Security of the Fiat-Shamir Transformation in the Quantum - - PowerPoint PPT Presentation

▶
security of the fiat shamir transformation in the quantum
SMART_READER_LITE
LIVE PREVIEW

Security of the Fiat-Shamir Transformation in the Quantum - - PowerPoint PPT Presentation

Sep 24, 2023 391 likes •1.38k views

Security of the Fiat-Shamir Transformation in the Quantum Random-Oracle Model Jelle Don, Serge Fehr, Christian Majenz and Christian Schaffner QIP 2020 Hilton Shenzhen Shekou Nanhai Hotel, Shenzhen, China Two facts of life Two facts of life

slide-1
SLIDE 1

Security of the Fiat-Shamir Transformation in the Quantum Random-Oracle Model

Jelle Don, Serge Fehr, Christian Majenz and Christian Schaffner QIP 2020 Hilton Shenzhen Shekou Nanhai Hotel, Shenzhen, China

slide-2
SLIDE 2

Two facts of life

slide-3
SLIDE 3

Two facts of life

  • 1. Interaction is exhausting (=costly).
slide-4
SLIDE 4

Two facts of life

  • 1. Interaction is exhausting (=costly).
  • 2. Testing/verification is more efficient interactively than

noninteractively

slide-5
SLIDE 5

Two facts of life

  • 1. Interaction is exhausting (=costly).
  • 2. Testing/verification is more efficient interactively than

noninteractively Fiat-Shamir reconciles the two in certain cases.

slide-6
SLIDE 6

Outline

  • 1. Introduction
  • Interactive proof systems
  • The Fiat Shamir transformation
  • 2. Results
  • Overview
  • Reduction
  • Techniques
  • 3. Application: Digital Signatures
slide-7
SLIDE 7
  • 1. Introduction
slide-8
SLIDE 8

Interactive proof system

slide-9
SLIDE 9

Interactive proof system

Prover Verifier

slide-10
SLIDE 10

Interactive proof system

Prover Verifier is true!

x

slide-11
SLIDE 11

Interactive proof system

Prover Verifier is true!

x

Prove it!

slide-12
SLIDE 12

Interactive proof system

Prover Verifier is true!

x

Prove it! bla

slide-13
SLIDE 13

Interactive proof system

Prover Verifier is true!

x

Prove it! bla bla

slide-14
SLIDE 14

Interactive proof system

Prover Verifier is true!

x

Prove it! bla bla bla

slide-15
SLIDE 15

Interactive proof system

Prover Verifier is true!

x

Prove it! bla bla bla bla

slide-16
SLIDE 16

Interactive proof system

Prover Verifier is true!

x

Prove it! bla bla bla bla …

slide-17
SLIDE 17

Interactive proof system

Prover Verifier is true!

x

Prove it! bla bla Now I believe that is true…

x

bla bla …

slide-18
SLIDE 18

Interactive proof system

slide-19
SLIDE 19

Interactive proof system

Many cryptographic properties:

slide-20
SLIDE 20

Interactive proof system

Many cryptographic properties:

  • Completeness
slide-21
SLIDE 21

Interactive proof system

Many cryptographic properties:

  • Completeness
  • Soundness
slide-22
SLIDE 22

Interactive proof system

Many cryptographic properties:

  • Completeness
  • Soundness
  • Zero-knowledge
slide-23
SLIDE 23

Interactive proof system

Many cryptographic properties:

  • Completeness
  • Soundness
  • Zero-knowledge
  • Proof-of-knowledge
slide-24
SLIDE 24

Interactive proof system

Many cryptographic properties:

  • Completeness
  • Soundness
  • Zero-knowledge
  • Proof-of-knowledge
  • …
slide-25
SLIDE 25

Interactive proof system

Many cryptographic properties:

  • Completeness
  • Soundness
  • Zero-knowledge
  • Proof-of-knowledge
  • …

}

perfect/statistical/computational

slide-26
SLIDE 26

Interactive proof system

Many cryptographic properties:

  • Completeness
  • Soundness
  • Zero-knowledge
  • Proof-of-knowledge
  • …

Can we do the same without interaction?

