Information processing device, information processing method, and program

Abstract

Provided is an information processing device comprising: an acquisition unit that acquires a correction key generated by error-correcting random numbers shared by quantum channels, and data indicating a hash function including a specific Toeplitz matrix; a division unit that divides the specific Toeplitz matrix into submatrices each having a size corresponding to the number of rows and / or the number of columns of the specific Toeplitz matrix; and a generation unit that calculates the logical product of each of the submatrices and a portion corresponding to each of the partial matrices of the correction key, and generates a final key having a size further compressed than that of the correction key as privacy amplification processing by exclusive OR for each row of the hash function.

Description

Information processing device, information processing method, and program

[0001] The present disclosure relates to an information processing device, an information processing method, and a program.

[0002] Patent Literature 1 discloses a privacy amplification processing device that performs privacy amplification processing of quantum cryptography in a quantum cryptography communication system. In Patent Literature 1, an i-bit correction key x is multiplied by an n×i-bit (i and n are positive integers, i≦n) first sparse matrix to generate an n-bit modified correction key y. Then, a fast Fourier transform is applied to each of an n-bit random number v and the n-bit modified correction key y, which specify an n×n-bit circulant matrix, and a convolution operation is performed to multiply the n×n-bit circulant matrix by the n-bit modified correction key y. The n-bit bit string obtained as the result of the operation is then multiplied by a k×n-bit (k is a positive integer, k<i≦n) second sparse matrix to generate a k-bit secret key. The technology in Patent Literature 1 can reduce the amount of calculation in so-called privacy amplification processing compared to simple (simple) operations using a Toeplitz matrix (a matrix whose elements are constant along each descending diagonal from left to right).

[0003] JP 2012-049765 A

[0004] However, the technique described in Patent Document 1 leaves room for further improvement, for example, in the calculation process of the Toeplitz matrix.

[0005] In view of the above-mentioned problems, an object of the present disclosure is to provide a technology that can more appropriately execute the calculation of privacy amplification processing.

[0006] In a first aspect of the present disclosure, there is provided an information processing device having: an acquisition unit that acquires a correction key generated by error-correcting a random number shared over a quantum channel and data indicating a hash function including a specific Toeplitz matrix; a division unit that divides the specific Toeplitz matrix into submatrices, each having a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix; and a generation unit that calculates a logical product of each of the submatrices and a portion of the correction key corresponding to each of the submatrices, and generates a final key that is more compact in size than the correction key by performing an exclusive OR on each row of the hash function as a privacy amplification process.

[0007] Furthermore, a second aspect of the present disclosure provides an information processing method for executing a process of acquiring a correction key generated by error-correcting a random number shared over a quantum channel and data indicating a hash function including a specific Toeplitz matrix, dividing the specific Toeplitz matrix into submatrices of a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix, calculating a logical product between each of the submatrices and a portion of the correction key corresponding to each of the submatrices, and generating a final key whose size is more compressed than the correction key as a privacy amplification process by performing an exclusive OR on each row of the hash function.

[0008] In addition, a third aspect of the present disclosure provides a program that causes a computer to execute the following process: acquire a correction key generated by error-correcting a random number shared over a quantum channel and data indicating a hash function including a specific Toeplitz matrix; divide the specific Toeplitz matrix into submatrices, each having a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix; calculate a logical product between each of the submatrices and a portion of the correction key corresponding to each of the submatrices; and generate a final key, which is smaller in size than the correction key, as a privacy amplification process by performing an exclusive OR on each row of the hash function.

[0009] According to one aspect, the privacy amplification processing can be performed more appropriately.

[0010] 1 is a diagram showing an example of the configuration of an information processing device that performs generation processing according to an embodiment. FIG. 2 is a diagram showing an example of the configuration of a quantum key distribution system according to an embodiment. FIG. 3 is a diagram showing an example of the hardware configuration of an information processing device according to an embodiment. FIG. 4 is a diagram showing key distillation processing of QKD according to an embodiment. FIG. 5 is a flowchart showing an example of privacy amplification processing of the information processing device 10 according to an embodiment. FIG. 6 is a diagram showing an example of dividing a Toeplitz matrix into blocks of a square matrix according to an assumed comparative example. FIG. 7 is a diagram showing an example of dividing a Toeplitz matrix into blocks of a square matrix according to an assumed comparative example. FIG. 8 is a diagram showing an example of dividing a Toeplitz matrix into blocks of a size according to at least one of the number of rows and the number of columns of the Toeplitz matrix according to an embodiment. FIG. 9 is a diagram showing an example of dividing a Toeplitz matrix into blocks of a size according to at least one of the number of rows and the number of columns of the Toeplitz matrix according to an embodiment.

