bits. 91 Figure 4.9: Key Consumption Rate. We plot the channel error-rate p on the X-axis and the key consumption rate KCR on the Y-axis. Here p = 0:001; 0:005; 0:01; 0:05, and 0:1. 92 Chapter 5 Quantum Steganography Marvelous, what ideas the young people have these days. But I don't believe a word of it. | Albert Einstein In this chapter we introduce our formalism for quantum steganography. It was impor- tant to establish an intuition, a deep understanding of a classical model of steganography before we could proceed to cast the problem in its quantum form. Considering the num- ber of papers being published in quantum information science each day, it came as a surprise to us that only four papers had been published in this subject area! Before we present our protocols for quantum steganography, we provide a brief history of the work that has been done in quantum steganography by other researchers. Julio Gea-Banacloche introduced the idea of hiding secret messages in the form of error syndromes by deliberately applying correctable errors in a quantum state encoded using the three-bit repetition code, [[3; 1; 3]] [2]. He also discussed the idea of \reverse encoding" to transmit a quantum steganographic message which is obtained by applying a superposition of bit- ip errors on the codeword of the three-bit code. If the receiver Bob knows exactly which error-correcting code was used to encode the quantum state he can read the hidden message in the error syndromes of the code. Eve can monitor the channel and can perform measurements to diagnose errors. The downside to this protocol is that if Eve knows the exact code that Alice and Bob are using then she can measure the codewords and undo the errors introduced by Alice and thereby transmit the wrong steganographic message to Bob. Gea-Banacloche suggested a way around this 93 problem by insisting that Alice and Bob share a secret bit. Alice uses this secret bit to encode her codewords in either of two mutually non-orthogonal bases. If Eve now proceeds to measure the codewords, she will be able to diagnose the correct errors only half of the time, and half of the time she will disturb the state of the codewords which Bob will be able to detect and thereby abort the protocol. One can strengthen this protocol by insisting Alice choose from a larger set of mutually non-orthogonal states rather than just two. In such a case Alice and Bob will have to share a longer secret key, instead of a single bit. One of the central notions in steganography is that a message should look innocent to Eve. We tackle this issue extensively in this thesis, but which Gea-Banacloche does not address in his paper. Curty et. al. propose three dierent quantum steganographic protocols [15]. In the rst protocol they hide bits 0 or 1, by replacing a noisy qubit withj+i orji respectively. In a modied protocol they hide two classical bits into a noisy qubit using super-dense coding. In a third protocol they teleport a steganographic qubit by communicating the classical bits that Bob needs over a classical steganographic channel in order to perform the correct measurement so that he can retrieve the qubit. They do not address the issue of an innocent message, or give key-consumption rates. Natori provides a very rudimentary treatment of quantum steganography which is once again just a slight modication of super-dense coding [37]. Martin introduced the notion of steganographic communication of quantum information in [35]. His protocol is a modication of Bennett and Brassard's quantum-key distribution protocol (QKD). He hides a steganographic channel in the QKD protocol. We can imagine a day when quantum networks become ubiquitous. Quantum steganography could provide a way to embed a stego message into some quantum data of interest which Alice could then send to Bob. Alice could use a few steganographic qubits located at random locations as a \watermark." Both of them could exploit quantum correlations such as entanglement between various steganographic qubits to determine 94 whether the quantum information was tampered by Eve as it passed through a quan- tum channel. An advantage that steganography has over standard encryption schemes is that while users or systems could be communicating over a network through steganog- raphy, this communication could go on for a very long time, completely undetected. In an encryption protocol this is not necessarily the case. Quantum steganography has far-reaching consequences, and it may give us a measure of security which classical steganography may not be able to parallel. We begin by showing how one can hide quantum information in the noise of a depo- larizing channel, using a shared classical secret key between Alice and Bob. In our rst quantum steganographic protocol the channel is intrinsically noiseless (i.e., all noise is controlled by Alice), and in the second case the channel has its own intrinsic noise (not controlled by Alice and Bob). We calculate the amount of secret key consumed. We will later present a quantum steganographic protocol for general quantum channels. We will also look at the question of whether Alice and Bob can send a nite amount of hidden information, or can actually communicate at a nonzero asymptotic rate (given an arbi- trarily large secret key). This depends on Eve's knowledge of the physical channel, and Alice and Bob's knowledge of Eve's expectations. Finally we will address the question of security. This is two-fold: rst, can Eve detect that a secret message has been sent, and second, can she read the message? 5.1 The Depolarizing Channel The quantum analog of the classical binary symmetric channel (BSC) is the depolarizing channel (DC) which is one of the most widely used quantum channel models: !N = (1p) + p 3 XX + p 3 YY + p 3 ZZ : (5.1) 95 That is, each qubit has an equal probability of undergoing anX,Y , orZ error. Applying this channel repeatedly to a qubit will map it eventually to the maximally mixed state I=2. We can rewrite this channel in a dierent but equivalent form: N = (1 4p=3)J + (4p=3)T : (5.2) whereJ = andT = (1=4)( +XX +YY +ZZ). The operationT is twirling: it takes a qubit in any state to the maximally mixed stateI=2. If we rewrite the channel in this way, instead of applying X, Y , or Z errors with probability p=3, we can think of removing the qubit with probability 4p=3, and replacing it with a maximally mixed state. This picture makes the steganographic protocol more transparent. We will rst assume that the actual physical channel between Alice and Bob is noiseless. All the noise that Eve sees is due to deliberate errors that Alice applies to her codewords. (i). Alice encodes a covertext of k c qubits into N qubits with an [[N;k c ]] quantum error-correcting code (QECC). (ii). From (5.2), the DC would maximally mix Q qubits with probability p Q where p Q = N Q (4p=3) Q (1 4p=3) NQ : (5.3) For large N, Alice can send M = (4=3)pN(1) stego qubits, where 1 p (1 4p=3)=(4p=3)N. (The chance of fewer than M errors is negligibly small.) (iii). Using the shared random key (or shared ebits), Alice chooses a random subset of M qubits out of the N, and swaps her M stego qubits for those qubits of the codeword. She also replaces a random number m of qubits outside this subset with maximally mixed qubits, so that the total Q =M +m matches the binomial distribution (5.3) to high accuracy. (iv). Alice \twirls" her M stego qubits using 2M bits of secret key or 2M shared ebits. To each qubit she applies one of I, X, Y , or Z chosen at random, so !T. To 96 Figure 5.1: We plot the key consumption rate (KCR) as a function of the error-rate p of the channel. Eve, who does not have the key, these qubits appear maximally mixed. (Twirling can be thought of as the quantum equivalent of a one-time pad.) (v). Alice transmits the codeword to Bob. From the secret key, he knows the correct subset of M qubits, and the one-time pad to decode them. This protocol transmits (4=3)pN(1) secret qubits from Alice to Bob 5.2. If the channel contains intrinsic noise, Alice will rst have to encode her k s stego qubits in an [[M;k s ]] QECC, swap those M qubits for a random subset of M qubits in the codeword, and apply the twirling procedure. This twirling does not interfere with the error-correcting power of the QECC if Bob knows the key. Assuming the physical channel is also a DC with error rate p, and that Alice emulates a DC with error rate q, the eective channel will appear to Eve like a DC with error rate p +q(1 4p=3)p +p. The rate of transmission k s =N will depend on the rate of the QECC used to protect the stego 97 qubits. For a BSC this would be (1)(1h(p))p=(12p). However, for most quantum channels (including the DC) the achievable rate is not known. The secret key is used at two points in these protocols. First, in step 3 Alice chooses a random subset ofM qubits out of theN-qubit codeword. There areC(N;M) subsets, so roughly log 2 C(N;M) bits are needed to choose one. Next, in step 4, 2M bits of key are used for twirling. This gives us n k log 2 0 @ N M 1 A + 2M (5.4) bits of secret key used. Dene the key consumption rateK =n k =N to be the number of bits of key consumed per qubit that Alice sends through the channel. We useM 4qN=3 and qp=(1 4p=3) to expressK in terms of p, p, and N 4.9: K log 2 h (4=) (1N) 1 i ; 4p=(3 4p) : (5.5) Alice can consume fewer bits of key if Bob and she have access to a source that produces maximally mixed states. This would allow them to bypass the twirling procedure. The protocols given above perform well in emulating a depolarizing channel. However, there are far more general channels than these, and the protocols may not work well, or