Quantum encryption

Abstract

The invention relates to a quantum-mechanical encryption key stretching method. The method comprising encoding an input key into a set of quantum mechanical states, scrambling the encoded quantum mechanical states into a larger number of quantum mechanical states and deriving an enhanced encryption key from the larger number of5 quantum mechanical states. The invention also includes methods of encrypting and decrypting data using the enhanced encryption key and method of deriving the enhanced key. A further aspect of the invention relates to a method for encrypting data by encoding the data in a set of quantum mechanical states and performing a scrambling operation on those quantum mechanical states.

Description

[0001] QUANTUM ENCRYPTION

[0002] Technical Field

[0003] The invention relates to the field of encryption using quantum computation.

[0004] Background

[0005] Classical algorithms for encryption often rely on the computational complexity of a problem to make breaking the encryption computationally difficult or infeasible. However, the predicted ability of quantum computers to solve certain problems, such as integer factorization, in significantly less time than classical computers raises concerns about the susceptibility of classical encryption algorithms to attack using quantum computation.

[0006] Summary of the Invention

[0007] A first aspect of the invention relates to a quantum-mechanical encryption key stretching method. The method comprises: obtaining an input encryption key; generating a plurality of intermediate data sequences and determining a probability distribution of the generated intermediate data sequences by repeatedly: encoding the input encryption key in a first set of quantum-mechanical states in a quantum computing system; performing a scrambling quantum computation on the quantum-mechanical states, wherein the scrambling quantum computation comprises generating a second set of quantum mechanical states based on the first set of quantum mechanical state, and wherein the number of quantum-mechanical states in the second set is larger than the number of quantum-mechanical states in the first set; and generating an intermediate data sequence based on the second set of quantummechanical states; selecting a subset of the generated intermediate data sequences; and deriving an enhanced encryption key from the subset of generated intermediate data sequences.

[0008] A second aspect of the invention relates to a method of encrypting a plaintext data sequence. The method comprises deriving an enhanced encryption key according to the method described above and generating a ciphertext data sequence by applying a symmetric encryption algorithm using the enhanced encryption key to the plaintext data sequence.

[0009] A third aspect of the invention relates to a method of decrypting an ciphertext data sequence. The method comprises deriving an enhanced encryption key according to the method described above and generating a plaintext data sequence by applying a symmetric encryption algorithm using the enhanced encryption key to the ciphertext data sequence.

[0010] A fourth aspect of the invention relates to a method of securely transmitting a data sequence over a communication channel. The method comprises generating, at a first device, a ciphertext data sequence by encrypting a plaintext data sequence according to the method described above, transmitting the ciphertext data sequence from the first device to a second device over the communication channel; and deriving, at the second device, the plaintext data sequence by decrypting the received ciphertext data sequence according to the method described above.

[0011] A fifth aspect of the invention relates to a method of encrypting a plaintext data sequence. The method comprises: encoding the data sequence in a set of one or more encoded quantummechanical states of the quantum computing system; performing a scrambling quantum computation on the set of quantum-mechanical states to generate a set of one or more scrambled quantum-mechanical states, wherein the one or more scrambled quantum-mechanical states are superpositions of the encoded quantum-mechanical states; and performing an encryption quantum computation on the scrambled quantummechanical states to generate a set of one or more encrypted quantummechanical states, the encryption quantum computation being based on an encryption key, wherein the set of encrypted quantum-mechanical states corresponds to the encrypted data sequence.

[0012] A sixth aspect of the invention relates to a method of decrypting an encrypted data sequence stored in a set of one or more encrypted quantum-mechanical states, the set of encrypted quantum-mechanical states having been prepared according to the method described above. The method comprises: performing a decryption computation on a set of encrypted quantum-mechanical states, the decryption computation being the inverse of the encryption computation performed in the encryption method using the same encryption key and generating a set of one or more scrambled quantum-mechanical states; and performing a descrambling computation on the set of scrambled quantummechanical states, the descrambling computation being the inverse of the scrambling computation performed in the encryption method and generating a set of one or more encoded quantum mechanical states; decoding an data sequence from the set of encoded quantum-mechanical states by measuring the set of encoded quantum-mechanical states.