[0011] The principles of the present disclosure will be described with reference to some exemplary embodiments. It should be understood that these embodiments are set forth for illustrative purposes only, to aid those skilled in the art in understanding and practicing the present disclosure, without implying any limitation on the scope of the disclosure. The disclosure described herein may be implemented in various ways other than those described below.

[0012] In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs.

[0013] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. Note that each drawing is merely an example for describing one or more embodiments. Each drawing is not related to only one particular embodiment, but may also be related to one or more other embodiments. As will be understood by those skilled in the art, various features or steps described with reference to any one drawing can be combined with features or steps shown in one or more other drawings to create, for example, an embodiment not explicitly shown or described. Not all features or steps shown in any one drawing are necessarily required to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0014] (First Embodiment) <Configuration> The configuration of an information processing device 10 according to an embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the configuration of the information processing device 10 according to an embodiment. The information processing device 10 has an acquisition unit 11, a division unit 12, and a generation unit 13. Each of these units may be realized by cooperation between one or more programs installed in the information processing device 10 and hardware such as a processor and memory of the information processing device 10.

[0015] The acquisition unit 11 acquires a correction key generated by error-correcting a random number shared over a quantum channel, and data indicating a hash function including a specific Toeplitz matrix.

[0016] The dividing unit 12 divides the specific Toeplitz matrix acquired by the acquiring unit 11 into submatrices each having a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix.

[0017] The generation unit 13 calculates the logical product of each submatrix divided by the division unit 12 and the part of the correction key corresponding to each submatrix, and generates a final key that is smaller in size than the correction key as a privacy amplification process by performing an exclusive OR for each row of the hash function.

[0018] (Embodiment 2) Next, with reference to Fig. 2, a configuration of a quantum key distribution (QKD) system 1 according to an embodiment will be described. <System Configuration> Fig. 2 is a diagram showing an example configuration of a quantum key distribution system 1 according to an embodiment. In the example of Fig. 2, the quantum key distribution system 1 includes an information processing device 10A and an information processing device 10B (in the present disclosure, when there is no need to distinguish between them, they will be simply referred to as "information processing devices 10"). The information processing device 10A is a QKD transmitter, and the information processing device 10B is a QKD receiver.

[0019] 2, the information processing device 10A and the information processing device 10B are connected to each other so as to be able to communicate with each other via a quantum communication path (quantum channel) N1 such as an optical fiber and a public communication path N2. Examples of the public communication path N2 include the Internet, a mobile communication system, a wireless LAN (Local Area Network), a short-range wireless communication such as BLE, a LAN, and a bus. Examples of the mobile communication system include a fifth-generation mobile communication system (5G), a fourth-generation mobile communication system (4G), a third-generation mobile communication system (3G), and the like.

[0020] <Hardware Configuration> Fig. 3 is a diagram showing an example of the hardware configuration of the information processing device 10 according to the embodiment. In the example of Fig. 3, the information processing device 10 (computer 100) includes a processor 101, a memory 102, and a communication interface 103. These components may be connected via a bus or the like. The memory 102 stores at least a part of a program 104. The communication interface 103 includes an interface required for communication with other network elements.

[0021] When the program 104 is executed by the processor 101, memory 102, and other components in cooperation with each other, the computer 100 performs at least some of the processing of the embodiments of the present disclosure. The memory 102 may be of any type. As a non-limiting example, the memory 102 may be a non-transitory computer-readable storage medium. The memory 102 may also be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory, and removable memory. Although only one memory 102 is shown in the computer 100, several physically different memory modules may be present in the computer 100. The processor 101 may be of any type. The processor 101 may include one or more of a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), and, as a non-limiting example, a processor based on a multi-core processor architecture. The computer 100 may have multiple processors, such as application-specific integrated circuit chips that are time-slaved to a clock that synchronizes the main processor.

[0022] Embodiments of the present disclosure may be implemented in hardware or special purpose circuits, software, logic, or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software that may be executed by a controller, microprocessor, or other computing device.

[0023] The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer-readable storage medium. The computer program product includes computer-executable instructions, such as instructions included in program modules, that execute on a target real or virtual processor or device to perform the processes or methods of the present disclosure. Program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The functionality of the program modules may be combined or divided among program modules as desired in various embodiments. The machine-executable instructions of the program modules may be executed in local or distributed devices. In a distributed device, the program modules may be located in both local and remote storage media.

[0024] The program code for executing the methods of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus. When the program code is executed by the processor or controller, the functions / acts in the flowcharts and / or implementing block diagrams are performed. The program code may be executed entirely on the machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine, or entirely on a remote machine or server.

[0025] The program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored on a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, computer-readable media or tangible storage media include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technologies, CD-ROM, digital versatile disc (DVD), Blu-ray disc or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may also be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, transitory computer-readable media or communication media include electrical, optical, acoustic, or other forms of propagated signals.