at all, in these cases. If one has a channel that can be written !N = (1p T +p E )J +p T T +p E E (5.6) whereE is an arbitrary error operation, one can still use the above protocols to hide approximately p T N stego bits or qubits, while generating p E N random errors of type E. But for some channels, p T may be very small or zero. How should we proceed? Moreover, hiding stego qubits locally as apparently maximally-mixed qubits sacrices some potential information. The location of the error|that is, the choice of the subset 98 holding the errors|could also be used to convey information, potentially increasing the rate and reducing the amount of secret key or shared entanglement required. A dierent approach is instead to encode information in the error syndromes. For simplicity, we consider the case when N is large. In this case, it suces to consider only typical errors. We begin with the case where the physical channel is noise-free. For largeN, almost all (in probability, 1) combinations of errors on the individual qubits will correspond to one of the set of typical errors. There are roughly 2 sN of these, and their probabilities p e are all bounded within a range 2 N(s+) p e 2 N(s) . The number s is the entropy of the channel on one qubit; for the BSC s = h(p) = p log 2 p (1p) log 2 (1p), and for the DC s =(1p) log 2 (1p)p log 2 p=3. We label the typical error operatorsE 0 ;E 1 ;:::;E 2 sN 1 , and their corresponding probabilities arep j . A good choice of QECC for the cover text will be able to correct all these errors. We make the simplifying assumption that the QECC is nondegenerate, so each typical error E j has a distinct error syndrome s j . Ahead of time, Alice and Bob partition the typical errors intoC roughly equiprobable sets S k , so that X E j 2S k p j 1 C ; 8k : (5.7) As far as possible, the errors in a given set should be chosen to have roughly equal probabilities. The maximum of C is roughly C 2 N(s) , and k = 0;:::;C 1. We can now present a new quantum steganographic protocol, using error syndromes to store information. (i). Alice prepares k c qubits of cover text in a statej c i. (ii). Alice's secret message is a string of log 2 CN(s) qubits, in a state j s i = C1 X k=0 k jki : (5.8) 99 She \twirls" each qubit of this string, using 2N(s) bits of the secret key or shared ebits, to get a maximally mixed state. To this, she appends Nk c (s)N extra ancilla qubits in the statej0i to make up a total register of Nk c qubits. (iii). Using the shared secret key, Alice chooses from each setS k a typical errorE j k with syndromes j k . She applies a unitaryU S to the register ofNk c qubits, that maps U S jki j0i Nkc(s)N =js j k i. She appends this register to the cover qubits in statej c i, then applies the encoding unitaryU E . Averaging over the secret key, the resulting state will appear to Eve like P 2 nS 1 j=0 p j E j j c ih c jE y j , which is eectively indistinguishable from the channel being emulated acting on the encoded cover text. (iv). Alice sends this codeword to Bob. If Eve examines its syndrome, she will nd a typical error for the channel being emulated. (v). Bob applies the decoding unitary U D =U y E , and then applies U y S (which he knows using the shared secret key). He discards the cover text and the lastNk c (s)N ancilla qubits, and undoes the twirling operation on the remaining qubits, again using the secret key. If Eve has not measured the qubits, he will have recovered the state encoded by Alice. This protocol may easily be used to send classical information by using a single basis state rather than a superposition like (5.8). The steganographic transmission rateR is roughlyR s! s. The rate of transmission s is higher than the rate 4p=3 of our rst protocol. This protocol used 2N(s) bits of secret key (or ebits) for twirling in step 2, and roughly N bits of secret key in choosing representative errors E j k from each set S k in step 3. So the key rate is roughlyK 2s! 2s, better than the rst protocol in key usage per stego qubit transmitted. However, this encoding is much trickier in the case where the channel contains intrinsic noise. In principle this quantum steganographic protocol can be used when the channel contains noise. The steganographic qubits are rst encoded in a QECC to protect them 100 against the noise in the channel. In practice, for many channels this can be dicult: the eects of errors on the space of syndromes look quite dierent from a usual additive error channel. Also, unlike the depolarizing channel, general channels when composed together may change their type. However, by drawing on codes with suitable properties, the problem of designing steganographic protocols for general channels may be simplied. We discuss a simple example in the supporting online material (SOM), but the solution for a general channel is a problem for future work. What is the standard of security for a stego protocol? There are two obvious con- siderations. First, if Eve becomes suspicious, can she read the message? By the use of one-time pads or twirling, Alice and Bob can prevent this from happening. The more important question is, can Alice and Bob avoid arousing Eve's suspicions in the rst place? In order to do this, the messages that Alice sends must emulate as closely as possible the channel that Eve expects. We can make this condition quantitative. Let E C be the channel onN qubits that Eve expects, and letE S be the eective channel that Alice and Bob produce with their steganographic protocol. Then the protocol is secure ifE S is -close toE C in the diamond normkE S E C k for some small > 0. The diamond norm is directly related to the probability for Eve to distinguishE C fromE S under ideal circumstances (i.e., when she can control both the inputs and the outputs), and therefore puts an upper bound on her ability to distinguish them in practice. For a simple example, the dierence between two DCs applied to N qubits has norm N N r N N p = N X j=0 0 @ N j 1 A r j (1r) Nj p j (1p) Nj ; (5.9) where p is the error-rate of the channel Eve expects and r = p +p is the error-rate of the steganographic channel that emulates Eve's expected channel. If we make p < p p(1p)=N then we can make this norm as small as we like, while communicating O(pN) = O( p N) secret qubits. This indicates that even if Eve has exact knowledge of the channel, Alice and Bob can in principle send an arbitrarily large (but nite) 101 amount of information without arousing Eve's suspicion, by choosing a suciently small p and largeN. If Eve's knowledge of the channel is imperfect, Alice and Bob can do even better, communicating steganographic information at a nonzero rate. If Eve is constantly monitoring the channel over a long period of time, and if she has exact knowledge of the channel then she will eventually learn that Alice and Bob are communicating with each other steganographically. Moreover, with constant measurement Eve can disrupt the superpositions of the steganographic qubits and prevent any information from ever reaching Bob, eectively ooding the quantum channel with noise. If Alice and Bob have shared ebits, they can perform measurements on each of their halves and distill correlated random bits. Moreover, with shared ebits Alice can send her quantum information to Bob via quantum teleportation by sending only classical bits through the channel. These classical bits are the result of her measurement on her half of the ebits and her stego qubits. To Eve who may be monitoring the channel, these bits will look maximally mixed (random). For her to change the outcome of what Bob receives on his end, Eve would have to disrupt the bits. So if Eve is measuring the channel continuously, Alice and Bob can still send quantum information to each other using their shared ebits. 5.2 The Diamond Norm In this section we gather the denition of the diamond norm and some of its rele- vant properties to derive the norm of the dierence between N uses of two binary- symmetric channels (BSC) and two depolarizing channels (DC). We refer the reader to John Watrous's lecture notes for the denition and properties of the diamond norm [53]. As mentioned in the main text the diamond norm give us a measure of how \close" or similar two channels can be when they transform an arbitrary density matrix from one Hilbert space to another. More formally letN be some arbitrary super-operator, and 102 letN : L (V)! L (W), where L (:) is a space of linear operators on the Hilbert spaces V andW. Then one can dene the diamond-norm ofN as: kNk I L(V) N tr ; (5.10) wherekNk tr is dened as: kNk tr maxfkN (O)k tr :O2L (V);kOk tr = 1g : (5.11) The maximization in (5.11 is over all density matrices. When the Hilbert space is innite dimensional we take the supremum of the set dened in Denition(5.11). Binary Symmetric Channel Let 0<p< 1=2 be the rate at which Alice ips the qubits of her codeword. Letrp+p be the rate at which the BSC ips qubits, wherep is some additional noise which is not under the control of either Alice or Bob. We assume that 0 < p < r < 1=2 because at p = 1=2 the channel has zero capacity to send information andp> 1=2 means that more qubits are being ipped which is unnatural for this channel. For a single qubit (N = 1) letN p be the BSC that Alice applies to an arbitrary single-qubit density operator : N p = (1p) +pXX ; (5.12) and letN r be the actual BSC N r = (1r) +rXX : (5.13) We can now express the dierence of the two channels as: (N r N p ) = (pr) + (rp)XX (5.14) 103 We can express the diamond norm of the dierence of the channelsN p andN r as: kN r N p k = max k(I (N r N p ))k tr (5.15) = (rp)max k(I I)(I I) (I X)(I X)k tr : (5.16) When we substitute = j0ih0j ( is some arbitrary density operator) in the above equation we achieve the maximum. kN r N p k = (rp)k j0ih0j j1ih1jk tr (5.17) k j0ih0jk tr +j1kj j1ih1jk tr (5.18) = (rp)k k tr kj0ih0jk tr +k k tr kj1ih1jk tr (5.19) = (rp)(1 + 1) (5.20) = 2(rp) (5.21) = 2(p +pp) (5.22) = 2p: (5.23) In Equation (5.18) we use the triangle inequality and in Equation (5.19) we use the fact that for any two linear operators A and B, the trace norm of their tensor product is equal to the product of their trace norms, i.e.,kA Bk tr =kAk tr kBk tr . We would like an expression for the optimal probability to correctly distinguish two channels. P opt = 1 2 + 1 4 kN r N p k : (5.24) So for a single-qubit use P opt = 1 2 (1 +p) : (5.25) For the case where we have two qubits, we can write Alice's BSC as: (N p N p ) = (1p) 2 +p(1p)X 1 X 1 +p(1p)X 2 X 2 +p 2 X 1 X 2 X 1 X 2 ; (5.26) 104 where X 1 X I and X 2 I X, and X 1 X 2 X X. We can similarly calculate N 1 N 1 . We can now write the dierence between the two channels as: (N r N r N p N p ) = (r 2 2r + 2pp 2 ) + (rr 2 p +p 2 )(X 1 X 1 +X 2 X 2 ) + (r 2 p 2 )X 1 X 2 X 1 X 2 : The diamond norm of the dierence between two BSC on two qubits can be expressed as: kN r N r N p N p k = max k(I (N r N r N p N p ))k tr : (5.27) We use a similar construction from the single-qubit case to maximize the right side of Equation (5.27). Letting = j00ih00j we get: kN r N r N p N p k = (1r) 2 (1p) 2 + 2jr(1r)p(1p)j + r 2 p 2 : (5.28) Given our constraints that 0 < p < r < 1=2, the rst term on the right side of Equa- tion (5.28) is negative while the second and third terms are positive. This give us: kN r N r N p N p k = 2(rp)(2rp) (5.29) = 2p(2 2p 2p) : (5.30) So in the double-qubit case P opt is: P opt = 1 2 (1 +p(2 2p 2r)) : (5.31) 105 If we observe Equation( 5.28) carefully we nd that the terms are distributed binomially. For the case where we haveN qubits, we can use = j00 0ih00 0j to maximize the diamond norm for N uses of BSC to get: N N r N N p = N X j=0 0 @ N j 1 A r j (1r) Nj p j (1p) Nj : (5.32) Depolarizing Channel The calculation of the diamond norm of the dierence betweenN uses of two depolarizing channels (DC) is similar to the calculation of BSC that we performed in the previous section. The expression for the channel is N p = (1p) + (p=3 ( XX +YY +ZZ) : (5.33) Eve sees a channel with a somewhat higher rate r = p +p. As in the BSC case we assume that 0<p<r< 1=2. ForN = 2 case the dierence between the two depolarizing channels is: (N r N r N p N p ) = ((1r) 2 (1p) 2 ) + ((1r)(r=3) (1p)(p=3))(X 1 X 1 + +Z 2 Z 2 ) + ((r=3) 2 (p=3) 2 )(X 1 X 2 X 1 X 2 + +Z 1 Z 2 Z 1 Z 2 ) : 106 The density matrix that maximizes the trace norm is = j + ih + j, wherej + i = 1= p 2(j00i +j11i), and is some arbitrary single-qubit density operator. kN r N r N p N p k = (1r) 2 (1p) 2 + 6j(1r)(r=3) (1p)(p=3)j + 9 (r=3) 2 (p=3) 2 = (1r) 2 (1p) 2 + 2j(1r)r (1p)pj + r 2 p 2 : After evaluating the absolute value terms, we get: kN r N r N p N p k = 2(rp)(2rp) (5.34) = 2p 2 2pp : (5.35) So, P opt = 1 2 + 1 2 p 2 2pp : (5.36) For the general case for N uses of the depolarizing channel we may write the diamond norm as: N N r N N p = N X j=0 0 @ N j 1 A r j (1r) Nj p j (1p) Nj ; (5.37) which is exactly the same expression as for the BSC. 107 Achievable Rate for Protocol 2 We will work out the simplest example|the BSC in the case where the physical channel is noise-free. The errors in the codewords that Alice sends to Bob are binomially dis- tributed. Let pN be the mean of this distribution and let the variance be pN, where 0< 1. Here N is the length of each of codeword. Let p k = N k p k (1p) Nk (5.38) be the errors that Alice applies to her codewords. For eachk fromNp(1) toNp(1+) choose C k strings of weight k. Let C = Np(1+) X k=Np(1) C k : (5.39) Let these sets of strings be called S k , and S =[ k S k (5.40) So the total number of strings in the set S is C. Dene the probability q 1=C. Then we want to satisfy qC k = C k =C = p k . Clearly we must have C k N k , for all k. This implies that: C k p k (1p) Nk N k p k (1p) Nk )C k p k (1p) Nk C k q )p k (1p) Nk q 108 We wantC to be as large as possible, which means we wantq to be as small as possible. This constraint then gives us q =p Np(1) (1p) N(1p+p) )C = 1=q )C =p Np(1) (1p) N(1p+p) The number of bits that Alice can send is, therefore M = log 2 C =N(p log 2 p (1p) log 2 (1p) +(p log 2 pp log 2 (1p))) =N(h(p)p log 2 ((1p)=p)) So with this encoding Alice can send almost Nh(p) bits. Diamond norm for protocol 2 Again we consider the simplest case of the BSC. Let N be suciently large so that the total probability of the typical errors is > 1, and these typical errors have weight k in the range Np(1) k Np(1 +). We divide up all errors of weight k into C k partitions containing n k N k C k 1p p kNp(1) errors each. Within each set the errors are all equally likely to be chosen. However, because the number of errors is unlikely to divide exactly evenly into C k sets, the probabilities q k of an error of weight k will be slightly dierent from the probability 109 p k =p k (1p) Nk of the binomial distribution. We can put a (not-very-tight) bound on this dierence: jq k p k j< p k 1p p kNp(1) 1 < 1p 1 2p p 2k (1p) N2k : (5.41) Plugging this into the expression for the diamond norm, we get jjN N p N enc jj < + Np(1+) X k=Np(1)+1 N k jp k q k j < + 1p 1 2p p 1p Np(1) 1 2p + 2p 2 1p N ; (S37) which is exponentially small in N. Error-correction for protocol 2 with a noisy channel Since errors can act in a complicated manner on the space of syndromes, it is not entirely clear what the optimal encoding is even for a simple channel. Here we present one encoding for the BSC that gives an achievable rate in the limit of largeN, but it is quite likely that higher rates are possible. In the noiseless case, it is possible to use the C(N;M) strings of weight M as a code|each string represents one possible weight-M error. If we then apply a BSC with probability p, on average Np bits would be ipped. If NpM then one can keep only a subset of the weight-M strings, separated by a distance > 2Np. This encoding quickly becomes inecient as p gets larger. Using the shared secret key, Alice can instead chose only a subset of the N bits to hold the codewords. If this subset includesN 0 bits, then the errors on the remaining NN 0 bits are irrelevant and do not need to be corrected. The limit of this would be similar to encoding 1 in the paper, where N 0 2M. 110 Let N 0 =qN for some 0<q 1. The number of strings of weight M is C(qN;M), and there will be an average number of bit ips pqN on the relevant portion of the codeword. Keep a subset of these codewords separated by distance 2pqN. Decoding is done by nding the closest codeword to the output string. As N;M!1 then the number of codewords will go like C(N;M;p;q) qN M qN pqN : The number of bits will be log 2 C(N;p;q). Since q is a parameter we can choose freely, we choose it to maximize the rate R(N;M;p;q) (1=N) log 2 C(N;M;p;q). Using the Stirling approximation, dierenti- ating with respect to q, and setting the result equal to 0, we can solve for q: q = M N 2 h(p) 2 h(p) 1 ! : We can then plug this back into the formula forR. If the physical channel has error rate p and Alice is attempting to emulate a channel with error rate p +p, then M = Np=(1 2p). This gives us the following expression for the rate: R(p;p) = p 1 2p log 2 2 h(p) 1 : We can compare this to the rate from encoding 1, which for the BSC is 2p(1h(p))=(1 2p). It is not hard to see thatR(p;p) above approaches this rate asp! 1=2 (and both rates go to zero), but as p! 0 this encoding does considerably better than encoding 1. It is quite likely, however, that there may be even more ecient encodings. 111 5.3 Concluding Remarks We presented two dierent protocols for hiding quantum information in the codewords of a quantum error-correcting code. Using the rst protocol, Alice can hide quantum information in the actual qubits of the QEC, by sharing secret information about the location of the chosen qubits with Bob. In the second protocol she hides quantum information by encoding it into the syndromes of a QEC. In both protocols, she encodes the information in such a way as to match the probability distribution of the depolarizing channel. We generalized how Alice and hide quantum information by using general quantum channels and a general QEC by utilizing typical sequences, it is not immediately clear what sort of encoding will yield an optimal rate for the transmission of quantum information between Alice and Bob. We also presented a rigorous security criterion and showed that it is always possible for Alice to send a nite amount of quantum information to Bob even when the noise is not completely under their control. In the next chapter we present an example of how Alice hides four stego-qubits in to the perfect code and how using a particular encoding she can transmit an optimal number of stego-qubits to Bob without apprising Eve. We essentially cast the problem of encoding as a linear optimization one. 112 Figure 5.2: Quantum Steganographic Protocol. Alice hides her information qubit (solid brown circle) by swapping it in with a qubit of her quantum codeword. She uses her shared secret key with Bob to determine which qubit to swap. She uses the shared key again to twirl the information qubit. She further applies random depolarizing errors to the rest of the qubits of the codeword (shown in green). She sends the codeword through a depolarizing channel to Bob who uses the shared secret to correctly apply the untwirling operation, followed by locating and swapping out Alice's original information qubit. 