[0013] Further aspects of the invention relate to hybrid classical-quantum computers and systems comprising classical and quantum computers that are configured to perform any of the methods described above.

[0014] Still further aspects of the invention relate to computer readable media comprising instructions that when executed cause a hybrid classical-quantum computers or a system comprising classical and quantum computers to perform any of the method described above.

[0015] Further details of the invention are set out in the detailed description and in the claims.

[0016] Brief Description of the Drawings

[0017] Figure 1 A flow chart depicting methods for quantum-mechanical encryption key stretching, and encryption and decryption using the enhanced key.

[0018] Figure 2 A flow chart showing in more detail the process of generating intermediate data sequences according to the method of Figure 1.

[0019] Figure 3 A quantum circuit demonstrating the method of generating an intermediate data sequence according to the methods of Figures 1 and 2.

[0020] Figure 4 A flow chart depicting a method of encrypting a data sequence using a quantum computer and a method of decrypting the encrypted data sequence.

[0021] Figure 5 A schematic diagram of a hybrid classical-quantum computer that may be used to perform the methods of the present invention.

[0022] Detailed Description

[0023] Figure 1 is a flow chart depicting methods for quantum-mechanical encryption key stretching, and encryption and decryption using the enhanced key. Key stretching is a cryptographic technique used to make encryption more secure against a brute force attack by increasing the resources required to test each possible key. An input encryption key is “stretched” to generate an enhanced encryption key, and the enhanced encryption key is used to encrypt data, e.g. using a symmetrical encryption algorithm. The process of generating the enhanced encryption key is a non-trivial operation that can be performed relatively quickly for a single input key but is sufficiently complex that generating a large enough number of enhanced keys to perform a brute force attack on the encrypted data is computationally very expensive.

[0024] A quantum-mechanical analogue to the classical encryption key stretching method is provided by the present invention. A method 100 for quantum-mechanical encryption key stretching begins at step 101 , when an input encryption key is obtained. The input encryption key may be at least 50-bits long in binary representation. The input encryption key may also include the secret and a salt.

[0025] At step 102, a plurality of intermediate data sequences are generated according to the method depicted in the flowchart of Figure 2.

[0026] At step 201 of the method shown in Figure 2, the input encryption key is encoded in a plurality of quantum-mechanical states, referred to as “first set” of quantum-mechanical states. The quantum-mechanical states may be states of qubits, such as superconducting or trapped ion qubits, qumodes in a quantum photonic processor, or any other means of representing and manipulating quantum mechanical states are required by the method of the present invention.

[0027] In one example, where the quantum-mechanical states are the states of qubits, the system on which the method is performed may include at least n qubits, where n is the number of bits in the binary representation of the input encryption key. Each of the n qubits is associated with one of the n bits of the input encryption key. Encoding the input encryption key in the states of the qubits comprises applying single-qubit gates to all qubits where the corresponding bit of the input encryption key is 1 , or alternatively applying single-qubit gates to all qubits where the corresponding bit of the input encryption key is 0.

[0028] As an alternative example, the quantum-mechanical states are a plurality of qumodes, the system on which the method is performed may include at least m qumodes, where m is the number of digits in a base-Z representation of the input encryption key, and I is the number of states used per qumode. Each of the m qumodes is associated with one of the m digits of the base-Z representation of the input encryption key. Encoding the encryption key in the plurality of qumodes comprises squeezing the qumode states with a squeezing parameter for each qumode derived from the normalised digit of the corresponding base-Z representation of the input encryption key.

[0029] As a further alternative, in which the quantum-mechanical states are a plurality of qumodes as described above, encoding the encryption key in the plurality of qumodes may include mapping the initial population of each qumode to the value of the corresponding digit in the base-Z representation of the input encryption key.

[0030] At step 202, a scrambling quantum computation is performed on the first set of quantummechanical states to generate a second set of quantum mechanical states. The number of quantum mechanical states in the second set is larger than the number of quantummechanical states in the first set. Preferably, the number of quantum mechanical states in the second set is at least double than the number of quantum-mechanical states in the first set. The number of quantum mechanical states in the second set may even be polynomially or exponentially larger than the number of quantum-mechanical states in the first set.

