Schiansky et al. 2023 SI Note 3

Citations

• https://www.nature.com/articles/s41467-023-39519-w(opens in a new tab)
• doi:10.1038/s41467-023-39519-w(opens in a new tab)

Record

Every field of the source record, in file order.

Protocolprotocol

schiansky_payment_2023

Gamegame

D1

Sourcesource

SKSRGTBW2023

Assumptionsassumptions

• –Two merchants (one committed bit per sub-token); TTP honest; i.t.-secure MAC; Client's choice of merchant independent of external bias.
• –Source emits states diagonal in photon number (SPDC; sigma_k of SI Note 3A with p0, p1, pm); multiphoton probability pm known.
• –Attack model: general CPTP map on the token producing two classical cryptograms; TTP checks declared error e and loss l.
• –N -> infinity: exponential de Finetti argument stated informally (SI Note 3B), i.e. collective attacks assumed asymptotically i.i.d.
• –Finite N: Chernoff-Hoeffding (SI Eqs. 7-8) applied to the mishap count M(e,l) = (4+2 sqrt 2) e + l.

Required declarationsrequired_declarations

• –two_merchants_one_bit
• –honest_ttp
• –it_secure_mac
• –fock_diagonal_spdc_source
• –permutation_symmetric_iid_reduction

Calibration familiescalibration_families

• –schiansky_2023

Finite n or asymptoticfinite_n_or_asymptotic

finite N via Chernoff, on top of an asymptotic (de Finetti) reduction

Parametersparameters

N: quantum states per committed bit (sub-token length)
p_m: multiphoton emission probability
e_h: honest error rate
l_h: honest loss rate
delta_d: dishonest tolerance (0,1]
delta_h: honest tolerance (0,1]

Quantifier over adversariesquantifier_over_adversaries

a malicious Client/Merchant applying any CPTP map to the token (SDP over Choi matrices, N=1), extended to N by an informal de Finetti argument

Mathematical boundmathematical_bound

p_d <= exp(-(delta_d^2/2) * (1/2)(1 - p_m/2) * N) [SI Eq. 22] 1 - p_h <= exp(-(delta_h^2/3) * M(e_h,l_h) * N), M = (4+2 sqrt 2) e + l [SI Eqs. 18-20] admissible iff (1/2)(1 - p_m/2)(1 - delta_d) >= M(e_h,l_h)(1 + delta_h) [SI Eq. 23]

Numerical methodnumerical_method

log space; reproduces p_d = 5.9e-45 at N=4.2e6, p_m=0.0602, delta_d=0.01

Verification scriptverification_script

qmint/proofs/finite_size.py; tests/unit/proofs/test_finite_size.py

Independent crosscheckindependent_crosscheck

qmint/proofs/checker.py re-derives the numbers but REFUSES to certify (see caveats)

Caveatscaveats

• –Secure-region boundary Eq. (16) is described by the authors as an analytic expression that FITS the numerical SDP optimum, not a proven closed form.
• –The N->infinity step is an informal appeal to exponential de Finetti without finite-N correction terms.
• –Chernoff bound (stated for sums of Bernoulli variables) is applied to the weighted mishap combination M(e,l).
• –p_d excludes the MAC tag-forgery probability p_t = 1/sqrt|C|; the paper chooses p_d ~ p_t but states no composed epsilon. QMint does not compose them.
• –Main text vs SI disagree: multiphoton probability 6.76 +- 0.12 % (main; reproduces main-text e_d = 3.79 %) vs p_m = 6.02 +- 0.28 % (SI Table 2; reproduces e_d = 3.82 % and allowed mishaps 0.4849); sub-token length N = 4.2e6 (Fig. 4b) vs 4,482,440 (SI Table 2). The published p_d = 5.911e-45 reproduces ONLY with N = 4.2e6 and p_m = 6.02 % (N = 4,482,440 gives 6.3e-48; p_m = 6.76 % gives 8.7e-45). Cross-checked with lane A (research/THEOREM_REGISTRY_SEED.yaml T-SCH23-FINITE).
• –OPEN QUESTION (QMint assessment, not a claim of error): SI Eqs. (7)-(8) are multiplicative Chernoff bounds for sums of independent variables in {0,1}. The mishap variable per state takes values in {0, 1, 4+2 sqrt 2} (weight > 1 on errors), outside that hypothesis. Rescaling to [0,1] (divide by w = 4+2 sqrt 2) gives the textbook-valid exponent reduced by w: p_d <= exp(-(delta_d^2/2)(1/2)(1-p_m/2) N / w) = 3.3e-7 at the published tuple instead of 5.9e-45. The authors may have a different justification; until resolved D1 stays uncertifiable. Same issue for the honest bound (Eq. 19).
• –Therefore results carry evidence kind PUBLISHED_AGGREGATE and status NUMERICALLY_SUPPORTED; the independent checker never marks a D1 certificate CERTIFIED.

Statusstatus

NUMERICALLY_SUPPORTED

Reproduced examplesreproduced_examples

• –p_d = 5.911e-45 (SI Table 2) at N = 4.2e6, p_m = 0.0602, delta_d = 0.01 (ours 5.911e-45); with SI N = 4,482,440 the same formula gives 6.3e-48, so the published number uses N = 4.2e6
• –e_d(l_m = 0.224) = 3.82 % with p_m = 6.02 % (SI) and 3.79 % with p_m = 6.76 % (main text)
• –M(e_m, l_m) for +/- basis: (4+2 sqrt2)(0.03278)+0.224 = 0.448 (SI Table 2: 0.448)
• –Eq. (23) admissible at delta_h = 0.031, delta_d = 0.01

Boundsbounds

Show structured value20 lines

Related entries

• T-SCH23-SDP-N1Schiansky et al. 2023 · Supplementary InformationVERIFIED FROM SOURCE
• T-SCH23-ASYMPTOTICSchiansky et al. 2023 · Supplementary Note 3BVERIFIED FROM SOURCE
• T-SCH23-FINITESchiansky et al. 2023 · Supplementary Note 3CVERIFIED FROM SOURCE