113 Chapter 6 Hiding Quantum Information in the Perfect Code By this it appears how necessary it is for any man that aspires to true knowledge to examine the denitions of former authors; and either to correct them, where they are negligently set down, or to make them himself. For the errors of denitions multiply themselves, according as the reckoning proceeds, and lead men into absurdities, which at last they see, but cannot avoid, without reckoning anew from the beginning; in which lies the foundation of their errors. For between true science and erroneous doctrines, ignorance is in the middle. Natural sense and imagination are not subject to absurdity. Nature itself cannot err: and as men abound in copiousness of language; so they become more wise, or more mad, than ordinary. Nor is it possible without letters for any man to become either excellently wise or (unless his memory be hurt by disease, or ill constitution of organs) excellently foolish. For words are wise men's counters; they do but reckon by them: but they are the money of fools, that value them by the authority of an Aristotle, a Cicero, or a Thomas, or any other doctor whatsoever, if but a man. |Thomas Hobbes In the previous Chapter 5 we detailed protocols to send quantum steganographic infor- mation from Alice to Bob. In this chapter we give specic examples of the second protocol that we outlined in the previous chapter. In our rst example Alice and Bob use the [[5; 1; 3]] code, which is also called the \perfect" code. It is called perfect because 114 j0i H H j0i H H j0i H H H j0i H H j c i H H Figure 6.1: Encoding circuit for the perfect code. The H gate is a Hadamard gate, and the two-qubit gates are CNOT gates. The rst four qubits are ancilla qubits and the fth qubitj c i is the cover-qubit. it was the rst example of the smallest quantum error-correcting code that could cor- rect an arbitrary single-qubit error. It is a nondegenerate code because each error gets mapped to a unique syndrome. Alice and Bob use this code to hide up to four qubits of information which they send over a channel that to Eve looks like a depolarizing channel. Our second and third examples are based on the six-qubit code and the Steane code, respectively. We end this chapter by showing how we can go to bigger block sizes by combining several ve-qubit blocks. By hiding a qubit of information in each block, we hope that the combined errors from all the smaller block on larger combined block is a typical error. 6.1 Protocol The perfect code is a distance three code and so it can correct up to an arbitrary single- qubit error. It encodes one logical qubit into ve physical qubits. As we mentioned before it is a nondegenerate code and so each single-qubit error is mapped to a unique syndrome. The perfect code has nk = 5 1 = 4 stabilizer generators which we list in Table 6.1, along with the logical operators. Figure 6.1 shows the encoding unitary circuit for the perfect code. We obtained this circuit using the algorithm described in Section 3.6. For the sake of convenience and completeness we reproduce the algorithm below to generate the encoding unitary circuit for the perfect code. We begin by rst 115 g 1 X Z Z X I g 2 I X Z Z X g 3 X I X Z Z g 4 Z X I X Z X X X X X X Z Z Z Z Z Z Table 6.1: Stabilizer generatorsg 1 , . . . ,g 4 , and logical operators X and Z for the perfect code. The convention in the above generators is that Y =ZX. converting the stabilizer generators in Table 6.1 into a binary form which we refer to as a ZjX matrix. We obtain the the left Z submatrix by inserting a \1" wherever we see a Z in the stabilizer generators. We obtain the X submatrix by inserting a \1" wherever we see a corresponding X in the stabilizer generator. If there is a Y in the generator, we insert a \1" in the corresponding row and column of both the Z and X submatrices. The idea is to convert matrix 6.1 to matrix 6.8 through a series of row and column operations. The binary form of the matrix in 6.1 corresponds to the stabilizer generators in Table 6.1. We can use CNOT, Hadamard, Phase, and SWAP gates. (i). When we apply a CNOT gate from qubit i to qubit j, it adds column i to column j in the X submatrix, and in the Z submatrix it adds column j to column i. (ii). A Hadamard on qubit i swaps column i in the Z submatrix with column i in the X submatrix. (iii). A Phase gate on qubit i adds column i in the X submatrix to column i in the Z submatrix. (iv). When we apply a SWAP gate from qubit i to qubit j, we exchange column i with column j in Z submatrix and column i and column j in the X submatrix. Row operations do not change the error-correcting properties of the code. They do not cost us in terms of gates. 116 2 6 6 6 6 6 6 6 4 0 1 1 0 0 0 0 1 1 0 0 0 0 1 1 1 0 0 0 1 1 0 0 1 0 0 1 0 0 1 1 0 1 0 0 0 1 0 1 0 3 7 7 7 7 7 7 7 5 (6.1) Swap rows one and four. 2 6 6 6 6 6 6 6 4 1 0 0 0 1 0 0 1 1 0 0 0 0 1 1 0 1 1 0 0 0 1 0 1 0 0 1 0 0 1 1 0 1 0 0 1 0 0 1 0 3 7 7 7 7 7 7 7 5 (6.2) Apply Hadamard to qubit one and ve. 2 6 6 6 6 6 6 6 4 0 0 0 0 0 0 0 1 1 1 1 0 0 1 0 1 1 1 0 0 1 1 0 1 1 0 1 0 0 0 0 0 1 0 1 0 0 0 1 0 3 7 7 7 7 7 7 7 5 (6.3) Apply CNOT from qubit one to qubit two, four, and ve. 2 6 6 6 6 6 6 6 4 0 0 0 0 0 0 0 1 1 1 0 0 0 1 0 0 1 1 0 0 1 0 0 0 0 0 1 0 0 0 0 0 1 0 1 0 0 0 1 0 3 7 7 7 7 7 7 7 5 (6.4) 117 Apply Hadamard on qubit one and then swap row two with row four. 2 6 6 6 6 6 6 6 4 1 0 0 0 0 0 1 1 0 0 0 0 0 1 0 0 0 1 1 1 0 0 0 0 0 0 0 0 1 0 0 0 1 0 1 0 1 0 0 0 3 7 7 7 7 7 7 7 5 (6.5) Apply Hadamard on qubit two and three, followed by CNOT from qubit two to qubit three and four. 2 6 6 6 6 6 6 6 4 1 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 1 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 1 0 0 3 7 7 7 7 7 7 7 5 (6.6) Now apply Hadamard gate on qubit two, three, and four, followed by CNOT from qubit three to qubit four and ve. 2 6 6 6 6 6 6 6 4 1 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 3 7 7 7 7 7 7 7 5 (6.7) Apply a Hadamard on qubit ve, followed by a CNOT from qubit four and ve, and then ending the operations with a Hadamard on qubit three and four. 2 6 6 6 6 6 6 6 4 1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 3 7 7 7 7 7 7 7 5 (6.8) 118 Figure 6.2: Steganographic protocol to hide four qubits of information using the per- fect code. Based on a classical shared secret key with Bob, Alice hides four qubits, j 1 i;:::;j 4 i by applying the twirling procedure to each of her four qubits and trans- forms each qubit into a maximally mixed state. We call this system the stego subsystem S. The twirling procedure is applied by the yellow box. We label the rst four ancilla qubitsj0i along with the cover-qubitj C i as Alice's subsystem A. The rst unitary U 1 depicted by the blue box is applied to the subsystemsA andS, followed by unitary U 2 . Finally Alice applies the encoding unitaryE to subsystemA and sends it over a channel to Bob. She traces out subsystemS. Bob upon receiving the codeword decodes it by applying the decoding circuitD. He uses the shared secret key to undo the unitary transformationsU 1 andU 2 that were applied by Alice. He nally uses the shared secret key to untwirl the qubits to obtain the stego qubits. We have nally obtained a binary matrix that corresponds to the canonical stabilizer generators in Table 6.1. Multiplying the above operations in reverse takes us from the unencoded canonical stabilizers to the encoded ones. Next we need the syndromes corresponding to single-qubit errors. The perfect code has a total of fteen single-qubit errors. Each of the ve qubits can undergo a single bit- ip error X 1 ;X 2 ;:::; or X 5 , a single phase- ip error Z 1 ;Z 2 ;:::; or Z 5 or a combination of both characterized by Y 1 ;Y 2 ;:::; or Y 5 . We also add the no error operator IIIII to this list. We express X I I I I succinctly as either XIIII or as X 1 , and 119 similarly with the other error operators. We generate the syndrome of each single-qubit error operator by taking the symplectic product of the parity check matrix 6.1 with the binary vector of the error operator corresponding to a single-qubit error. We write the binary vector of an error operator in the same way that we constructed the rows of the parity check matrix 6.1. As an example the binary vector corresponding to XIIII is [00000j10000]. Before we show how to take the symplectic product between a binary matrix and a vector, we must clarify the procedure between two binary vector of length two. Suppose u;v2 (Z 2 ) 2 . Let us employ the shorthand u = [zjx] and v = [z 0 jx 0 ] where z, x, z 0 , x 0 2Z 2 . For example, suppose u = [0j1], and suppose v = [1j0]. Let denote the symplectic product between two elements u;v2 (Z 2 ) 2 : uvzx 0 xz 0 : (6.9) Then based on our example above, the symplectic product between u and v is: [0j1] [1j0] = 0:0 1:1 = 0 1 = 1 (6.10) Let the binary matrix A and the binary vector v be of dimensionsM 2N and 2N 1, respectively. So v is a column vector. Furthermore, let A ij be an element of A indexed by row i and column j. We divide the matrix A into the Z part and the X part which we label as A Z and A X respectively. The Z part of A consists of columns from 1 to N, and its X part consists of columns from N + 1 to 2N. So A Z ij is an element of A belonging to the Z part at row i and column j. Similarly let v Z and v X be the Z and X part of the binary vector v. Rows of v labeled from 1 to N belong to the Z part, whereas rows labeled from N + 1 to 2N belong to the X part. v Z i refers an element of 120 Error Syndrome Error Syndrome IIIII 0000 IIIIZ 0001 IIZII 0010 IIIXI 0011 IXIII 0100 IIXII 0101 ZIIII 0110 IIYII 0111 XIIII 1000 IZIII 1001 IIIIX 1010 IIIIY 1011 IIIZI 1100 IYIII 1101 YIIII 1110 IIIYI 