[0031] By increasing the number of quantum-mechanical states in the second set compared to the first, the difficulty to simulate the quantum-mechanical scrambling computation using a classical computer increases. Thus, the overall key stretching method is relatively straightforward to perform on a quantum computer, but difficult to perform on a classical computer. The higher the number of quantum-mechanical states in the second set compared to the first set, the more computationally difficult a classical simulation is. Even for relatively small increases in the number of quantum-mechanical states in the second set compared to the first set, the computational complexity of classical simulation may be sufficiently high to provide an effective key stretching algorithm as described above, while preventing breaking of the key stretching algorithm by a quantum computer.

[0032] Where the quantum-mechanical states are the states of qubits, a suitable scrambling algorithm for use in the scrambling computation may be one such as that described in Arute, F., Arya, K., Babbush, R. et al. Quantum supremacy using a programmable superconducting processor. Nature 574, 505-510 (2019). https: / / doLorg / 10.1038 / s41586- 019-1666-5. The scrambling computation may include sampling the output of random or quasirandom quantum circuits, as described in this paper. The random or quasirandom quantum circuits may be applied for at least 10 cycles.

[0033] Where the quantum-mechanical states are qumodes and the input encryption is encoded by the squeezing parameter, the scrambling quantum computation may include performing Gaussian boson sampling on the qumodes. Where the quantum-mechanical states are qumodes and the input encryption is encoded in the population of the qumode, the scrambling quantum computation includes performing boson sampling on the qumodes.

[0034] At step 203, an intermediate data sequence is generated based on the second set of quantum mechanical states. In this context, the intermediate data sequence is classical data that can be processed and stored by a classical computer, e.g. binary data. The intermediate data sequence is obtained from the second set of quantum-mechanical states using a mapping from any general quantum state from the Hilbert space of the second set of quantum-mechanical states to a tractable amount of classical data.

[0035] For example, generating an intermediate data sequence may comprise dividing the second set of quantum-mechanical states into groups of size g, measuring the second set of quantum-mechanical states and deriving a digit value for each group of states based on the measured states, and combining the digit values of each group to form an intermediate data sequence of length q / g, where q is the number of quantum-mechanical states in the second set. As an illustrative example, if q = 60, and g = 6, there are ten groups of six qubits. After the measurement, a 10-bit number may be obtained by mapping the measured state of each group onto a bit.

[0036] Alternatively, where the quantum-mechanical states are qumodes where the input encryption is encoded by the squeezing parameter, the intermediate data sequence may be a binary string obtained by sampling from the matrix Torontonian.

[0037] In a further alternative, where the quantum-mechanical states are qumodes and the input encryption is encoded in the population of the qumode, a photon number resolving measurement may be performed for each qumode in order to generate an intermediate data sequence from the number of photons measured in each qumode.

[0038] Since generating an intermediate data sequence based on the second set of quantummechanical states necessarily involves a measurement step, the intermediate data sequence generated following a single pass of steps 201 , 202 and 203 may be any of the valid intermediate data sequences that can be generated by the mapping from the Hilbert space of the second set of quantum mechanical states to a classical data sequence. For example, in the example described above where a 10-bit number is obtained, there are 210, i.e. 1024, possible intermediate data sequences generated by steps 201 , 202, and 203.

[0039] In order to deterministically derive an enhanced encryption key from the input encryption key, steps 201 , 202 and 203 are performed repeatedly. Since the generation of intermediate data sequences is probabilistic, the set of repeatedly generated intermediate data sequences tends towards a particular set based on the probability distribution of the intermediate data sequences as the number of repetitions increases. Thus, at step 103 of the method 100, a subset of the generated intermediate data sequences is selected, and at step 104, the selected subset is used to generate the enhanced encryption key.

[0040] Selecting the subset of the generated intermediate data sequences at step 103 may include selecting a predetermined number of most probable intermediate data sequences. For example, in the example described above where the intermediate data sequences are 10-bit numbers, the 100 most probable 10-bit numbers may be selected.

