# Techniques: Quantum cryptography beyond key distribution: theory and experiment

## What the paper contributes (one paragraph)

This is a review of quantum cryptography beyond quantum key distribution, together with secure quantum computation. It classifies the main quantum-cryptographic primitives by their security level (information-theoretic, physical-assumption-based, and computational against quantum adversaries), summarises what each can and cannot achieve, and surveys their photonic implementations and hardware challenges. For the pathfinder matrix the most suppliable material sits in its treatment of secure quantum computation and quantum information protection: it consolidates the standard constructions for delegating a quantum computation to an untrusted server with privacy (blind quantum computing), with privacy and integrity (verifiable blind quantum computing via traps), with a purely classical client (remote state preparation and quantum fully homomorphic encryption), across many mistrustful parties (secure multiparty quantum computation), and for protecting transmitted quantum data (quantum message authentication). These are capabilities that an external quantum-computing result could be wrapped in to gain confidentiality, verifiability, or multi-party privacy.

## Techniques offered

- **Blind quantum computation (delegated private computation)** - lets a client with minimal quantum resources delegate a universal computation to an untrusted server such that input, output, and the computation itself stay perfectly hidden.
  - guarantee: information-theoretic blindness; the server's classical and quantum views are independent of the client's input (with an epsilon-blindness statistical relaxation for imperfect sources).
  - quote: "The client wishes to delegate their computation \hl{in such a way that their input, output and computation remain perfectly hidden from the server."
- **Verifiable blind quantum computation (trap-based verification)** - augments blind delegation with hidden trap qubits so the client can detect an incorrect or malicious server execution.
  - guarantee: interactive soundness; corrupting the computation while avoiding the traps happens with negligible probability, and the scheme has been proven composably secure and compatible with fault-tolerant computation.
  - quote: "In other words, one needs a protocol in which corrupting the computation while avoiding the traps happens with negligible probability."
- **Classical-client delegation via remote state preparation** - replaces the quantum channel from client to server with a classical interaction, letting a fully classical client instruct a quantum server to prepare BB84 states blindly.
  - guarantee: computational soundness only, resting on the hardness of Learning-With-Errors and trapdoor claw-free or collision-resistant functions; information-theoretic blindness with a classical client is impossible.
  - quote: "This enables a classical client to ``replace'' the need for communicating single qubits via a quantum channel with this primitive called ``classical-client remote state preparation'' (CC-RSP)."
- **Quantum fully homomorphic encryption** - lets a server apply an arbitrary unitary to an encrypted quantum state, returning the encrypted result with at most one input and one output round of communication, and in verifiable form via trap-based authentication.
  - guarantee: computational security (hardness of the garden-hose model and LWE); polynomial resources but large shared entanglement, with a verifiable variant (vQFHE) checking the evaluation.
  - quote: "The first fully homomorphic quantum encryption (QFHE) scheme was presented in \cite{DSS:Crypto16}."
- **Secure multiparty quantum computation** - lets several mistrustful parties jointly evaluate a quantum circuit on private inputs so each learns nothing beyond its own output.
  - guarantee: simulation-based privacy and (in verifiable variants) correctness, with corruption thresholds such as fewer than n/6 dishonest parties, a non-corrupt majority, or even a single non-corrupt party depending on the construction, built on verifiable quantum secret sharing or quantum authentication codes.
  - quote: "This solution enables the secure computation of any efficient quantum circuit, provided that no more than $n/6$ parties are dishonest."
- **Quantum message authentication** - authenticates a transmitted quantum state using a shared classical key by encrypting it, mixing in check qubits, and applying a quantum error-correcting code.
  - guarantee: information-theoretic integrity (existential unforgeability under chosen message attack); requires at least 2m key bits per m-qubit message and necessarily encrypts the message, with publicly verifiable signing of quantum messages proven impossible.
  - quote: "The approach proposed in \cite{BCG:IEEE02} is to encrypt the message $\ket m$ as in Section \ref{sec:privchannel}, mix it with some fixed maximally-mixed check qubits and apply a quantum error-correcting code."

## Where it could apply

- Target primitive(s): arbitrary delegated quantum circuits, including VQE, QAOA, QPE, sampling, and Trotterised simulation run on an untrusted server; Clifford plus T-gate circuits for the homomorphic variants.
- Target application group(s): platforms_tooling (delegated and cloud quantum computing, verification of quantum hardware claims), quantum_ml and chemistry_materials and finance and optimization (any workload delegated to an untrusted quantum server needing input or output privacy or correctness guarantees).
- Code family / hardware assumptions: photonic qubits for the client-server quantum channel (polarization, MBQC cluster states, GHZ and W states); matter qubits (trapped ions, superconducting, neutral atoms, silicon) for the server-side computation, with hybrid photon-matter interfaces; quantum error-correcting codes and fault-tolerant computation assumed for the verifiable and multiparty variants; classical-client variants assume LWE hardness and a powerful quantum server.

## Caveats

This is a review article, not a primary result, so it supplies established constructions rather than a single new method; the technique bullets above are the survey's consolidated capabilities and the verbatim quotes attribute each to its originating reference. The information-theoretic guarantees (blind and verifiable computation, quantum authentication) are strong, but the classical-client and homomorphic variants are only computationally secure and the review explicitly notes they cannot practically replace a quantum channel unless the application already involves a quantum-capable server. The multiparty and homomorphic schemes carry large overheads (quadratic or constant-factor blow-ups, substantial shared entanglement) and most sit firmly in the fault-tolerant era. Composable security holds only for some schemes and only under added assumptions such as a common reference string.