[0026] <Key Distillation Processing of QKD> Fig. 4 is a diagram showing key distillation processing of QKD according to an embodiment. In the example of Fig. 4, an information processing device 10A transmits random number sequence data to an information processing device 10B via a quantum communication channel N1. As a result, a random number sequence called a sifted key is recorded in each information processing device 10. Note that the sifted keys of each information processing device 10 do not completely match due to disturbances and the like that accompany transmission.

[0027] Therefore, in the error correction process, each information processing device 10 shares error correction data (syndrome, parity information) via the public communication channel N2 to generate a key after error correction (correction key). Each information processing device 10 then shares a hash function (e.g., a modified Toeplitz matrix) via the public communication channel N2. Here, one of the information processing device 10A (transmitter) and the information processing device 10B (receiver) may randomly select a hash function and disclose the selected hash function to the other via the public communication channel N2.

[0028] The information processing device 10 then performs privacy amplification processing on the correction key, which is processing for invalidating the eavesdropped information. As a result, a final key (encryption key, shared key) is generated. In this way, key distillation mainly consists of error correction processing and privacy amplification processing.

[0029] <Processing> Next, an example of the privacy amplification process of the information processing device 10 according to the embodiment will be described with reference to Fig. 5 to Fig. 11 . Fig. 5 is a flowchart showing an example of the privacy amplification process of the information processing device 10 according to the embodiment. Figs. 6, 7, and 9 are diagrams showing an example of dividing a Toeplitz matrix into blocks of a square matrix according to an assumed comparative example. Figs. 8, 10, and 11 are diagrams showing an example of dividing a Toeplitz matrix into blocks of a size corresponding to at least one of the number of rows and the number of columns of the Toeplitz matrix according to the embodiment.

[0030] In step S1, the acquisition unit 11 acquires a correction key generated by error-correcting a random number shared over a quantum channel and data indicating a hash function including a specific Toeplitz matrix. The size of the hash function (number of rows and columns) may be determined by, for example, one of the information processing devices 10A (transmitter) and 10B (receiver) based on an estimated amount of eavesdropping on the quantum channel. The values ​​of each element of the matrix, which is the hash function, may be randomly selected by the one device. The hash function may then be made public to the other device over a public communication channel N2.

[0031] Here, the hash function is, for example, an m×n (m rows and n columns) modified Toeplitz matrix T Ｍ It should be noted that the hash function of the present disclosure is not limited to the matrix of formula (1), and may be any matrix including a Toeplitz matrix.

[0032] Here, l ｍ is an m x m (m rows and m columns) identity matrix, and T (an example of a "specific Toeplitz matrix") is a Toeplitz matrix (a constant diagonal matrix). A Toeplitz matrix is ​​a matrix whose elements are constant (the diagonal elements have the same value) along each descending diagonal from left to right.ｍ |T) is the identity matrix l ｍ and the Toeplitz matrix T are horizontally arranged (concatenated) matrices. ｉ are the elements of the Toeplitz matrix T, and take the value 0 or 1.

[0033] The n-bit correction key Y can be expressed as in the following equation (2): ｔ denotes transposition.

[0034] The first m bits of the correction key Y are expressed as Y ０ The remaining nm bits (each bit from the m+1th bit onwards of the correction key Y) are expressed as Y １ Then, the final key Z may be calculated based on the following equation (3). In this case, the final key Z will be m bits. Note that since the calculation of the correction key Y is performed in binary, '+' (addition) is calculated as xor (exclusive OR), and '·' (multiplication) is calculated as and (logical AND).

[0035] By such privacy amplification processing, the n-bit correction key Y is compressed into the m-bit final key Z. Therefore, the compression ratio is m / n.

[0036] Note that the multiplication process for the Toeplitz matrix T (T·Y in Equation (3)) １ The process of calculating n is a binary calculation, but by regarding 0 and 1 as real numbers or integers, the calculation can be sped up using FFT (Fast Fourier Transform) or number theorem transform. ２ Although the amount of calculation is of the order of magnitude, if FFT or number-theoretic transformation is used, it is n × log ２ The amount of calculation is n-order.

[0037] Next, the dividing unit 12 divides the specific Toeplitz matrix into blocks (submatrices) each having a size corresponding to the number of rows and columns of the specific Toeplitz matrix (step S2). ＭThe Toeplitz matrix T included in may be divided into blocks according to the processing size of the implemented FFT or number theoretic transform.