[0041] At step 104, the selected subset of generated intermediate data sequences may be combined to derive the enhanced encryption key, e.g. by concatenating the data sequences. Again referring to the example of 10-bit intermediate data sequences, the selected 100 most probably 10-bit numbers may be combined to derive a 10OO-bit enhanced encryption key by, for example, concatenating the 10-bit numbers in a particular order based on their probability. It can therefore be seen that an 60-bit input key has been stretched into a 10OO-bit enhanced encryption key.

[0042] The number of repetitions of steps 201 , 202 and 203 should be high enough that the same subset of generated intermediate data sequences is selected - and the same enhanced encryption key derived - each time the method is used for a given input key. However, slight variation in the subset of generated intermediate data sequences may be acceptable, for example in applications where the validity of an enhanced encryption key used to encrypt some data can be easily tested. If the enhanced encryption key is invalid, then the number of repetitions can be increased until a new enhanced encryption key is generated.

[0043] The number of repetitions of step 201 , 202, 203 may be determined systematically while the method is running, e.g. by deriving the enhanced encryption key after each repetition and stopping the repetitions of steps 201 , 202, and 203 once a predetermined number of repetitions has elapsed without any change in the derived enhanced encryption key, or e.g. by fitting the probability distribution of the intermediate data sequences and stopping the repetitions of steps 201 , 202 and 203 once a predetermined number of repetitions has elapsed without any change in the parameters of the probability distribution above a threshold.

[0044] Referring again to Figure 2, it can be seen that optional steps 204 and 205 may also be performed prior to encoding the input encryption key in the first set of quantum mechanical states at step 201 . Where optional steps 204 and 205 are included in the method, they are performed in sequence with steps 201 , 202 and 203 and are performed every time steps 201 , 202 and 203 are repeated.

[0045] Step 204 may be part of the method when the quantum-mechanical states are qubit states, in which case each of the qubits may be initialised into the known state (e.g. the ground state).

[0046] At step 205, a second scrambling computation may be performed on the initialised quantum-mechanical states before encoding the input encryption key at step 201. The scrambling computation of step 205 may be the same as the scrambling computation of step 202. By performing a second scrambling computation, the quantum computation of step 204, 205, 201 , 202 and 203 may be more difficult to simulate classically than the method of steps 201 , 202 and 203 alone.

[0047] Referring again to Figure 1 , the method 100 may continue after the enhanced encryption key is generated at step 104 with step 105, where the enhanced encryption key is used to encrypt plaintext data to generate ciphertext data. At step 106, the ciphertext data is transmitted over a communication channel to another device. At step 107, the input encryption key is shared with the other device via any secure key exchange method. At step 108, the process of steps 101 to 104 is repeated at the other device to derive the enhanced encryption key from the shared input encryption key, which can be used to decrypt the ciphertext. Alternatively, the enhanced encryption key itself may be shared via any secure key exchange mechanism, in which case it is not necessary to derive the enhanced key again at the other device.

[0048] Figure 3 is a quantum circuit depicting steps 201 , 202 and 203 described above when applied to qubit states. Three qubits q0, q±and q2are shown in Figure 3, but the circuit can easily be generalised to an arbitrary number of qubits by simply adding more qubit lines with the same configuration as those shown. As described above, at step 201 , the input encryption key is encoding in the states of qubits q according to a unitary Uk. At step 202, a scrambling computation is performed on the qubits q according to a unitary US2. At step 203, the qubit states are measured and classical post-processing according to a mapping Acis performed to generate the intermediate data sequence. As described at step 204 (not shown in Figure 3), the qubits q may be initialized in the |0) state. As described at step 205, a second scrambling computation may be performed prior to encoding the input encryption key in the qubit states and may be done by applying a unitary US1, which may be the same as unitary US2.