1111 Table 6.2: Syndrome table of the perfect code. The error operators are ordered according to syndrome values. v indexed by row i belonging to the Z part. Let w be the symplectic product of A and v. We calculate each element w i of w as: w i = M X i=1 2N X j=1 A Z ij v X j +A X ij v Z j (6.11) In the above equation it should be clear that in the rst part of the sum the elements of A Z are indexed by j between 1 and N, whereas the elements of v X indexed by i go from N + 1 to 2N. Based on the above equation we can calculate the syndromes of single-qubit errors for the perfect code which we list in Table 6.2. We now detail the steps Alice takes to hide four stego qubits. We label Alice's subsystem asA, and the stego subsystem asS. The initial combinedA andS subsystems after theS subsystem has passed through the twirling procedure is: SA = I 2 S I 2 S I 2 S I 2 S j0000ij C i A h0000jh C j A : (6.12) The maximally mixed state is I=2. If we measure this state, we will get the result '0' with probability 1=2 or we will get the result '1' with probability 1=2. So the results of 121 the measurement are completely random. We can rewrite theS subsystem of the state in Equation(6.12) in the computational basis as: I 4 = 15 X i=0 jkihkj: (6.13) In Equation(6.13), we index the ket states from 0 to 15, but we must think of their binary representation. So for examplej0i isj0000i. When we combine Equation(6.13) with the initial state described by Equation(6.12), we get: SA = 1 16 15 X k=0 jkihkj S j0000ij C i A h0000jh C j A : (6.14) We further simplify the state SA by writing it as: SA = 1 16 15 X k=0 jkihkj S j 0ih 0j A j C ih C j A ; (6.15) wherej 0ij0000i. We dene the rst unitary U 1 shown in the blue box in Figure 6.2 as: U 1 15 X i=0 jiihij S E A i O A i : (6.16) The E i are the error operators listed in Table 6.2, ordered from top to bottom. So E 1 corresponds to the error operator IIIII. We dene the second unitary U 2 depicted by the green box in Figure 6.2 as: U 2 15 X j=0 (X j ) S jjihjj A I A C : (6.17) In Equation(6.17) X j is a shorthand notation for X j 1 X j 2 X j 3 X j 4 , where each j 1 ;:::;j 4 is either 0 or 1. For example, X 0 =X 0 X 0 X 0 X 0 =I I I I. The operator I C acts on the cover-qubit (information qubit)j C i. After Alice applies the unitary U 1 and U 2 , followed by the encoding unitaryE, and the tracing out procedure, 122 she must end up with a channel model that looks plausible to Eve. In this case she is trying to match the depolarizing channel: !N () (1p) + (1p) 4 p 3 4 X i=0 X i X i +Y i Y i +Z i Z i : (6.18) We have taken each error operator E i from Table 6.2 and listed it as a tensor product E i O i in the rst two columns of Table 6.3. We will use this table as we derive the channel model. We write the state that emerges after Alice applies U 1 to SA as: SA 1 U 1 SA U y 1 : (6.19) Alice then applies U 2 , and the subsequent state is: SA 2 U 2 SA 1 U y 2 : (6.20) The encoding unitary that Alice applies is U e =I S U A e : SA e U e SA 2 U y e ; (6.21) followed by tracing out theS subsystem: Tr S SA e = A e !N ( e ) = (1p) e + (1p) 4 p 3 4 X i=0 X i e X i +Y i e Y i +Z i e Z i : (6.22) We claim that the above three unitary transformations and the partial-trace of the S subsystem produces the correct depolarizing channel. We now detail the protocol. Alice and Bob a-priori know which quantum error-correcting code they will be using to send steganographic messages to each other. Alice and Bob also share a classical secret key which is indicated by the bold black lines in Figure 6.2. They require this key for two purposes. First, it allows Alice to twirl an arbitrary stego-qubit into a maximally mixed state. Given an arbitrary density matrix , the twirling operatorT 123 j0i j i j i j0i Figure 6.3: Swap circuit takes ! 1=4( +XX +YYZZ) I=2. Alice and Bob use two bits to determine which of the four operators I;X;Y , or Z to apply. It is important to realize that the twirled state looks maximally mixed to Eve who does not have access to the secret key. Also note that the state that Alice produces is an average state, the result of applying the operators I;X;Y , or Z repeatedly. In this protocol since Alice is hiding four stego- qubits, she and Bob consume eight bits in the twirling procedure. Second, Alice and Bob use the key to select those error operators that have distinct syndromes. These are the operators that go into the construction of the the unitary U 1 in Equation (6.16). The error operatorsE A i O A i are listed in Table 6.3. The intuition behind using the unitaries U 1 and U 2 is that by using them Alice can swap in her stego-qubits with the ancillas of the codeword. They act as generalized swap operators. We depict the usual swap circuit in Figure 6.3. When we swap in an arbitrary qubitj i with an ancilla statej0i we only need two CNOT gates, instead of three. Alice applies U 1 to the initial state SA to get the state SA 1 : SA 1 = 1 16 15 X i;j;k=0 jiihijkihkjjihjj E i j 0ih 0jE y j O i j C ih C jO y j ; = 1 16 15 X i;j;k=0 ik kj jiihjj E i j 0ih 0jE y j O i j C ih C jO y j ; = 1 16 15 X i=0 jiihij E i j 0ih 0jE y i O i j C ih C jO y i : (6.23) 124 E i O i Encoded Error Syndrome i Syndrome Label IIII I IIIII 0000 s 0 IIIX Z IIIIZ 0001 s 1 IIXI I IIZII 0010 s 2 IIXX I IIIXI 0011 s 3 IXII I IXIII 0100 s 4 IXZY Y IIXII 0101 s 5 ZXXI Z ZIIII 0110 s 6 IXYY Y IIYII 0111 s 7 XIII I XIIII 1000 s 8 XZIX I IZIII 1001 s 9 XIXI X IIIIX 1010 s 10 XIXX Y IIIIY 1011 s 11 XXIZ X IIIZI 1100 s 12 XYIX I IYIII 1101 s 13 YXXI Z YIIII 1110 s 14 XXXY X IIIYI 1111 s 15 Table 6.3: Encoded error operators of the perfect code. Next Alice applies the unitary U 2 to the state SA 1 : SA 2 = 1 16 15 X i;k;l=0 X k jiihijX l hkjE i j 0ih 0jE y i jlijkihlj O i j C ih C jO y i ; (6.24) = 1 16 15 X i;k;l=0 X k jiihijX l hkjiihijlijkihlj O i j C ih C jO y i ; (6.25) = 1 16 15 X i;k;l=0 X k jiihijX l ki il jkihlj O i j C ih C jO y i ; (6.26) = 1 16 X i X i jiihijX i jiihij O i j C ih C jO y i ; (6.27) = 1 16 15 X i=0 j 0ih 0j jiihij O i j C ih C jO y i ; (6.28) = 1 16 15 X i=0 j 0ih 0j (E i O i )j 0ih 0j j C ih C j (E i O i ) y : (6.29) 125 As mentioned before these error operators appear in Table 6.3. In Equation (6.25) we see that eachE i transformsj0i to the corresponding syndromejii. Also recall that j 0ij0000i. Alice nally applies the encoding unitary U e to SA 2 : SA e = 1 16 15 X i=0 j 0ih 0j S U A e (E i O i )j 0ih 0j j C ih C j (E i O i ) y (U A e ) y ; = 1 16 15 X i=0 j 0ih 0j S U A e (E i O i ) (U A e ) y U A e j 0ih 0j j C ih C j(U A e ) y U A e (E i O i ) y (U A e ) y ; = 1 16 15 X i=0 j 0ih 0j S U A e (E i O i ) (U A e ) y A e U e (E i O i ) y (U A e ) y ; = 1 16 15 X i=0 j 0ih 0j S E e i e (E e i ) y : (6.30) Alice nally traces out the stego subsystem: Tr S SA e = 1 16 15 X i=0 h 0j 0iE e i e (E e i ) y ; = 1 16 15 X i=0 E e i e (E e i ) y : (6.31) So nally: A e = 1 16 15 X i=0 E e i e (E e i ) y ; (6.32) where e is a codeword of the perfect code. The rst encoded error operator (column three) in Table 6.3 is IIIII. To plausibly use the ve-qubit code, the error rate p must be suciently low that it is rare for more than one single-qubit error to occur. So if Eve intercepts this state and checks the error syndromes, the result should look reasonable for a codeword that has passed through the depolarizing channel. 126 6.2 Average rate of steganographic transmission While the encoding given in the previous section is reasonable for encoding stego-qubits in a single codeword, it would not do if Alice wants to send many messages to Bob. It would quickly look suspicious if almost every codeword had exactly one single-qubit error. For longer messages, Alice must most often apply no errors, from time to time apply a single error, and perhaps occasionally apply two errors (an uncorrectable error), in such a way as to match the statistics of a depolarizing channel with error probability p. In this section we present details of how Alice optimizes the number of stego-qubits that she sends to Bob by encoding her stego-qubits in the syndromes of the perfect code. She either sends no stego-qubits to Bob (and applies no errors to the codeword) or she sends four stego-qubits to him (applying either one or two errors). We would like to maximize the number of stego-qubits that Alice can send to Bob under the constraint that Alice's encoding scheme should match the probability distribution of the depolarizing channel. The channel model that we are interested in is: N () (1p) 5 + p(1p) 4 3 4 X i=0 X i X i +Y i Y i +Z i Z i + p 2 (1p) 3 9 X i<j X i X j X i X j + X i Y j X i Y j +X i Z j X i Z j +Y i X j Y i X j +Y i Y j Y i Y j +Y i Z j Y i Z j +Z i X j + Z i X j +Z i Y j Z i Y j +Z i Z j Z i Z j : (6.33) There are of course three, four, and ve qubit errors, but it is very unlikely that such errors will occur, and so we neglect them for this paper. The techniques we give here could easily be used to nd stego-encodings for those cases as well; but it might appear suspicious if Alice and Bob used an encoding that frequently suered uncorrectable errors. 