[0038] As an example of a possible comparative example, consider an example in which a Toeplitz matrix T is divided into blocks of a square matrix having a size corresponding to a transform processing size N by an FFT, number theoretic transform, or the like implemented in software or hardware, as shown in FIG. Each block, which is a submatrix of the Toeplitz matrix T, is a Toeplitz matrix (a constant diagonal matrix). The transform processing size N is the sum of the number of rows and the number of columns of a matrix to be multiplied by an FFT, number theoretic transform, or the like. These values ​​are based on the properties of a Toeplitz matrix. The transform processing size N is, for example, the memory size of an array (buffer) that stores data to be multiplied by an FFT, number theoretic transform, or the like, and is a fixed value because it is determined by the software or hardware implementation.

[0039] By multiplying each bit of the correction key by each block using FFT or number theoretic transformation, etc., and calculating the xor (exclusive OR) of the multiplication results for each row, the same processing result can be achieved in equation (6) described below as when the original (before division) Toeplitz matrix T in equation (1) above is multiplied without being divided into blocks.

[0040] In the example of Figure 6, the original Toeplitz matrix T portion 601 is divided into 18 blocks 611 to 628 of an N / 2 x N / 2 square matrix. The transform processing size N is a fixed value determined by the software or hardware implementation. Therefore, FFT processing is also performed on the portions of each block 616, 622 to 628 that do not include the original Toeplitz matrix T portion 601. Therefore, the calculation processing for these portions is wasted.

[0041] The information processing device 10 changes the compression ratio (m / n) as needed depending on the state of the quantum channel. When it becomes necessary to use a relatively large Toeplitz matrix depending on the state of the quantum channel, the compression ratio becomes relatively small, and a Toeplitz matrix T ＭIn this case, if the original Toeplitz matrix T is divided into blocks of a square matrix, the amount of unnecessary (redundant) calculations becomes relatively large, resulting in a relatively poor performance. The example of FIG. 7, which is another example of a possible comparative example, shows a case where the number of rows (m) of the original Toeplitz matrix T is relatively small compared to the example of FIG. 6. In the example of FIG. 7, the bit length of the correction key Y and the modified Toeplitz matrix T Ｍ The number of columns, n, is 4N, m=2 / 3×N, and nm=10 / 3×N.

[0042] In the example of Figure 7, the original Toeplitz matrix T portion 701 is divided into 14 blocks 711 to 724 of an N / 2 x N / 2 square matrix. In this case, calculations are wasted for the portions of each of the blocks 717, 718 to 724 that do not include the original Toeplitz matrix T portion 701, which are shown shaded. Therefore, the amount of wasted calculations is relatively large compared to the example of Figure 6.

[0043] (Division Example) In step S2, the division unit 12 may determine the size of each block into which the Toeplitz matrix T is divided, for example, by the following procedure. Note that the order of the following procedures can be changed as appropriate as long as there is no contradiction. Note that, although an example of determining the size of each block based on the number of rows m of the Toeplitz matrix T will be described below, the present disclosure is not limited to this. For example, the division unit 12 may determine the size of each block based on the number of columns n-m of the Toeplitz matrix T. In this case, m may be read as n-m in the following description. (1) Identify the number of rows m of the Toeplitz matrix T and the transformation processing size N implemented in software or hardware. (2) Identify the smallest natural number k such that m / k≦N / 2. (3) Determine the number of rows N1 of each block to be the smallest integer equal to or greater than m / k. (4) Determine the number of columns N2 of each block to be N-N1. As a result, the size of each block becomes N1×N2. That is, each block is a matrix of N1 rows and N2 columns.

[0044] This allows the total number of blocks to be divided (number of divisions) to be relatively small, while the portion of the block that does not contain the original Toeplitz matrix T can be made relatively small.

[0045] Using the above procedure, the Toeplitz matrix T is decomposed into ceiling(m / N1) × ceiling((n-m) / N2) blocks. Then, FFT or the like is applied to each block of N1 rows and N2 columns. Note that ceiling(x) indicates the ceiling function of x, and indicates the smallest integer equal to or greater than x for a real number x.

[0046] Fig. 8 shows an example in which the dividing unit 12 according to the embodiment divides a Toeplitz matrix T, where m = 2 / 3 × N and n - m = 10 / 3 × N, as in Fig. 7, into blocks using the above procedure. In the example of Fig. 8, the original Toeplitz matrix T portion 701 is divided into 10 blocks 811 to 820 of a matrix with N / 3 rows and 2N / 3 columns. In this case, the portion of each block that does not include the original Toeplitz matrix T portion 701, shown shaded, is relatively small, resulting in relatively less wasted calculations compared to the example of Fig. 7.

[0047] According to the present disclosure, typically, for example, when k=1, that is, N / 2≧m, the Toeplitz matrix T can be divided into blocks each having a size of m×(N−m) and arranged in a row, which allows for a reduction in the number of processes such as FFT, as shown in FIGS.