[0049] Figure 4 is a flowchart showing a method for encrypting a data sequence using a quantum computer. At step 401 , the data sequence to be encrypted, i.e. plaintext data, is encoded in a plurality of quantum-mechanical states. Encoding the plaintext data in quantummechanical states may be performed in the same way as described above for encoding the input encryption key in the quantum-mechanical states in the method 100, including first initializing the quantum-mechanical states in the known state. The quantummechanical states following the encoding process are referred to as “encoded quantummechanical states”. In one example, two classical bits of information may be encoded by three single-qubit states. For example, 00 may be encoded as |0 - +), 01 as |+ + 0), 10 as |- 0 -) and 11 as | 111 . In this way, unauthorised access to any single qubit provides very little useful information. This may be taken advantage of by storing or transmitting these states separately, e.g. via different channels.

[0050] At step 402, a scrambling quantum computation is performed on the encoded quantum mechanical states. The scrambling computation may be any computation that promotes superpositions of the encoded quantum mechanical states, for example those described above with respect to step 102 of the method 100. The scrambling quantum computation generates a plurality of scrambled quantum-mechanical states.

[0051] At step 403, an encryption quantum computation is performed on scrambled quantummechanical states to generate encrypted quantum-mechanical states. The encryption quantum computation is based on an encryption key, for example by applying single-qubit gates to each quantum-mechanical state depending on the bit value in a binary representation of the encryption key. The encrypted quantum-mechanical states encode the input data sequence in such a way that the input data sequence can be recovered as long as the encryption key is known. As such, the encrypted quantum mechanical states correspond to the encrypted data sequence.

[0052] It is possible to recover the plaintext data sequence from the encrypted quantum mechanical states as each of the encoding, scrambling and encryption quantum computations are reversible. The decryption process is depicted in steps 404, 405 and 406 of the method 400 and is the inverse of the encryption process.

[0053] At step 404, a decryption computation is performed on the encrypted quantum-mechanical states. The decryption computation is the inverse of the encryption computation performed at step 403 and uses the same encryption key. The decryption computation generates the scrambled quantum-mechanical states originally generated by the scrambling computation of step 402.

[0054] At step 405, a descrambling computation is performed on the scrambled quantummechanical states generated at step 404. The descrambling computation is the inverse of the scrambling computation performed at step 402 and generates the encoded quantum mechanical states originally generated at step 401 .

[0055] At step 406, the data sequence is decoded from the encoded quantum-mechanical states by measuring the encoded quantum-mechanical states. The measured values of the encoded quantum-mechanical states can then be used to recover the data sequence.

[0056] This form of encryption is exceptionally secure as only a single attempt to decrypt the encrypted quantum mechanical states can be performed, as any measurement will cause a collapse of the superpositions of quantum-mechanical states generated by the scrambling computation and, due to the no-cloning theorem of quantum information, it is impossible to copy the encrypted quantum mechanical states.

[0057] In order to allow for a limited number of genuine attempts to decrypt the encrypted quantum mechanical states, the process of steps 401 , 402 and 403 may be carried out multiple times to generate multiple instances of the encrypted quantum-mechanical states.

[0058] Furthermore, multiple instances of the encrypted quantum-mechanical states may be generated such that the decryption process of steps 404, 405 and 406 can be carried out multiple times. An error correcting code, such as a repetition code, can then be applied to the decrypted data from each decryption process in order to identify and / or correct any errors.

[0059] The encryption method of steps 401 , 402 and 403 may include an additional scrambling computation following the encryption computation, in which case the decryption method of steps 404, 405 and 406 will also include an additional descrambling computation, the inverse of the additional scrambling computation, before the decryption computation.

[0060] Figure 5 depicts exemplary hardware on which the methods described above may operate. A quantum computing system 500 includes a classical processing unit 501 and a quantum processing unit 502. The classical processing unit 501 may perform additional computational tasks as part of the method described above, e.g. step 104 of the method 100 or deriving the data sequence from the measured states following step 406 of the method 400, and may also, or alternatively, be used to control and interact with the quantum processing unit 502. If the classical processing unit 501 is used only to control and interact with the quantum processing unit 502, then the classical processing steps mentioned above may be performed by a separate classical computer, e.g. one connected via a network 503 to the system 500.