}

perfect/statistical/computational

slide-27
SLIDE 27

Interactive proof system

Many cryptographic properties:

  • Completeness
  • Soundness
  • Zero-knowledge
  • Proof-of-knowledge
  • …

Can we do the same without interaction? Yes, at least in some cases, using the Fiat Shamir transformation

}

perfect/statistical/computational

slide-28
SLIDE 28

Prover Verifier is true!

x

Prove it!

a c ∈R 𝒟

Now I believe that is true…

x r

  • protocol

Σ

slide-29
SLIDE 29

Prover Verifier is true!

x

Prove it!

a c ∈R 𝒟

Now I believe that is true…

x r

  • protocol

Σ

“public coin”

slide-30
SLIDE 30

Prover Verifier is true!

x

Prove it!

a c ∈R 𝒟

Now I believe that is true…

x r

Fiat Shamir transformation

slide-31
SLIDE 31

Prover Verifier is true!

x

Prove it!

a c = H(a)

Now I believe that is true…

x r

Fiat Shamir transformation

slide-32
SLIDE 32

Prover Verifier is true!

x

Prove it!

a c = H(a)

Now I believe that is true…

x r

Fiat Shamir transformation

Hash function, “looks random”

slide-33
SLIDE 33

Fiat Shamir transformation

  • Intractability of hash function replaces interaction
slide-34
SLIDE 34

Fiat Shamir transformation

  • Intractability of hash function replaces interaction
  • Yields non-interactive proof system
slide-35
SLIDE 35

Fiat Shamir transformation

  • Intractability of hash function replaces interaction
  • Yields non-interactive proof system
  • Used for digital signature schemes
slide-36
SLIDE 36

Fiat Shamir transformation

  • Intractability of hash function replaces interaction
  • Yields non-interactive proof system
  • Used for digital signature schemes
  • Preserves properties in the Random Oracle Model (ROM)

(Pointcheval & Stern ‘00)

slide-37
SLIDE 37

Fiat Shamir transformation

  • Intractability of hash function replaces interaction
  • Yields non-interactive proof system
  • Used for digital signature schemes
  • Preserves properties in the Random Oracle Model (ROM)

(Pointcheval & Stern ‘00)

Pretend that hash function is random and everybody has oracle access

slide-38
SLIDE 38

Fiat Shamir transformation

  • Intractability of hash function replaces interaction
  • Yields non-interactive proof system
  • Used for digital signature schemes
  • Preserves properties in the Random Oracle Model (ROM)

(Pointcheval & Stern ‘00)

? What about the quantum ROM (QROM)?

slide-39
SLIDE 39

Fiat Shamir transformation

  • Intractability of hash function replaces interaction
  • Yields non-interactive proof system
  • Used for digital signature schemes
  • Preserves properties in the Random Oracle Model (ROM)

(Pointcheval & Stern ‘00)

? What about the quantum ROM (QROM)?

Unruh ’17: The Fiat Shamir transformation preserves some security properties in the QROM if the underlying -protocol is statistically sound.

Σ

slide-40
SLIDE 40

Fiat Shamir transformation

  • Intractability of hash function replaces interaction
  • Yields non-interactive proof system
  • Used for digital signature schemes
  • Preserves properties in the Random Oracle Model (ROM)

(Pointcheval & Stern ‘00)

? What about the quantum ROM (QROM)?

Unruh ’17: The Fiat Shamir transformation preserves some security properties in the QROM if the underlying -protocol is statistically sound.

Σ

Many cases important for post-quantum crypto still open.

slide-41
SLIDE 41
  • 2. Results
slide-42
SLIDE 42

Our results

  • 1. A general reduction for the Fiat Shamir transform in the

QROM.

slide-43
SLIDE 43

Our results

  • 1. A general reduction for the Fiat Shamir transform in the

QROM.

Theorem (Don, Fehr, M, Schaffner):

The Fiat Shamir transformation of a -protocol inherits all its security properties in the QROM.

Σ

slide-44
SLIDE 44

Our results

  • 1. A general reduction for the Fiat Shamir transform in the

QROM.

Theorem (Don, Fehr, M, Schaffner):

The Fiat Shamir transformation of a -protocol inherits all its security properties in the QROM.

Σ

Concurrent work: Liu and Zhandry, less tight reduction.

slide-45
SLIDE 45

Our results

  • 1. A general reduction for the Fiat Shamir transform in the

QROM.

  • 2. A novel criterion for the computational proof-of-knowledge

property for sigma protocols (related to collapsingness)

Theorem (Don, Fehr, M, Schaffner):

The Fiat Shamir transformation of a -protocol inherits all its security properties in the QROM.