[0048] 9 and 10 show an example in which the number of rows m of the Toeplitz matrix T is 8, the number of columns n-m of the Toeplitz matrix T is 92, and the transform processing size N is 32. In FIG. 9 , which shows an assumed comparative example, a portion 901 of the Toeplitz matrix T is divided into six square matrices each having a size of 16 x 16. On the other hand, in FIG. 10 , which shows an example of division according to the embodiment, the portion 901 of the Toeplitz matrix T is divided into four submatrices each having a size of 8 x 24. Therefore, in the example of FIG. 10 according to the embodiment of the present disclosure, the number of processes such as FFT can be reduced compared to the example of FIG. 9 .

[0049] Next, the generating unit 13 generates a final key based on each block divided by the dividing unit 12 and the correction key (step S3). Here, the generating unit 13 calculates the logical product of each block and the part of the correction key corresponding to each block using FFT, number theoretic transformation, etc. Then, based on the calculation result, the generating unit 13 calculates a hash function (for example, a modified Toeplitz matrix T Ｍ ) for each row to generate a final key that is smaller in size than the correction key as a privacy amplification process.

[0050] Below, we use FFT to find T·Y in equation (3). １ The process for calculating the modified Toeplitz matrix T Ｍ The array t of elements of the Toeplitz matrix T included in is expressed as the following equation (4).

[0051] In addition, the above-mentioned Y １ An array y in which m zeros are concatenated at the beginning of is expressed as in the following formula (5).

[0052] Also, FFT is f, and its inverse transform is ｆ－１ Also, In this case, T.Y １ can be calculated as in the following equation (6).

[0053] When using number theoretic transformation, only f changes compared to when using FFT, and the procedure may be the same.

[0054] (Variation 1 of Division Example) In the division example of step S2 in Fig. 5 described above, the division is performed based on the smallest natural number k such that m / k ≤ N / 2. In the above example, when k = 1, that is, when N / 2 ≥ m, the Toeplitz matrix T is divided into blocks arranged in one row.

[0055] Alternatively, for example, when 2N / 3≧m, the division unit 12 may set k=1 and divide the Toeplitz matrix T into blocks arranged in a row. In this case, the Toeplitz matrix T is divided into blocks each having a size of m×(N−m). This makes it easier to divide the Toeplitz matrix T into blocks arranged in a row, for example. Therefore, for example, processing efficiency may be improved. In this case, the number of blocks is 1×ceiling((n−m) / (N−m)).

[0056] On the other hand, if 2N / 3≧m is not satisfied, the dividing unit 12 may identify the smallest natural number k such that m / k≦N / 2, as in the above-described dividing example of step S2 in FIG. 5. Then, the dividing unit 12 may determine the number of rows N1 of each block to be the smallest integer equal to or greater than m / k. Then, the dividing unit 12 may determine the number of columns N2 of each block to be N−N1.

[0057] (Modification 2 of Division Example) In the above-described examples, the conversion processing size N is one. Instead, the division unit 12 may divide the conversion processing size N of each of a plurality of conversion processing modules implemented in software or hardware. ｉ The conversion processing size N may be selected from (i≧2).

[0058] In this case, the dividing unit 12 divides the Toeplitz matrix T into blocks, for example, into a transformation processing size N ｉ The smallest conversion processing size N ｍｉｎ may be used as the above-mentioned transform processing size N. When performing FFT or number theoretic transform on each block, the generating unit 13 determines that the transform processing size is N ｍｉｎ This may, for example, make the processing more efficient.

[0059] In the example of division in step S2 of FIG. 5, the Toeplitz matrix T is divided into blocks, and the transformation processing size N ｉ is N ｉIn the first modification of the above-described division example, the transformation processing size N ｉ is 2N ｉ / 3≧m.

[0060] (Third Modification of Division Example) In the above-described examples, the Toeplitz matrix T is divided into blocks of the same size. Alternatively, the division unit 12 may make the size of the block located at the end of the row or column of the Toeplitz matrix T (for example, the rightmost block in FIG. 10 ) different from the size of the other blocks. This may, for example, make the processing more efficient.

[0061] In this case, the dividing unit 12 divides the size of the block located at the edge into a transformation processing size N that is equal to or larger than the size of the Toeplitz matrix T included in the block. ｉ The smallest conversion processing size N ｍｉｎ Here, the conversion processing size N ｉ is the same as the second modification of the division example described above, and is the conversion processing size N of the plurality of conversion processing modules each having a different conversion processing size. ｉ When performing FFT or number theoretic transformation on a block located at an edge, the generation unit 13 determines whether the transformation processing size is N ｍｉｎ A conversion processing module may be used.

[0062] Furthermore, when the dividing unit 12 divides the Toeplitz matrix T into blocks arranged in two or more rows, the dividing unit 12 may combine blocks located at the edge and spanning multiple block rows into one block, as shown in Fig. 11. In the example of Fig. 11, a part of the portion 1101 of the Toeplitz matrix T is divided into blocks 1111 to 1116 of the same size, and the remaining part of the portion 1101 of the Toeplitz matrix T is divided into a block 1117 located at the edge and spanning multiple block rows.