Claims

Claims1 . A quantum-mechanical encryption key stretching method, the method comprising: obtaining an input encryption key; generating a plurality of intermediate data sequences and determining a probability distribution of the generated intermediate data sequences by repeatedly: encoding the input encryption key in a first set of quantum-mechanical states in a quantum computing system; performing a scrambling quantum computation on the quantum-mechanical states, wherein the scrambling quantum computation comprises generating a second set of quantum mechanical states based on the first set of quantum mechanical state, and wherein the number of quantum-mechanical states in the second set is larger than the number of quantum-mechanical states in the first set; and generating an intermediate data sequence based on the second set of quantum-mechanical states; selecting a subset of the generated intermediate data sequences; and deriving an enhanced encryption key from the subset of generated intermediate data sequences.

2. The method of claim 1 , wherein the number of quantum-mechanical states in the second set is at least double the number of quantum-mechanical states in the first set.

3. The method of any preceding claim, wherein the quantum-mechanical states are the states of a plurality of qubits.

4. The method of claim 3, wherein the plurality of qubits comprises at least n qubits, where n is the number of bits in the binary representation of the input encryption key, and wherein each of the n qubits corresponds to a different bit of the n-bit binary representation of the input encryption key.

5. The method of claim 4, wherein encoding the input encryption key in the states of the n qubits comprises applying single-qubit gates to a subset of the n qubits, and wherein a single-qubit-gate is applied to a given qubit depending on the binary value of the corresponding bit in the binary representation of the input encryption key.

6. The method of claim 5, wherein: single qubit gates are applied to every qubit where the binary value of the corresponding bit in the binary representation of the input encryption key is 1 ; or single qubit gates are applied to every qubit where the binary value of the corresponding bit in the binary representation of the input encryption key is 0.

7. The method of any of claims 3 to 6, wherein the method further comprises, as part of the repeated process and before encoding the input encryption key in the qubit states: initialising the state of each qubit to the known state; and modifying the plurality of qubit states by performing a second scrambling quantum computation on the qubits.

8. The method of claim 7, wherein the second scrambling quantum computation performed before encoding the input encryption key in the qubit states is the same as the scrambling quantum computation performed after encoding the input encryption key in the qubit states.

9. The method of any of claims 3 to 8, wherein modifying the plurality of quantummechanical states comprises sampling the output of random or quasirandom quantum circuits.

10. The method of claim 9, wherein the random quantum circuits are applied for at least 10 cycles.11 . The method of any preceding claim, wherein the binary representation of the input encryption key comprises at least 50 bits.

12. The method of claim 1, wherein the plurality of quantum-mechanical states comprises at least m qumodes, and wherein each qumode corresponds to a different digit in the base-Z representation of the input encryption key, where m is the number of digits in the base-Z representation of the input encryption key, and whereI is the number of states used per qumode.

13. The method of claim 12, wherein encoding the encryption key in the plurality of qumodes comprises squeezing the qumode states, wherein the squeezing parameter of each qumode is derived from the normalised digit of the corresponding base-Z representation of the input encryption key.

14. The method of claim 13, wherein performing a scrambling quantum computation on the qumodes comprises performing Gaussian boson sampling on the qumodes.

15. The method of claim 12, wherein encoding the encryption key in the plurality of qumodes comprises mapping the initial population of each qumode to the value of the corresponding digit in the base-Z representation of the input encryption key.

16. The method of claim 15, wherein performing a scrambling quantum computation on the qumodes comprises performing boson sampling on the qumodes.

17. The method of claim 14 or 16, wherein generating an intermediate data sequence comprises sampling from the matrix Torontonian.

18. The method of any preceding claim, wherein generating an intermediate data sequence comprises dividing the second set of quantum-mechanical states into groups of size g, measuring the second set quantum-mechanical states and deriving a digit value for each group of states based on the measured states, andcombining the digit values of each group to form an intermediate data sequence of length q / g, where q is the number of quantum-mechanical states in the second set.

19. The method of any preceding claim, wherein selecting the subset of the generated intermediate data sequences comprises selecting a predetermined number of most probable intermediate data sequences.