Σ

Concurrent work: Liu and Zhandry, less tight reduction.

slide-46
SLIDE 46

Our results

  • 1. A general reduction for the Fiat Shamir transform in the

QROM.

  • 2. A novel criterion for the computational proof-of-knowledge

property for sigma protocols (related to collapsingness)

Theorem (Don, Fehr, M, Schaffner):

The Fiat Shamir transformation of a -protocol inherits all its security properties in the QROM.

Σ

Concurrent work: Liu and Zhandry, less tight reduction.

slide-47
SLIDE 47

𝒝

The reduction

slide-48
SLIDE 48

𝒝

x

The reduction

slide-49
SLIDE 49

𝒝 H

x

The reduction

Random oracle

slide-50
SLIDE 50

𝒝 H

x

The reduction

p = (a, c = H(a), r)

slide-51
SLIDE 51

𝒝 𝒯

Verifier

x

The reduction

slide-52
SLIDE 52

𝒝 𝒯

Verifier

x

The reduction

a c ∈R {0,1}ℓc r

slide-53
SLIDE 53

𝒝 𝒯

Verifier

x

The reduction

slide-54
SLIDE 54

𝒝 𝒯

Verifier

x

The reduction

slide-55
SLIDE 55

𝒝 𝒯

Verifier

x

The reduction

H

slide-56
SLIDE 56

𝒝 𝒯

Verifier

x

The reduction

Measure random query

H

slide-57
SLIDE 57

𝒝 𝒯

a Verifier

x

The reduction

Measure random query

H

use result as

slide-58
SLIDE 58

𝒝 𝒯

a Verifier

x

The reduction

H

slide-59
SLIDE 59

𝒝 𝒯

a c ∈R {0,1}ℓc Verifier

x

The reduction

H

slide-60
SLIDE 60

𝒝 𝒯

a c ∈R {0,1}ℓc Verifier

x

The reduction

use challenge to reprogram

H*

slide-61
SLIDE 61

𝒝 𝒯

a c ∈R {0,1}ℓc Verifier

x

The reduction

H*

slide-62
SLIDE 62

𝒝 𝒯

a c ∈R {0,1}ℓc r Verifier

x

The reduction

H*

use part of output as response

slide-63
SLIDE 63

𝒝 𝒯

a c ∈R {0,1}ℓc r Verifier

x

The reduction

H*

slide-64
SLIDE 64

𝒝 𝒯

a c ∈R {0,1}ℓc r Verifier

x

Success probability: ε(𝒯[𝒝]) ≥ ε(𝒝)

O(q2)

The reduction

H*

slide-65
SLIDE 65

𝒝 𝒯

a c ∈R {0,1}ℓc r Verifier

x

Success probability: ε(𝒯[𝒝]) ≥ ε(𝒝)

O(q2)

The reduction

H*

Why on earth does it work?

slide-66
SLIDE 66

𝒝 𝒯

a c ∈R {0,1}ℓc r Verifier

x

Success probability: ε(𝒯[𝒝]) ≥ ε(𝒝)

O(q2)

The reduction

H*

Why on earth does it work? Intuition: prover needs to measure anyway.

slide-67
SLIDE 67

Technique

Simplified picture: one query.

slide-68
SLIDE 68

Technique

Simplified picture: one query. (without final measurement)

𝒝H|ϕ⟩ = U2OHU1|ϕ⟩

slide-69
SLIDE 69

Technique

Simplified picture: one query. (without final measurement)

𝒝H|ϕ⟩ = U2OHU1|ϕ⟩

for , independently uniformly random

H*(x) = H(x) x ≠ x0 H*(x0)

slide-70
SLIDE 70

Technique

Simplified picture: one query. (without final measurement)

𝒝H|ϕ⟩ = U2OHU1|ϕ⟩

for , independently uniformly random

H*(x) = H(x) x ≠ x0 H*(x0)

“ unless queries on ”, i.e.

⇒ 𝒝H = 𝒝H* 𝒝 x0

slide-71
SLIDE 71

Technique

Simplified picture: one query. (without final measurement)

𝒝H|ϕ⟩ = U2OHU1|ϕ⟩

for , independently uniformly random

H*(x) = H(x) x ≠ x0 H*(x0)

“ unless queries on ”, i.e.