127 We use three distinct classes of encodings. The rst class corresponds to no errors, and transmits no hidden information. This always has the syndrome s 0 0000 in Table 6.3. Alice's second encoding class corresponds to all single-qubit errors, plus no error, with equal probability. These are the syndromes s 0 0000 to s 15 1111 in the same table. This is the encoding described in the previous section. So this encoding class includes a single encoding, and transmits four stego-qubits. The third encoding class corresponds to the set of all two-qubit errors. There are ninety such errors. These ninety two-qubit errors naturally divide into six sets of fteen errors each, where each set has one error corresponding to each of the fteen nonzero syndromes. By also including the \no error" operator, each set corresponds to an encod- ing that can transmit four stego-qubits. We list these six sets in Table 6.4. When Alice sends four stego-qubits to Bob, she must use all sixteen distinct syndromes. A single row of this table, spanning all sixteen syndromes, corresponds to a single encoding. Each encoding proceeds exactly as described above for the single-error case, except that the operatorsE i andO i from Table 6.4 are used in Eq. (6.16) instead of those from Table 6.3. We now need to solve for how often the three classes of encodings should be used to match the channel statistics. Let Q 0 be the fraction of times Alice uses the (trivial) rst encoding class; Q 1 the fraction of times that Alice uses the second (single-error) encoding class; and Q 2 the fraction of times that Alice uses one of the six two-error encodings (which should be used equally often). The channel distribution constraints are as follows: p 0 = (1p) 5 =Q 0 + 1 16 (Q 1 +Q 2 ); (6.34) p 1 = 5p(1p) 4 = 15 16 Q 1 ; (6.35) p 2 = 10p 2 (1p) 3 = 15 16 Q 2 : (6.36) 128 In the channel constraint equations above, p 0 ;p 1 , and p 2 represent the total probability of the channel applying no errors, one error, or two errors on the codewords. The right-hand-side of the equations represent how Alice matches the channel's probability distribution. For example, she always applies no errors if she uses the rst (trivial) encoding, and with probability 1=16 if she uses one of the other encodings. We solve for Q 0;1;2 to get: Q 0 = p 0 (p 1 +p 2 )=15; Q 1 = (16=15)p 1 ; (6.37) Q 2 = (16=15)p 2 : Note that these numbers do not add up to 1, because we have neglected errors of weight three or more. For small p they will come close. The average number of stego-qubits that Alice can send to Bob under the above constraints isN avg = 4(Q 1 +Q 2 ) = (64=15)(p 1 +p 2 ). We plot this function in Figure 6.4, along with the Shannon entropy of the channel (which is the maximum possible rate at which stego information could be sent). Note that this curve only makes sense for fairly small values of p; for higher values, it no longer makes sense to neglect higher-weight errors. 6.3 Key Consumption We dene the key consumption rate as the number of classical bits of key consumed by Alice and Bob per qubit block. Alice can send an N-qubit block to Bob by combining N=5 ve-qubit blocks together. How much shared secret key do Alice and Bob require to send steganographic information to each other? In Section 6.2 we dened Q 0 as the probability of Alice using the rst encoding to send no stego-qubits to Bob. The probability of using the second encoding is Q 1 , when Alice applies single errors to her 129 Figure 6.4: The red curve shows the Shannon entropy of the binary-symmetric channel. The blue curve underneath the entropy curve is the rate of steganographic information maximized for various values of the error-rate p of the channel. In the limit of large N, encoding in a single large block (rather than multiple sub-blocks) can achieve a rate of steganographic transmission approaching the Shannon entropy [44]. For small p one doesn't do too much worse using multiple nite-sized code blocks. codewords. Alice and Bob can also use two-error encodings to send four qubits to each other, of which there are a total of six as shown in Table 6.4. We assume that each of these six encodings are equiprobable, each with probabilityQ 2 =6. Therefore, there are a total of eight dierent encodings that Alice and Bob must choose from in order to send steganographic information to each other. For a single ve-qubit block, Alice and Bob must share three classical bits to specify which of the eight encodings has been used. They also require an extra eight bits for Alice to construct her four twirled qubits and for Bob to untwirl these qubits once he receives the steganographic information. So Alice and Bob would consume twelve classical secret key bits for each ve-qubit block, if they encode one block at a time, and 130 so for an N-qubit block they would consume at most 12N classical bits of key|not a very economical protocol. In fact, it would be less than that, since Alice needs no key bits to do twirling for the rst, trivial, encoding. Taking this into account, the total key consumption rate would be (3 + 8(Q 1 +Q 2 ))=5 secret key bits per qubit. However, Alice and Bob can do much better than this by encoding into multiple block at once. In the limit of largeN, the number of bits that they require to specify the key is given by the Shannon entropy of the probability distribution of the three dierent encodings. This gives us a key usage rate of K = 1 5 (Q 0 log 2 Q 0 Q 1 log 2 Q 1 Q 2 log 2 Q 2 =6) (6.38) key bits per qubit. For small p this dramatically outperforms the rate for encoding one block at a time. 131 Table 6.4: Table of two-qubit errors. Syndrome i E i O i Encoded Error IIIII IIIII IIIII IIIII 0000 IIIII IIIII IIIII IIIII IIIII IIIII IIIII IIIII IZIXI XZIII IIZYY IXXII 0001 ZIZYX ZIYII IIIXI IIZXI ZIIYY YIIYI IZIYX IYIZI ZIXIZ XZIII IZXZX IYIYI 0010 ZIXZY YIIZI IIXIX XIIIX IZXIY IZIIY IIXIZ IIIXZ ZZXXZ YYIII ZIYYX ZIXII 0011 IIYYY IXYII IZXXX IZIIX IIXXY XIIIY Continued on next page 132 Table 6.4: Continued from previous table Syndrome i E i O i Encoded Error IIXXZ IIZIZ ZXIIZ ZIZII IXZZY IIYXI 0100 IXIZX XIIZI ZXIIY YIIIX IXIZZ IIIYY IXZZX IIXIZ IYIXI XYIII ZXIXZ ZIIXI 0101 IYIYX IZIZI IXIYI IIIYX ZXIXX YIIIY IXIXZ IXIIZ IXXII IXZII IXYZY IIXXI 0110 IYXZX IZIYI IXXZI IIIZX IYXIY IIIYY IXYZX IIYIZ ZYXXZ YZIII IXXXI IXIXI 0111 IXXYX XIIYI IYXXX IYIIX IXXYZ IIIZY Continued on next page 133 Table 6.4: Continued from previous table Syndrome i E i O i Encoded Error ZXXXI ZIIIZ XZZZY IYXII XIZIZ IIYYI 1000 XIIZX IXIZI XIIIX IIZIX XIIIY IIIXY XZIIZ IZIIZ YIZYX YIYII YIIYY ZIIYI 1001 XIZXZ IIXZI XIIXX IIIXX XIIXY IIZIY XIIXZ XIIIZ YIXIZ YXIII XZYZY IYYII 1010 XIXII XIZII XZXII IZIXI XIYIZ IIXYI YIXZY ZIIZI YZXXZ ZYIII YIYYX YIXII 1011 XZXXI IZZII XIXXI XIIXI XIXYX IXIYI Continued on next page 134 Table 6.4: Continued from previous table Syndrome i E i O i Encoded Error XIYXZ IIYZI XXIII XXIII XYZZY IZXII 1100 YXIIZ YIZII YXIIY ZIIIX XXZZI IIYIY XYIIZ IYIIZ XXZYY XIXII YXIXZ YIIXI 1101 XXIYX IIZYI XXZYZ IIYIX YXIXX ZIIIY XXIYY IIIZZ XYYZY IZYII XYXII IYIXI 1110 XXXZX IIZZI XXXIX IXIIX XXYZI IIXIY XXXZY IIIYZ YYXXZ ZZIII XXYYY XIYII 1111 XYXXI IYZII XXYYZ IIXIX XXXXY IXIIY Continued on next page 135 Table 6.4: Continued from previous table Syndrome i E i O i Encoded Error YXXXI YIIIZ 136 Chapter 7 Conclusion and Future Directions When I examine myself and my methods of thought, I come to the conclusion that the gift of fantasy has meant more to me than any talent for abstract, positive thinking. |Albert Einstein In this thesis we have made two contributions to quantum information science. We augmented the theory of quantum error-correcting codes by bridging the gap between the perfect code and the Steane code. We provided a new proof technique on how to show that the Steane code is the smallest CSS code that can correct an arbitrary single- qubit error. We also showed how to convert the six-qubit code into a subsystem code. We hope that in the future this code will serve as a good test-bed to protect quantum computers from the debilitating eects of decoherence. Our second major contribution to QIS is the development of the theory of quantum steganography. We introduced a broad theory of quantum steganography but in the future we would like to explore the kinds of quantum error-correcting codes and encodings that will give good rates for steganographic communication between Alice and Bob under dierent noise models such as, depolarizing noise, dephasing noise, and general noise operators. In the current model we assume that the eavesdropper (Eve) is limited to only observing the channel and performing non-demolition measurements of the quantum codewords. While the above is a useful starting point, one can think about other equally impor- tant and valid scenarios. It may be reasonable to consider a couple of models of Eve: the maximally powerful, limited by physics and information theory, and the more realistic, 137 limited by computational power and nite information. We can set up the problem as containing only three parties, Alice, Bob, and Eve. But in a realistic situation, Eve may simultaneously be monitoring communications between a large number of parties | for instance, an entire network. In this situation, Eve may have no reason to be suspicious of Alice and Bob more than anyone else. The desire to keep this network running eciently may lead to some limitations on what Eve will and/or can do. Eve must allow communication, or she could just shut the channel down. If she intercepts and demands authentication for every communication, this makes quantum communica- tion impossible. Therefore, she can only intercept and demand authentication for some fraction of the messages, chosen at random. Without blocking the message, though, she could still check the error syndromes. She could do this every time, or some fraction of the time, which could be the same fraction with which she demands authentication, or a dierent fraction. She could just check the syndromes, or she could actually perform error-correction. There may be other set-ups as well in which there might not be an Eve per se. Suppose that there are two \innocent" communicators, April and Bill, and two \secret" communicators, Alice and Bob. Alice and Bob want to piggyback secret com- munication on top of April and Bills messages. So after April sends her codeword, Alice intercepts it, adds in secret information in a way that will look like noise and sends it on. Bob could get it either before Bill does (in which case he might extract the information and try to erase all evidence that it was there), or afterwards (in which case he might get it after Bill has performed error-correction and discarded the ancillas). Another scenario is when Eve is not necessarily an adversary, but a \helpful" network. For instance, there may be quantum repeater stations that correct and forward the quantum information. If Alice and Bob know how the quantum repeaters work, might they be able to sneak through some extra information that was not removed in the correction? What is the capacity of quantum steganographic protocols between three parties, Alice, Bob, and Charlie? We do not know the answer to these questions and we believe that they are worth exploring. 