20. The method of claim 18 or 19, wherein deriving an enhanced encryption key from the subset of generated intermediate data sequences comprises combining the selected intermediate data sequences.21 . The method of claim 20, wherein deriving an enhanced encryption key from the subset of generated intermediate data sequences comprises using a subset of the selected intermediate data sequences.

22. The method of any preceding claim, wherein the input encryption key comprises a secret and a salt.

23. A method of encrypting a plaintext data sequence, the method comprising: deriving an enhanced encryption key according to the method of any preceding claim; and generating a ciphertext data sequence by applying a symmetric encryption algorithm using the enhanced encryption key to the plaintext data sequence.

24. The method of claim 23, wherein the method is performed at a first device and further comprises transmitting or otherwise transferring the input encryption key to a second device via a secure key exchange mechanism.

25. A method of decrypting a ciphertext data sequence, the method comprising: deriving an enhanced encryption key according to the method of any of claims 1 to 22; andgenerating a plaintext data sequence by applying a symmetric encryption algorithm using the enhanced encryption key to the ciphertext data sequence.

26. A method of transmitting a data sequence securely over a communication channel, the method comprising: generating, at a first device, a ciphertext data sequence by encrypting a plaintext data sequence according to the method of claim 23 or 24; transmitting the ciphertext data sequence from the first device to a second device over the communication channel; and deriving, at the second device, the plaintext data sequence by decrypting the received ciphertext data sequence according to the method of claim 25.

27. A method of encrypting a data sequence using a quantum computer, the method comprising: encoding the data sequence in a set of one or more encoded quantum-mechanical states of the quantum computing system; performing a scrambling quantum computation on the set of quantum-mechanical states to generate a set of one or more scrambled quantum-mechanical states, wherein the one or more scrambled quantum-mechanical states are superpositions of the encoded quantum-mechanical states; and performing an encryption quantum computation on the scrambled quantummechanical states to generate a set of one or more encrypted quantum-mechanical states, the encryption quantum computation being based on an encryption key, wherein the set of encrypted quantum-mechanical states corresponds to the encrypted data sequence.

28. A method of decrypting an encrypted data sequence stored in a set of one or more encrypted quantum-mechanical states, the set of encrypted quantum-mechanical states having been prepared according to the method of claim 27, the method comprising: performing a decryption computation on a set of encrypted quantum-mechanical states, the decryption computation being the inverse of the encryption computationperformed in the method of claim 27 using the same encryption key and generating a set of one or more scrambled quantum-mechanical states; and performing a descrambling computation on the set of scrambled quantummechanical states, the descrambling computation being the inverse of the scrambling computation performed in the method of claim 27 and generating a set of one or more encoded quantum mechanical states; decoding an data sequence from the set of encoded quantum-mechanical states by measuring the set of encoded quantum-mechanical states.

29. The method of claim 27 or claim 28, wherein encoding the data sequence, performing a scrambling quantum computation and performing an encryption quantum computation are carried out several times to generate multiple physical instances of the encrypted data sequence.

30. The method of claim 28 and 29, wherein each of the instance of the encrypted data sequence is decrypted according to the method of claim 29 to generate a decoded data sequence, and wherein error correction is applied to the decoded data sequences.31 . The method of any of claims 27 to 30, wherein the method of encrypting the data sequence further comprises applying an additional scrambling quantum computation after performing the encryption computation.

32. The method of claim 31 when dependent on claim 28, wherein an additional descrambling quantum computation is performed before performing the decryption computation.

33. The method of any of claims 27 to 32, wherein the data sequence is larger than the dimension of the individual quantum-mechanical states into which the data sequence is encodedsuch that having access to all or a plurality of the quantummechanical states is required to retrieve the full data sequence.

34. A hybrid classical-quantum computer configured to perform the method of any of claims 1 to 32.

35. A system comprising a classical computer and a quantum computing system configured to perform the method of any of claims 1 to 32.

36. A computer readable medium comprising instructions that, when executed by a hybrid classical-quantum computing system, cause the hybrid classical-quantum computing system to perform the method of any of claims 1 to 32.

37. A computer readable medium comprising instructions that, when executed by a system comprising a classical computer and a quantum computing system, cause the system to perform the method of any of claims 1 to 32.

Images