⇒ 𝒝H = 𝒝H* 𝒝 x0

(*) (à la BBBV)

𝒝H*|ϕ⟩ = 𝒝H|ϕ⟩ + U2OH*|x0⟩⟨x0|U1|ϕ⟩ − U2OH|x0⟩⟨x0|U1|ϕ⟩

slide-72
SLIDE 72

Technique

Simplified picture: one query. (without final measurement)

𝒝H|ϕ⟩ = U2OHU1|ϕ⟩

for , independently uniformly random

H*(x) = H(x) x ≠ x0 H*(x0)

“ unless queries on ”, i.e.

⇒ 𝒝H = 𝒝H* 𝒝 x0

(*) (à la BBBV)

𝒝H*|ϕ⟩ = 𝒝H|ϕ⟩ + U2OH*|x0⟩⟨x0|U1|ϕ⟩ − U2OH|x0⟩⟨x0|U1|ϕ⟩

Successful

  • utputs

for some

𝒝H* |x⟩|H*(x)⟩ x

slide-73
SLIDE 73

Technique

Simplified picture: one query. (without final measurement)

𝒝H|ϕ⟩ = U2OHU1|ϕ⟩

for , independently uniformly random

H*(x) = H(x) x ≠ x0 H*(x0)

“ unless queries on ”, i.e.

⇒ 𝒝H = 𝒝H* 𝒝 x0

(*) (à la BBBV)

𝒝H*|ϕ⟩ = 𝒝H|ϕ⟩ + U2OH*|x0⟩⟨x0|U1|ϕ⟩ − U2OH|x0⟩⟨x0|U1|ϕ⟩

Successful

  • utputs

for some

𝒝H* |x⟩|H*(x)⟩ x

Plan: 1. Use (*) to test whether

  • utputs

𝒝H* |x0⟩|H*(x0)⟩

slide-74
SLIDE 74

Technique

Simplified picture: one query. (without final measurement)

𝒝H|ϕ⟩ = U2OHU1|ϕ⟩

for , independently uniformly random

H*(x) = H(x) x ≠ x0 H*(x0)

“ unless queries on ”, i.e.

⇒ 𝒝H = 𝒝H* 𝒝 x0

(*) (à la BBBV)

𝒝H*|ϕ⟩ = 𝒝H|ϕ⟩ + U2OH*|x0⟩⟨x0|U1|ϕ⟩ − U2OH|x0⟩⟨x0|U1|ϕ⟩

Successful

  • utputs

for some

𝒝H* |x⟩|H*(x)⟩ x

Plan: 1. Use (*) to test whether

  • utputs

𝒝H* |x0⟩|H*(x0)⟩

  • 2. Interpret RHS as algorithm
slide-75
SLIDE 75

Technique

(*)

𝒝H*|ϕ⟩ = 𝒝H|ϕ⟩ + U2OH*|x0⟩⟨x0|U1|ϕ⟩ − U2OH|x0⟩⟨x0|U1|ϕ⟩

Plan: 1. Use (*) to test whether

  • utputs

𝒝H* |x0⟩|H*(x0)⟩

  • 2. Interpret RHS as algorithm
slide-76
SLIDE 76

Technique

(*)

𝒝H*|ϕ⟩ = 𝒝H|ϕ⟩ + U2OH*|x0⟩⟨x0|U1|ϕ⟩ − U2OH|x0⟩⟨x0|U1|ϕ⟩

Plan: 1. Use (*) to test whether

  • utputs

𝒝H* |x0⟩|H*(x0)⟩

  • 2. Interpret RHS as algorithm

⟨x0|⟨H*(x0)|𝒝H*|ϕ⟩ = ⟨x0|⟨H*(x0)|𝒝H|ϕ⟩

+⟨x0|⟨H*(x0)|U2OH*|x0⟩⟨x0|U1|ϕ⟩ − ⟨x0|⟨H*(x0)|U2OH|x0⟩⟨x0|U1|ϕ⟩

slide-77
SLIDE 77

(*)

𝒝H|ϕ⟩ = 𝒝H*|ϕ⟩ + U2OH|x0⟩⟨x0|U1|ϕ⟩ − U2OH*|x0⟩⟨x0|U1|ϕ⟩

Plan: 1. Use (*) to test whether

  • utputs

𝒝H |x0⟩|H(x0)⟩

  • 2. Interpret RHS as algorithm

∥⟨x0|⟨H*(x0)|𝒝H*|ϕ⟩∥2 ≤ ∥⟨x0|⟨H*(x0)|𝒝H|ϕ⟩∥2

+∥⟨x0|⟨H*(x0)|U2OH*|x0⟩⟨x0|U1|ϕ⟩∥2 + ∥⟨x0|⟨H*(x0)|U2OH|x0⟩⟨x0|U1|ϕ⟩∥2

Technique

slide-78
SLIDE 78

(*)