[0063] <Others> Privacy amplification in the key distillation process of a quantum cryptography system can be said to be a process of compressing the data to a size equal to the difference between the amount of information in the correction key generated by error-correcting the random numbers shared between Alice (Party A) and Bob (Party B) via the quantum channel and the amount of eavesdropping by Eve (the eavesdropper). This compression process can be performed by multiplying by a hash (universal hash) function such as a randomly selected modified Toeplitz matrix.

[0064] The estimated value of the amount of eavesdropping in QKD is affected by the accuracy of the estimated values ​​of quantum channel parameters such as error rate and excess noise (deviation of signal variance). For this reason, it is necessary to suppress the variance for a sufficiently large amount of data, and the size of the data (correction key) to be subjected to privacy amplification processing must also be large (for example, n = 10 ８ ~10 １２ ) is necessary.

[0065] The matrix multiplication process of a large-sized hash function needs to be performed using an FFT, a number-theoretic transform, or the like to reduce the amount of calculation. However, the matrix multiplication process of a large-sized hash function using an FFT, a number-theoretic transform, or the like can be relatively difficult to implement. For example, a large amount of memory is required, and processing performance may be degraded due to memory access.

[0066] On the other hand, according to the present disclosure, a specific Toeplitz matrix is ​​divided into submatrices having sizes corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix, and then processing such as FFT or number theoretic transform is performed. Therefore, the operation of privacy amplification processing can be more appropriately performed. Note that the technology of the present disclosure can also be used in a random number generation system that generates unbiased random numbers from highly biased physical random numbers.

[0067] <Modifications> The information processing device 10 may be a device contained in a single housing, but the information processing device 10 of the present disclosure is not limited to this. Each unit of the information processing device 10 may be realized by cloud computing configured with one or more computers, for example. Such an information processing device 10 is also included in the examples of the "information processing device" of the present disclosure.

[0068] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be combined with other embodiments as appropriate.