138 We would also like to explore where quantum steganography ts in with quantum Shannon theory. Could a combination of some primitive quantum information-theoretic protocols in quantum Shannon theory when combined with steganography give rise to novel and interesting new insights? Can one treat quantum steganography as a new quantum information science primitive? Quantum steganography is rich in open prob- lems, and there is clearly a need to develop this theory further because once we do have commercially available quantum networks, there will be a need for private communi- cation. We hope that in time this theory will become a subeld of quantum Shannon theory. We also hope that in the near future experimentalists will be able to test our protocols in the laboratory. 139 Bibliography [1] P. Aliferis and A. W. Cross Subsystem Fault Tolerance with the Bacon-Shor Code.. Physical Review Letters, 98(22):220502|220506, 2007. [2] J. Gea-Banacloche. Hiding messages in quantum data. Journal of Mathematical Physics, 43:4531|4537, 2002. [3] P. Benio. The computer as a physical system: A macroscopic quantum mechanical hamiltonian model of computers as represented by turing machines. Journal of Statistical Physics, 22(5):563{591, May 1980. [4] C. H. Bennett Logical reversibility of computation. IBM Journal of Research and Development, 17:525, 1973 [5] C. H. Bennett and G. Brassard. Quantum cryptography: Public key distribution and coin tossing. In Proceedings of IEEE International Conference on Computers Systems and Signal Processing, pages 175{179, Bangalore, India, December 1984. [6] C. H. Bennett and S. J. Wiesner. Communication via one- and two-particle operators on einstein-podolsky-rosen states. Physical Review Letters, 69(20):2881{2884, Nov 1992. [7] C. H. Bennett, G. Brassard, C. Cr epeau, R. Jozsa, A. Peres, and W. K. Wootters. Teleporting an unknown quantum state via dual classical and einstein-podolsky- rosen channels. Physical Review Letters, 70(13):1895{1899, Mar 1993. [8] C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, and W. K. Wootters. Mixed-state entanglement and quantum error correction. Physical Review A, 54(5):3824|3851, 1996. [9] G. Bowen. Entanglement required in achieving entanglement-assisted channel Phys- ical Review A, 66(5):052313|052321, 2002. [10] T. A. Brun, I. Devetak, and M. Hsieh. Catalytic quantum error correction. arXiv:quant-ph/0608027, 2006. 140 [11] T. A. Brun, I. Devetak, and M. Hsieh. Correcting Quantum Errors with Entangle- ment. Science, 314(5798):436|439, 2006. [12] T. A. Brun, I. Devetak, and M. Hsieh General entanglement-assisted quantum error- correcting codes. Proceedings of the IEEE International Symposium on Information Theory, June 2007. [13] A. R. Calderbank, E. M. Rains, P. W. Shor, and N. J. A. Sloane. Quantum error cor- rection via codes over GF(4). IEEE Transactions on Information Theory, 44:1369| 1387, 1998. [14] A. R. Calderbank and P. W. Shor. Good quantum error-correcting codes exist. Physical Review A, 54(2):1098|1105, Aug 1996. [15] M. Curty and D. J. Santos. Protocols for quantum steganography. 2 nd Bielefeld Workshop on Quantum Information and Complexity, 12, 2004. [16] D. Deutsch Quantum theory, the Church-Turing principle and the universal quan- tum computer. Proceedings of the Royal Society of London A, 400:97|117, 1985. [17] J. Eisert and M. B. Plenio. Introduction to the basics of entanglement theory in continuous-variable systems. International Journal of Quantum Information, 1:479, 2003. [18] T. ElGamal. A public-key cryptosystem and a signature scheme based on discrete logarithms. IEEE Transactions on Information Theory, 31(4):469|472, 1985. [19] D. Fattal, T. S. Cubitt, Y. Yamamoto, S. Bravyi, and I. L. Chuang. Entanglement in the stabilizer formalism. arXiv:quant-ph/0406168, 2004. [20] R. P. Feynman. Simulating physics with computers. International Journal of The- oretical Physics, 21:467{488, 1982. [21] G. Gilbert, M. Hamrick, Y. S. Weinstein, V. Aggarwal, and A. R. Calder- bank. A Universal Operator Theoretic Framework for Quantum Fault Tolerance. arXiv:quant-ph/0709.0128, 2007. [22] D. Gottesman. Stabilizer Codes and Quantum Error Correction. arXiv:quant- ph/9705052, 1997. [23] D. Gottesman. Class of quantum error-correcting codes saturating the quantum Hamming bound. Physical Review A, 54(3):1862|1868, 1996. [24] M. Hein, W. D ur, J. Eisert, R. Raussendorf, M. V. den Nest, and H. J. Briegel. Entanglement in graph states and its applications. Proceedings of the International School of Physics \Enrico Fermi" on \Quantum Computers, Algorithms and Chaos" (arXiv:quant-ph/0602096), July 2005. [25] Herodotus. The Histories. Penguin Books, 1996. 141 [26] M. Hsieh, I. Devetak, T. A. Brun. General entanglement-assisted quantum error- correcting codes. arXiv:quant-ph/0708.2142. [27] A. Klappenecker and P. K. Sarvepalli. On Subsystem Codes Beating the Hamming or Singleton Bound. arXiv:quant-ph/0703213. [28] E. Knill, R. La amme, and L. Viola. Theory of Quantum Error Correction for General Noise. Physical Review Letters, 84(11):2525|2528, 2000. [29] D. Kribs, R. La amme, and D. Poulin. Unied and Generalized Approach to Quan- tum Error Correction. Physical Review Letters, 94(18):1880501|180505, 2005. [30] R. La amme, C. Miquel, J. P. Paz, and H. W. Zurek. Perfect quantum error- correcting code. Physical Review Letters, 77(1):198|201, 1996. [31] R. Landauer. Uncertainty principle and minimal energy dissipation in the computer. International Journal of Theoretical Physics, 21:283{297,1982. [32] S. Lang. Undergraduate Algebra. Springer, 2005. [33] S. Lloyd. Universal quantum simulators. Science, 273(5278):1073{1078, 1996. [34] Y. Manin. Computable and uncomputable. Sovetskoye Radio, 1980. [35] K. Martin. Steganogrphic communication with quantum information. Lecture Notes in Computer Science, 4569, 2008. [36] N. D. Mermin. Quantum Computer Science. Cambridge University Press, 2007. [37] S. Natori. Why quantum steganography can be stronger than classical steganogra- phy. Quantum Computation and Information, 102, 2006. [38] M. A. Nielsen and I. L. Chuang. Quantum Computation and Quantum Information. Cambridge University Press, 2000. [39] D. Poulin. Stabilizer Formalism for Operator Quantum Error Correction.. Physical Review Letters, 95(23):230504|230508, 2005. [40] R. Raussendorf and H. J. Briegel. A one-way quantum computer. Physical Review Letters, 86(22):5188{5191, 2001. [41] R. L. Rivest, A. Shamir, L. Adleman. A method for obtaining digital signatures and public-key cryptosystems. Communnications of the ACM, 21:120|126, 1978. [42] A. Shabani and D. A. Lidar. Linear Quantum Error Correction. arXiv:quant- ph/0708.1953. [43] C. E. Shannon. A mathematical theory of communication. Bell System Technical Journal, 27:379{423, 1948. 142 [44] B. A. Shaw and T. A Brun. Quantum Steganography. arXiv:quant-ph/1006.1934v1, 2010. [45] P. W. Shor. Algorithms for quantum computation: Discrete logarithms and fac- toring. In Proceedings of the 35th Annual Symposium on Foundations of Computer Science, pages 124{134, Los Alamitos, CA, 1994. IEEE Computer Society Press. [46] P. W. Shor. Polynomial-time algorithms for prime factorization and discrete loga- rithms on a quantum computer. SIAM Journal on Scientic Computing, 26:1484, 1997. [47] P. W. Shor. Scheme for reducing decoherence in quantum computer memory. Phys- ical Review A, 52(4):R2493{R2496, 1995. [48] D. R. Simon. On the power of quantum computation. In Proceedings, 35 th Annual Symposium on Foundations of Computer Science, 116|123, 1994. [49] G. J. Simmons. The prisoner's problem and the subliminal channel. Advances in Cryptology|CRYPTO 83, 51|67, 1983. [50] A. Steane. Error-correcting codes in quantum theory. Physical Review Letters, 77(5):793|797, 1996. [51] J. Trithemius. Steganographia. First printed edition, Frankfurt, 1606. [52] A. Turing. On Computable numbers, with an application to the Entscheidungsprob- lem. Proceedings of the London Mathematical Society, 42:230|265, 1937. [53] J. Watrous. Lectures notes on the theory of quantum information, 2008. [54] S. Wiesner. Conjugate Coding. Association of Computing Machinery, Special Inter- est Group in Algorithms and Computation Theory, 15:78|88,1983. [55] M. M. Wilde and T. A. Brun. Entanglement-Assisted Quantum Convolutional Coding. arXiv:quant-ph/0712.2223, 2007. [56] M. M. Wilde, H. Krovi, and T. A. Brun. Convolutional Entanglement Distillation.. arXiv:quant-ph/0708.3699, 2007. [57] M. M. Wilde, H. Krovi, and T. A. Brun. Entanglement-Assisted Quantum Error Correction with Linear Optics. Physical Review A, 76(5):052308|052316, Nov 2007. [58] Mark M. Wilde. Quantum Coding with Entanglement. arXiv:quant- ph/0806.4214v1, 2008. 143