𝒝H|ϕ⟩ = 𝒝H*|ϕ⟩ + U2OH|x0⟩⟨x0|U1|ϕ⟩ − U2OH*|x0⟩⟨x0|U1|ϕ⟩

Plan: 1. Use (*) to test whether

  • utputs

𝒝H |x0⟩|H(x0)⟩

  • 2. Interpret RHS as algorithm

∥⟨x0|⟨H*(x0)|𝒝H*|ϕ⟩∥2 ≤ ∥⟨x0|⟨H*(x0)|𝒝H|ϕ⟩∥2

+∥⟨x0|⟨H*(x0)|U2OH*|x0⟩⟨x0|U1|ϕ⟩∥2 + ∥⟨x0|⟨H*(x0)|U2OH|x0⟩⟨x0|U1|ϕ⟩∥2

Technique

Small even after summing over x0

slide-79
SLIDE 79

Measure query, outcome , reprogram before answering

x0

(*)

𝒝H|ϕ⟩ = 𝒝H*|ϕ⟩ + U2OH|x0⟩⟨x0|U1|ϕ⟩ − U2OH*|x0⟩⟨x0|U1|ϕ⟩

Plan: 1. Use (*) to test whether

  • utputs

𝒝H |x0⟩|H(x0)⟩

  • 2. Interpret RHS as algorithm

∥⟨x0|⟨H*(x0)|𝒝H*|ϕ⟩∥2 ≤ ∥⟨x0|⟨H*(x0)|𝒝H|ϕ⟩∥2

+∥⟨x0|⟨H*(x0)|U2OH*|x0⟩⟨x0|U1|ϕ⟩∥2 + ∥⟨x0|⟨H*(x0)|U2OH|x0⟩⟨x0|U1|ϕ⟩∥2

Technique

slide-80
SLIDE 80

(*)

𝒝H|ϕ⟩ = 𝒝H*|ϕ⟩ + U2OH|x0⟩⟨x0|U1|ϕ⟩ − U2OH*|x0⟩⟨x0|U1|ϕ⟩

Plan: 1. Use (*) to test whether

  • utputs

𝒝H |x0⟩|H(x0)⟩

  • 2. Interpret RHS as algorithm

∥⟨x0|⟨H*(x0)|𝒝H*|ϕ⟩∥2 ≤ ∥⟨x0|⟨H*(x0)|𝒝H|ϕ⟩∥2

+∥⟨x0|⟨H*(x0)|U2OH*|x0⟩⟨x0|U1|ϕ⟩∥2 + ∥⟨x0|⟨H*(x0)|U2OH|x0⟩⟨x0|U1|ϕ⟩∥2

Technique

Measure query, outcome , reprogram after answering

x0

slide-81
SLIDE 81

(*)

𝒝H|ϕ⟩ = 𝒝H*|ϕ⟩ + U2OH|x0⟩⟨x0|U1|ϕ⟩ − U2OH*|x0⟩⟨x0|U1|ϕ⟩

Plan: 1. Use (*) to test whether

  • utputs

𝒝H |x0⟩|H(x0)⟩

  • 2. Interpret RHS as algorithm

∥⟨x0|⟨H*(x0)|𝒝H*|ϕ⟩∥2 ≤ ∥⟨x0|⟨H*(x0)|𝒝H|ϕ⟩∥2

+∥⟨x0|⟨H*(x0)|U2OH*|x0⟩⟨x0|U1|ϕ⟩∥2 + ∥⟨x0|⟨H*(x0)|U2OH|x0⟩⟨x0|U1|ϕ⟩∥2

Technique

slide-82
SLIDE 82

(*)

𝒝H|ϕ⟩ = 𝒝H*|ϕ⟩ + U2OH|x0⟩⟨x0|U1|ϕ⟩ − U2OH*|x0⟩⟨x0|U1|ϕ⟩

Plan: 1. Use (*) to test whether

  • utputs

𝒝H |x0⟩|H(x0)⟩

  • 2. Interpret RHS as algorithm

∥⟨x0|⟨H*(x0)|𝒝H*|ϕ⟩∥2 ≤ ∥⟨x0|⟨H*(x0)|𝒝H|ϕ⟩∥2

+∥⟨x0|⟨H*(x0)|U2OH*|x0⟩⟨x0|U1|ϕ⟩∥2 + ∥⟨x0|⟨H*(x0)|U2OH|x0⟩⟨x0|U1|ϕ⟩∥2 Square, Jensen’s inequality RHS: success probability of reduction, reprogramming before/after the measured query at random