[0069] Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes. (Supplementary Note 1) An information processing device comprising: an acquisition unit that acquires a correction key generated by error-correcting a random number shared over a quantum channel and data indicating a hash function including a specific Toeplitz matrix; a division unit that divides the specific Toeplitz matrix into submatrices, each having a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix; and a generation unit that calculates a logical product of each of the submatrices and a portion of the correction key corresponding to each of the submatrices, and generates a final key that is more compact in size than the correction key as a privacy amplification process by performing an exclusive OR on each row of the hash function. (Supplementary Note 2) The information processing device according to Supplementary Note 1, wherein the division unit divides the specific Toeplitz matrix into the submatrices, each having a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix and a transform process size of an FFT (Fast Fourier Transform) or a number theoretic transform. (Supplementary Note 3) The information processing device according to Supplementary Note 2, wherein the dividing unit identifies the smallest natural number k such that m / k≦N / 2, where m is the number of rows of the specific Toeplitz matrix and N is the transformation processing size, determines the number of rows N1 of each submatrix to be the smallest integer equal to or greater than m / k, and determines the number of columns N2 of each submatrix to be N−N1. (Supplementary Note 4) The information processing device according to Supplementary Note 3, wherein the dividing unit determines the value of k to be 1 if 2N / 3≦m. (Supplementary Note 5) The information processing device according to Supplementary Note 2, wherein the transformation processing size includes a plurality of sizes, and the dividing unit divides the specific Toeplitz matrix into submatrices of sizes corresponding to the smallest transformation processing size among the plurality of sizes in which the submatrices into which the specific Toeplitz matrix is ​​divided are arranged in one row. (Supplementary Note 6) The information processing device according to Supplementary Note 1 or 2, wherein the dividing unit determines a size of a submatrix located at an end in a row direction or a column direction of the specific Toeplitz matrix so that the size is different from the sizes of the other submatrices. (Supplementary Note 7) The information processing device according to Supplementary Note 1 or 2, wherein the hash function is a matrix in which an identity matrix and a Toeplitz matrix are arranged, the number of rows m of the matrix being the number of bits of the final key, and the number of rows n of the matrix being the number of bits of the correction key.(Supplementary Note 8) An information processing method that executes the following processes: acquiring a correction key generated by error-correcting a random number shared over a quantum channel and data indicating a hash function including a specific Toeplitz matrix, dividing the specific Toeplitz matrix into submatrices having a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix, calculating a logical product of each of the submatrices and a portion of the correction key corresponding to each of the submatrices, and generating a final key whose size is more compressed than the correction key as a privacy amplification process by performing an exclusive OR on each row of the hash function. (Supplementary Note 9) The information processing method according to Supplementary Note 8, wherein the dividing process divides the specific Toeplitz matrix into the submatrices having a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix and a transform process size of an FFT (Fast Fourier Transform) or a number theoretic transform. (Supplementary Note 10) The information processing method according to Supplementary Note 9, wherein the dividing process specifies the smallest natural number k such that m / k≦N / 2, where m is the number of rows of the specific Toeplitz matrix and N is the transformation processing size, determines the number of rows N1 of each submatrix to be the smallest integer equal to or greater than m / k, and determines the number of columns N2 of each submatrix to be N−N1. (Supplementary Note 11) The information processing method according to Supplementary Note 10, wherein the dividing process determines the value of k to be 1 if 2N / 3≦m. (Supplementary Note 12) The information processing method according to Supplementary Note 9, wherein the transformation processing size includes a plurality of sizes, and wherein the dividing process divides the specific Toeplitz matrix into submatrices of sizes corresponding to the smallest transformation processing size among the plurality of sizes in which each of the submatrices into which the specific Toeplitz matrix is ​​divided is arranged in one row. (Supplementary Note 13) The information processing method according to Supplementary Note 8 or 9, wherein in the dividing process, a size of a submatrix located at an end in a row or column direction of the specific Toeplitz matrix is ​​determined to be different from a size of each of the other submatrices. (Supplementary Note 14) The information processing method according to Supplementary Note 8 or 9, wherein the hash function is a matrix in which an identity matrix and a Toeplitz matrix are arranged, the number of rows m of the matrix being the number of bits of the final key, and the number of rows n of the matrix being the number of bits of the correction key.(Supplementary Note 15) A program that causes a computer to execute the following processes: acquiring a correction key generated by error-correcting a random number shared over a quantum channel and data indicating a hash function including a specific Toeplitz matrix, dividing the specific Toeplitz matrix into submatrices having a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix, calculating a logical product of each of the submatrices and a portion of the correction key corresponding to each of the submatrices, and generating a final key whose size is more compressed than the correction key as a privacy amplification process by performing an exclusive OR on each row of the hash function. (Supplementary Note 16) The program according to Supplementary Note 15, wherein the dividing process divides the specific Toeplitz matrix into the submatrices having a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix and a transform process size of an FFT (Fast Fourier Transform) or a number theoretic transform. (Supplementary Note 17) The program according to Supplementary Note 16, wherein the dividing process identifies the smallest natural number k such that m / k≦N / 2, where m is the number of rows of the specific Toeplitz matrix and N is the transformation processing size, determines the number of rows N1 of each submatrix to be the smallest integer equal to or greater than m / k, and determines the number of columns N2 of each submatrix to be N−N1. (Supplementary Note 18) The program according to Supplementary Note 17, wherein the dividing process determines the value of k to be 1 if 2N / 3≦m. (Supplementary Note 19) The program according to Supplementary Note 16, wherein the transformation processing size includes a plurality of sizes, and wherein the dividing process divides the specific Toeplitz matrix into submatrices of sizes corresponding to the smallest transformation processing size among the plurality of sizes in which each of the submatrices into which the specific Toeplitz matrix is ​​divided is arranged in one row. (Supplementary Note 20) The program according to Supplementary Note 15 or 16, wherein in the dividing process, a size of a submatrix located at an end in a row or column direction of the specific Toeplitz matrix is ​​determined to be different from a size of each of the other submatrices. (Supplementary Note 21) The program according to Supplementary Note 15 or 16, wherein the hash function is a matrix in which an identity matrix and a Toeplitz matrix are arranged, the number of rows m of the matrix being the number of bits of the final key, and the number of rows n of the matrix being the number of bits of the correction key.

[0070] REFERENCE SIGNS LIST 1 quantum key distribution system 10 information processing device 11 acquisition unit 12 division unit 13 generation unit

Claims

1. An information processing device having: an acquisition unit that acquires a correction key generated by error-correcting a random number shared by a quantum channel and data indicating a hash function including a specific Toeplitz matrix; a division unit that divides the specific Toeplitz matrix into submatrices having a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix; and a generation unit that calculates the logical product of each of the submatrices and a portion of the correction key corresponding to each of the submatrices, and generates a final key whose size is more compressed than the correction key as a privacy amplification process by performing an exclusive OR for each row of the hash function.

2. The information processing device according to claim 1, wherein the division unit divides the specific Toeplitz matrix into the submatrices having sizes according to at least one of the number of rows and the number of columns of the specific Toeplitz matrix and a transform processing size of an FFT (Fast Fourier Transform) or a number theoretic transform.

