Non-interactive quantum zero-knowledge proofs Quantum “Fiat-Shamir” Dominique Unruh University of Tartu

Quantum NIZK with random oracle Intro: Proof systems Statement x Witness w P V Statement x Soundness: Verifier accepts only true statements Zero-knowledge: Verifier learns nothing Quantum NIZK with random oracle

Quantum NIZK with random oracle Intro: Proof systems Sigma-protocols Non-interactive ZK P V proof P V commitment challenge response Ease of use Concurrency, offline Need RO or CRS Lack of combiners Specific languages Specific 3-round proofs Versatile combiners Simple to analyze Weak security Quantum NIZK with random oracle

Intro: Best of two worlds Fiat-Shamir: Convert sigma-proto into NIZK Ease of use (concurrent, offline) Versatile combiners Simple analysis Uses random oracle P V commitment challenge response P V com, H(com), resp Quantum NIZK with random oracle

Intro: Best of two world (ctd.) Fiat-Shamir also implies: Sigma-proto  signatures (in RO) Fischlin’s scheme: Also: sigma-proto  NIZK (in RO) No rewinding (online extraction) Less efficient Quantum NIZK with random oracle

Post-quantum security Quantum computers Potential future threat Not there yet, but we need to be prepared Post-quantum cryptography Classical crypto, secure against quantum attack Is Fiat-Shamir post-quantum secure? Quantum NIZK with random oracle

Fiat-Shamir soundness Quantum P V com, H(com), resp Fiat-Shamir: Can be seen as: Rewinding  Get two responses “Special soundness” of sigma-proto  Compute witness P H com chal := H(com) response V Superposition queries messed-up state Quantum NIZK with random oracle

Saving (quantum) Fiat-Shamir? Existing quantum rewinding techniques Watrous / Unruh Do not work with superposition queries Ambainis, Rosmanis, Unruh: No relativizing security proof Consequence: Avoid rewinding! Quantum NIZK with random oracle

NIZK without rewinding Fischlin’s scheme: No rewinding Online extraction: List of queries  Witness But again: No relativizing security proof List of queries: Not well-defined: need to measure to get them Disturbs state Quantum NIZK with random oracle

Quantum online-extraction Prover: 𝑥 Idea: Make RO invertible (for extractor) Ensure: all needed outputs contained in proof P H 𝐻(𝑥) proof Extractor: H -1 𝑥 witness Quantum NIZK with random oracle

Protocol construction 𝑥𝑥𝑥 hash invertibly ( ) 𝑐 ℎ𝑎𝑙 11 𝑐 ℎ𝑎𝑙 12 ⋮ 𝑐 ℎ𝑎𝑙 1𝑚 𝑟𝑒𝑠 𝑝 11 𝑟𝑒𝑠 𝑝 12 ⋮ 𝑟𝑒𝑠 𝑝 1𝑚 𝑟𝑒𝑠 𝑝 12 𝑐𝑜 𝑚 1 𝑐𝑜 𝑚 2 ⋮ 𝑐𝑜 𝑚 𝑡 𝑐 ℎ𝑎𝑙 21 𝑐 ℎ𝑎𝑙 22 ⋮ 𝑐 ℎ𝑎𝑙 2𝑚 𝑟𝑒𝑠 𝑝 21 𝑟𝑒𝑠 𝑝 22 ⋮ 𝑟𝑒𝑠 𝑝 2𝑚 all this together is the proof 𝑟𝑒𝑠 𝑝 2𝑚 ⋮ W.h.p. at least one 𝑐𝑜𝑚 has two valid 𝑟𝑒𝑠𝑝 Extractor gets them by inverting hash Two 𝑟𝑒𝑠𝑝  witness 𝑐 ℎ𝑎𝑙 𝑡1 𝑐 ℎ𝑎𝑙 𝑡2 ⋮ 𝑐 ℎ𝑎𝑙 𝑡𝑚 𝑟𝑒𝑠 𝑝 𝑡1 𝑟𝑒𝑠 𝑝 𝑡2 ⋮ 𝑟𝑒𝑠 𝑝 𝑡𝑚 𝑟𝑒𝑠 𝑝 𝑡1 Hash to get selection what to open (Fiat-Shamir style) Quantum NIZK with random oracle

Invertible random oracle Random functions: not invertible Zhandry: RO ≈ 2𝑞-wise indep. Function Idea: Use invertible 2𝑞-wise indep. function Problem: None known Solution: Degree 2𝑞 polynomials Almost invertible (2𝑞 candidates) Good enough Quantum NIZK with random oracle

Quantum NIZK with random oracle Final result Theorem: If the sigma-protocol has: Honest verifier zero-knowledge Special soundness Then our protocol is: Zero-knowledge Simulation-sound online extractable Quantum NIZK with random oracle

Quantum NIZK with random oracle Further results Strongly unforgeable signatures (implied by the NIZK) New results for adaptive programming of quantum random oracle Invertible oracle trick (also used for variant of Fujisaki-Okamoto) Quantum NIZK with random oracle

Quantum NIZK with random oracle Saving Fiat-Shamir? P H |𝑐𝑜𝑚〉 𝑐ℎ𝑎𝑙 ≔|𝐻 𝑐𝑜𝑚 〉 𝑟𝑒𝑠𝑝 V Superposition queries, as many as P wants Zero-knowledge: yes (same as for our proto) Soundness: no [Ambainis Rosmanis U] Measuring 𝑐ℎ𝑎𝑙 disturbs state Hope: Soundness if underlying sigma-protocol has “strict soundness” / “unique responses” Quantum NIZK with random oracle

Quantum NIZK with random oracle Strict soundness P H |𝑐𝑜𝑚〉 𝑐ℎ𝑎𝑙 ≔|𝐻 𝑐𝑜𝑚 〉 𝑟𝑒𝑠𝑝 V Superposition queries, as many as P wants Strict soundness: Given com, chall: at most one possible resp Helped before, for “proofs of knowledge” Measuring response not disturbing (much) Quantum NIZK with random oracle

Saving Fiat-Shamir now? With strict soundness: no counterexample Proof still unclear (how to rewinding without disturbing quantum queries) Can be reduced to query-complexity problem Quantum NIZK with random oracle

The query complexity problem Let 𝑀 𝐻 be a quantum circuit, using random oracle 𝐻, implementing a projective measurement Game 1: State |Ψ〉, apply 𝑦 1 ≔𝑀 𝐻 . Game 2: State |Ψ〉, apply 𝑦 1 ≔𝑀 𝐻 , apply 𝑦 2 ≔𝑀 𝐻( 𝑦 1 ≔𝑟𝑎𝑛𝑑𝑜𝑚) . Show: Pr 𝑦 1 = 𝑦 2 ≠ ⊥ :Game 2 ≥ Pr⁡ 𝑦 1 ≠ ⊥ : Game 1 poly(#𝑞𝑢𝑒𝑟𝑖𝑒𝑠) Quantum NIZK with random oracle

I thank for your attention This research was supported by European Social Fund’s Doctoral Studies and Internationalisation Programme DoRa