⇒

Technique

slide-83
SLIDE 83

(*)

𝒝H|ϕ⟩ = 𝒝H*|ϕ⟩ + U2OH|x0⟩⟨x0|U1|ϕ⟩ − U2OH*|x0⟩⟨x0|U1|ϕ⟩

Plan: 1. Use (*) to test whether

  • utputs

𝒝H |x0⟩|H(x0)⟩

  • 2. Interpret RHS as algorithm

∥⟨x0|⟨H*(x0)|𝒝H*|ϕ⟩∥2 ≤ ∥⟨x0|⟨H*(x0)|𝒝H|ϕ⟩∥2

+∥⟨x0|⟨H*(x0)|U2OH*|x0⟩⟨x0|U1|ϕ⟩∥2 + ∥⟨x0|⟨H*(x0)|U2OH|x0⟩⟨x0|U1|ϕ⟩∥2 Square, Jensen’s inequality RHS: success probability of reduction, reprogramming before/after the measured query at random

⇒

queries: use (*) for each query. loss from Jensen, interpretation as expectation value

q O(q2)

Technique

slide-84
SLIDE 84
  • 3. Application: Digital

Signatures

slide-85
SLIDE 85

Prover Verifier for !

∃sk pk

Prove it!

Identification scheme Identification scheme

sk

Now I believe for …

∃sk pk a c ∈R 𝒟 r pk

slide-86
SLIDE 86

Prover Verifier for !

∃sk pk

Prove it!

Identification scheme

sk

Now I believe that Prover has for …

sk pk a c ∈R 𝒟 r pk

slide-87
SLIDE 87

Prover Verifier for !

∃sk pk

Prove it!

Identification scheme

sk

Now I believe that Prover has for …

sk pk

Still private!

a c ∈R 𝒟 r pk

slide-88
SLIDE 88

Prover Verifier for !

∃sk pk

Prove it!

Identification scheme

sk

Now I believe that Prover has for …

sk pk

Still private!

a c ∈R 𝒟 r

An Identification scheme is a zero-knowledge proof of knowledge of a private key.

pk

slide-89
SLIDE 89

pk

Prover Verifier for !

∃sk pk

Prove it!

Noninteractive Identification scheme

sk

Now I believe that Prover has for …

sk pk a c = H(a) r

slide-90
SLIDE 90

pk

Prover Verifier for !

∃sk pk

Prove it!

Digital signature scheme

sk

Now I believe that Prover has used to sign

sk m a c = H(a∥m) r

slide-91
SLIDE 91

Fiat Shamir signatures

Several NIST post-quantum candidates use Fiat Shamir:

slide-92
SLIDE 92

Fiat Shamir signatures

Several NIST post-quantum candidates use Fiat Shamir:

  • Picnic
  • Dilithium
  • MQDSS
  • QTesla
slide-93
SLIDE 93

Fiat Shamir signatures

Several NIST post-quantum candidates use Fiat Shamir:

  • Picnic
  • Dilithium
  • MQDSS
  • QTesla

Our result QROM security

⇒

slide-94
SLIDE 94

Fiat Shamir signatures

Several NIST post-quantum candidates use Fiat Shamir:

  • Picnic
  • Dilithium
  • MQDSS
  • QTesla

Improved efficiency! Our result QROM security

⇒

slide-95
SLIDE 95

Fiat Shamir signatures

Several NIST post-quantum candidates use Fiat Shamir:

  • Picnic
  • Dilithium
  • MQDSS
  • QTesla

⇒

Improved efficiency! Our result QROM security

⇒

slide-96
SLIDE 96

Further applications

Remove almost all interaction from Mahadev’s verification for BQP (Alagic, Childs, Hung ’19)

slide-97
SLIDE 97

Summary

The Fiat Shamir transformation is secure in the quantum random

  • racle model.

This fact has nice applications, in particular for post-quantum secure digital signature schemes. Open problem: quantum forking lemma?

∃

slide-98
SLIDE 98

Thanks!