3. The information processing device of claim 2, wherein the division unit: identifies the smallest natural number k such that m / k≦N / 2, where m is the number of rows of the specific Toeplitz matrix and N is the transformation processing size; determines the number of rows N1 of each of the submatrices to be the smallest integer greater than or equal to m / k; and determines the number of columns N2 of each of the submatrices to be N-N1.

4. The information processing device according to claim 3, wherein the division unit determines the value of k to be 1 if 2N / 3≦m.

5. The information processing device of claim 2, wherein the transformation processing size includes a plurality of sizes, and the division unit divides the specific Toeplitz matrix into submatrices of a size corresponding to the smallest transformation processing size among the plurality of sizes in which each of the submatrices into which the specific Toeplitz matrix is ​​divided is arranged in a row.

6. The information processing device according to claim 1 or 2, wherein the division unit determines a size of a submatrix located at an end in a row or column direction of the specific Toeplitz matrix so as to be different from the size of each of the other submatrices.

7. The information processing device according to claim 1 or 2, wherein the hash function is a matrix in which an identity matrix and a Toeplitz matrix are arranged, the number of rows m of the matrix is ​​the number of bits of the final key, and the number of rows n of the matrix is ​​the number of bits of the correction key.

8. An information processing method for executing a process of acquiring a correction key generated by error-correcting a random number shared by a quantum channel and data indicating a hash function including a specific Toeplitz matrix, dividing the specific Toeplitz matrix into submatrices having a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix, calculating a logical product between each of the submatrices and a portion of the correction key corresponding to each of the submatrices, and generating a final key having a smaller size than the correction key as a privacy amplification process by performing an exclusive OR for each row of the hash function.

9. The information processing method according to claim 8, wherein the division process divides the specific Toeplitz matrix into submatrices of a size according to at least one of the number of rows and the number of columns of the specific Toeplitz matrix and a transform processing size of an FFT (Fast Fourier Transform) or a number theoretic transform.

10. The information processing method of claim 9, wherein the division process includes identifying the smallest natural number k such that m / k≦N / 2, where m is the number of rows of the specific Toeplitz matrix and N is the transformation process size; determining the number of rows N1 of each of the submatrices to be the smallest integer greater than or equal to m / k; and determining the number of columns N2 of each of the submatrices to be N-N1.

11. The information processing method according to claim 10, wherein in the division process, if 2N / 3≦m, the value of k is determined to be 1.

12. The information processing method of claim 9, wherein the transformation processing size includes a plurality of sizes, and the division process divides the specific Toeplitz matrix into submatrices of a size corresponding to the smallest transformation processing size among the plurality of sizes in which each of the submatrices into which the specific Toeplitz matrix is ​​divided is arranged in a row.

13. The information processing method according to claim 8 or 9, wherein in the division process, the size of the submatrix located at the end of the row or column of the specific Toeplitz matrix is ​​determined to be different from the size of each of the other submatrices.

14. The information processing method according to claim 8 or 9, wherein the hash function is a matrix in which an identity matrix and a Toeplitz matrix are arranged, the number of rows m of the matrix is ​​the number of bits of the final key, and the number of rows n of the matrix is ​​the number of bits of the correction key.

15. A program that causes a computer to execute the following process: acquiring a correction key generated by error-correcting a random number shared by a quantum channel and data indicating a hash function including a specific Toeplitz matrix; dividing the specific Toeplitz matrix into submatrices having a size corresponding to at least one of the number of rows and the number of columns of the specific Toeplitz matrix; calculating a logical product between each of the submatrices and a portion of the correction key corresponding to each of the submatrices; and generating a final key whose size is more compressed than the correction key by performing an exclusive OR on each row of the hash function as a privacy amplification process.

16. The program according to claim 15, wherein the division process divides the specific Toeplitz matrix into submatrices of a size according to at least one of the number of rows and the number of columns of the specific Toeplitz matrix and a transform processing size of an FFT (Fast Fourier Transform) or a number theoretic transform.

17. The program according to claim 16, wherein the division process identifies the smallest natural number k such that m / k≦N / 2, where m is the number of rows of the specific Toeplitz matrix and N is the transformation process size; determines the number of rows N1 of each submatrix to be the smallest integer greater than or equal to m / k; and determines the number of columns N2 of each submatrix to be N-N1.

18. The program according to claim 17, wherein in the division process, if 2N / 3≦m, the value of k is determined to be 1.

19. The program of claim 16, wherein the transformation processing size includes a plurality of sizes, and the division process divides the specific Toeplitz matrix into submatrices of a size corresponding to the smallest transformation processing size among the plurality of sizes in which each of the submatrices into which the specific Toeplitz matrix is ​​divided is arranged in a row.

20. The program according to claim 15 or 16, wherein the division process determines the size of the submatrix located at the end of the row or column of the specific Toeplitz matrix so as to be different from the size of each of the other submatrices.

Images