Abstract (if available)

Abstract Quantum error-correcting codes have been the cornerstone of research in quantum information science (QIS) for more than a decade. Without their conception, quantum computers would be a footnote in the history of science. When researchers embraced the idea that we live in a world where the effects of a noisy environment cannot completely be stripped away from the operations of a quantum computer, the natural way forward was to think about importing classical coding theory into the quantum arena to give birth to quantum error-correcting codes which could help in mitigating the debilitating effects of decoherence on quantum data. We first talk about the six-qubit quantum error-correcting code and show its connections to entanglement-assisted error-correcting coding theory and then to subsystem codes. This code bridges the gap between the five-qubit (perfect) and Steane codes. We discuss two methods to encode one qubit into six physical qubits. Each of the two examples corrects an arbitrary single-qubit error.

Linked assets

University of Southern California Dissertations and Theses

Conceptually similar

PDF

Applications of quantum error-correcting codes to quantum information processing

PDF

Open quantum systems and error correction

PDF

Quantum coding with entanglement

PDF

Quantum error correction and fault-tolerant quantum computation

PDF

Protecting Hamiltonian-based quantum computation using error suppression and error correction

PDF

Applications and error correction for adiabatic quantum optimization

PDF

Error correction and quantumness testing of quantum annealing devices

PDF

Dynamical error suppression for quantum information

PDF

Lower overhead fault-tolerant building blocks for noisy quantum computers

PDF

Topics in quantum cryptography, quantum error correction, and channel simulation

PDF

Quantum computation and optimized error correction

PDF

Topics in quantum information and the theory of open quantum systems

PDF

Towards efficient fault-tolerant quantum computation

PDF

Error suppression in quantum annealing

PDF

Quantum feedback control for measurement and error correction

PDF

Error correction and cryptography using Majorana zero modes

PDF

Entanglement-assisted coding theory

PDF

Demonstration of error suppression and algorithmic quantum speedup on noisy-intermediate scale quantum computers

PDF

Towards optimized dynamical error control and algorithms for quantum information processing

PDF

Towards robust dynamical decoupling and high fidelity adiabatic quantum computation

Asset Metadata

Creator Shaw, Bilal A. (author)

Core Title Quantum steganography and quantum error-correction

School Viterbi School of Engineering

Degree Doctor of Philosophy

Degree Program Computer Science

Publication Date 08/05/2010

Defense Date 06/29/2010

Publisher University of Southern California (original), University of Southern California. Libraries (digital)

Tag hiding messages,information theory,OAI-PMH Harvest,quantum error-correction,quantum physics,Shannon,stabilizer formalism,steganography

Language English

Contributor Electronically uploaded by the author (provenance)

Advisor Brun, Todd A. (committee chair), Lidar, Daniel (committee member), Nakano, Aiichiro (committee member)

Creator Email bilalshaw@gmail.com,bilalshaw@hotmail.com

Permanent Link (DOI) https://doi.org/10.25549/usctheses-m3300

Unique identifier UC1323654

Identifier etd-Shaw-3947 (filename),usctheses-m40 (legacy collection record id),usctheses-c127-369069 (legacy record id),usctheses-m3300 (legacy record id)

Legacy Identifier etd-Shaw-3947.pdf

Dmrecord 369069

Document Type Dissertation

Rights Shaw, Bilal A.

Type texts

Source University of Southern California (contributing entity), University of Southern California Dissertations and Theses (collection)

Repository Name Libraries, University of Southern California

Repository Location Los Angeles, California

Repository Email cisadmin@lib.usc.edu