1. Non-interactive quantum zero-knowledge proofs
Quantum “Fiat-Shamir”
Dominique Unruh
University of Tartu

2. Quantum NIZK with random oracle
Intro: Proof systems
Statement x Witness w P V
Statement x
Soundness: Verifier accepts only true statements
Zero-knowledge: Verifier learns nothing
Quantum NIZK with random oracle

3. Quantum NIZK with random oracle
Intro: Proof systems
Sigma-protocols
Non-interactive ZK P V
proof P V
commitment
challenge
response
Ease of use
Concurrency, offline
Need RO or CRS
Lack of combiners
Specific languages
Specific 3-round proofs
Versatile combiners
Simple to analyze
Weak security
Quantum NIZK with random oracle

4. Intro: Best of two worlds
Fiat-Shamir: Convert sigma-proto into NIZK
Ease of use (concurrent, offline)
Versatile combiners
Simple analysis
Uses random oracle P V
commitment
challenge
response P V
com, H(com), resp
Quantum NIZK with random oracle

5. Intro: Best of two world (ctd.)
Fiat-Shamir also implies:
Sigma-proto  signatures (in RO)
Fischlin’s scheme:
Also: sigma-proto  NIZK (in RO)
No rewinding (online extraction)
Less efficient
Quantum NIZK with random oracle

6. Post-quantum security
Quantum computers
Potential future threat
Not there yet, but we need to be prepared
Post-quantum cryptography
Classical crypto, secure against quantum attack
Is Fiat-Shamir post-quantum secure?
Quantum NIZK with random oracle

7. Fiat-Shamir soundness
Quantum P V
com, H(com), resp
Fiat-Shamir:
Can be seen as:
Rewinding  Get two responses
“Special soundness” of sigma-proto  Compute witness P H
com
chal := H(com)
response V
Superposition queries
messed-up state
Quantum NIZK with random oracle

8. Saving (quantum) Fiat-Shamir?
Existing quantum rewinding techniques
Watrous / Unruh
Do not work with superposition queries
Ambainis, Rosmanis, Unruh:
No relativizing security proof
Consequence: Avoid rewinding!
Quantum NIZK with random oracle

9. NIZK without rewinding
Fischlin’s scheme:
No rewinding
Online extraction: List of queries  Witness
But again: No relativizing security proof
List of queries:
Not well-defined: need to measure to get them
Disturbs state
Quantum NIZK with random oracle

10. Quantum online-extraction
Prover: 𝑥
Idea:
Make RO invertible (for extractor)
Ensure: all needed outputs contained in proof P H
𝐻(𝑥)
proof
Extractor:
H -1 𝑥
witness
Quantum NIZK with random oracle

11. Protocol construction
𝑥𝑥𝑥
hash invertibly
( )
𝑐 ℎ𝑎𝑙 11 𝑐 ℎ𝑎𝑙 12 ⋮ 𝑐 ℎ𝑎𝑙 1𝑚
𝑟𝑒𝑠 𝑝 11 𝑟𝑒𝑠 𝑝 12 ⋮ 𝑟𝑒𝑠 𝑝 1𝑚
𝑟𝑒𝑠 𝑝 12
𝑐𝑜 𝑚 𝑐𝑜 𝑚 ⋮ 𝑐𝑜 𝑚 𝑡
𝑐 ℎ𝑎𝑙 21 𝑐 ℎ𝑎𝑙 22 ⋮ 𝑐 ℎ𝑎𝑙 2𝑚
𝑟𝑒𝑠 𝑝 21 𝑟𝑒𝑠 𝑝 22 ⋮ 𝑟𝑒𝑠 𝑝 2𝑚
all this together is the proof
𝑟𝑒𝑠 𝑝 2𝑚 ⋮
W.h.p. at least one 𝑐𝑜𝑚 has two valid 𝑟𝑒𝑠𝑝
Extractor gets them by inverting hash
Two 𝑟𝑒𝑠𝑝  witness
𝑐 ℎ𝑎𝑙 𝑡1 𝑐 ℎ𝑎𝑙 𝑡2 ⋮ 𝑐 ℎ𝑎𝑙 𝑡𝑚
𝑟𝑒𝑠 𝑝 𝑡1 𝑟𝑒𝑠 𝑝 𝑡2 ⋮ 𝑟𝑒𝑠 𝑝 𝑡𝑚
𝑟𝑒𝑠 𝑝 𝑡1
Hash to get selection what to open (Fiat-Shamir style)
Quantum NIZK with random oracle

12. Invertible random oracle
Random functions: not invertible
Zhandry: RO ≈ 2𝑞-wise indep. Function
Idea: Use invertible 2𝑞-wise indep. function
Problem: None known
Solution: Degree 2𝑞 polynomials
Almost invertible (2𝑞 candidates)
Good enough
Quantum NIZK with random oracle

13. Quantum NIZK with random oracle
Final result
Theorem:
If the sigma-protocol has:
Honest verifier zero-knowledge
Special soundness
Then our protocol is:
Zero-knowledge
Simulation-sound online extractable
Quantum NIZK with random oracle

14. Quantum NIZK with random oracle
Further results
Strongly unforgeable signatures (implied by the NIZK)
New results for adaptive programming of quantum random oracle
Invertible oracle trick (also used for variant of Fujisaki-Okamoto)
Quantum NIZK with random oracle

15. Quantum NIZK with random oracle
Saving Fiat-Shamir? P H
|𝑐𝑜𝑚〉
𝑐ℎ𝑎𝑙 ≔|𝐻 𝑐𝑜𝑚 〉
𝑟𝑒𝑠𝑝 V
Superposition queries, as many as P wants
Zero-knowledge: yes (same as for our proto)
Soundness: no [Ambainis Rosmanis U]
Measuring 𝑐ℎ𝑎𝑙 disturbs state
Hope: Soundness if underlying sigma-protocol has “strict soundness” / “unique responses”
Quantum NIZK with random oracle

16. Quantum NIZK with random oracle
Strict soundness P H
|𝑐𝑜𝑚〉
𝑐ℎ𝑎𝑙 ≔|𝐻 𝑐𝑜𝑚 〉
𝑟𝑒𝑠𝑝 V
Superposition queries, as many as P wants
Strict soundness: Given com, chall: at most one possible resp
Helped before, for “proofs of knowledge”
Measuring response not disturbing (much)
Quantum NIZK with random oracle

17. Saving Fiat-Shamir now?
With strict soundness: no counterexample
Proof still unclear (how to rewinding without disturbing quantum queries)
Can be reduced to query-complexity problem
Quantum NIZK with random oracle

18. The query complexity problem
Let 𝑀 𝐻 be a quantum circuit, using random oracle 𝐻, implementing a projective measurement
Game 1: State |Ψ〉, apply 𝑦 1 ≔𝑀 𝐻 .
Game 2: State |Ψ〉, apply 𝑦 1 ≔𝑀 𝐻 , apply 𝑦 2 ≔𝑀 𝐻( 𝑦 1 ≔𝑟𝑎𝑛𝑑𝑜𝑚) .
Show: Pr 𝑦 1 = 𝑦 2 ≠ ⊥ :Game 2 ≥ Pr⁡ 𝑦 1 ≠ ⊥ : Game 1 poly(#𝑞𝑢𝑒𝑟𝑖𝑒𝑠)
Quantum NIZK with random oracle

19. I thank for your attention
This research was supported by European Social Fund’s Doctoral Studies and Internationalisation Programme DoRa