Security of the Fiat-Shamir Transformation in the Quantum Random - - PowerPoint PPT Presentation

Security of the Fiat-Shamir Transformation in the Quantum Random Oracle Model

Serge Fehr

CWI and Leiden University

Jelle Don

CWI

Chris Majenz

UvA

Chris Schaffner

UvA

• Theorem. If S is secure (against a dishonest prover),

then FS[S] is secure (against a dishonest prover) in the quantum random oracle model (QROM).

Our Result in Short

Holds for any (reasonable) notion of security.

• Proof. Transformation: P attacking FS[S] ⇝ Pʹ attacking S.

Let S be a S-protocol, FS[S] its Fiat-Shamir transformation.

S-Protocols

A S-protocol is an interactive proof of a special form to prove x Î L, i.e., $ w : s.t. (x,w) satisfies relation R without revealing w Examples (for L): L = {x Î Z | $ w : w2 º x (mod N)} for a composite N . L = {(a,b,c) Î G3 | $ w : a = gw, c = bw} for a group G = ágñ . L = {(G0,G1) Î Graph2 | $ p ÎPerm : G1 = p(G0)}.

S-Protocol for Graph Isomorphism

PROVER P

G0,G1 I want to prove that G0 and G1 are isomorphic without revealing p

VERIFIER V

s ¬ Perm H := s(G0) c c ¬ {0,1} t := s ∘ p-c H = t(Gc)

?

Probability can be “boosted” by repeating the proof: if repeated k times, then V accepts false proof with prob. 1/2k. Assume that G0 ≄G1, i.e. $ ⁄ p ÎPerm : G1 = p(G0) Consider arbitrary (possibly dishonest) prover P

Analysis (of Soundness)

Either H ≄G0 or H ≄G1 (or both) ⇒ P fails to answer c with probability 1/2.

s ¬ Perm H := s(G0) c ¬ {0,1} t := s ∘ p-c H = t(Gc)

?

c GI Proof

Probability can be “boosted” by repeating the proof: if repeated k times, then V accepts false proof with prob. 1/2k. Assume that G0 ≄G1, i.e. $ ⁄ p ÎPerm : G1 = p(G0) Consider arbitrary (possibly dishonest) prover P

Analysis (of Soundness)

Either H ≄G0 or H ≄G1 (or both) ⇒ P fails to answer c with probability 1/2.

s ¬ Perm H := s(G0) c ¬ {0,1} t := s ∘ p-c H = t(Gc)

?

c GI Proof

What about privacy (V not learning p)? V obviously does not obtain p “in the clear”. Can show: V learns no info at all on p (zero-knowledge). Can show something stronger (proof of knowledge): If P succeeds with good probability then he must know p .

The Fiat-Shamir Transformation

PROVER P VERIFIER V

a c c ¬ {0,1}n z V(x,a,c,z) ? := H(a) c x,w x

FS

a z ,z) ? V(x,a,H(a) p = ( , ) S FS[S]

The Fiat-Shamir Transformation

PROVER P VERIFIER V

a c c ¬ {0,1}n z V(x,a,c,z) ? := H(a) c x,w x

FS

a z ,z) ? V(x,a,H(a) p = ( , ) S FS[S] Hope is: if H is a “good” cryptographic hash function that behaves like a random function then FS[S] inherits security properties of S Works well in practice - cannot be proven.

The Fiat-Shamir Transformation

PROVER P VERIFIER V

a c c ¬ {0,1}n z V(x,a,c,z) ? := H(a) c x,w x

FS

a z ,z) ? V(x,a,H(a) p = ( , ) S FS[S] Hope is: if H is a “good” cryptographic hash function that behaves like a random function then FS[S] inherits security properties of S Works well in practice - cannot be proven. Side remark: Understanding x as public key and w as secret key, and setting c := H(m,a), a proof p forms a signature on m (can be computed only by someone who knows w).

The Random Oracle Model - in the context here

PROVER P VERIFIER V

c := H(a) x,w x p = (a,z) V(x,a,H(a),z) FS[S] Idea: not let H be fixed function known to P and V accessible (only) via an oracle - the random oracle (RO) but instead let H be random function unknown to P and V

RO

a H(a) a H(a)

S versus FS[S] in the RO Model

PROVER P

x,w FS[S]

RO

a H(a) p = (a,z)

PROVER P

x,w a c z versus S

S versus FS[S] in the RO Model

PROVER P

FS[S]

RO

p = (a,z)

PROVER P

a c z versus S Dishonest prover P can query the RO many times

• Theorem. If S is secure then FS[S] is secure in the ROM.

Security of FS[S] in the (classical) RO Model

Security is w.r.t. any notion regarding a dishonest prover P: secure Î {comp./stat. sound, comp./stat. proof-of-knowledge} Classical result: The RO heuristic then suggests security in real life if using a “good enough” cryptographic hash function (Cannot be proven, but works well in practice) Remark: This RO methodology is used throughout crypto (to avoid no-go results, obtain more efficient schemes)

The Proof

a1 H(a1) ai aq a,z

aʹ cʹ zʹ

… …

Pr[V(x,a,H(a),z) ] ³ d choose i ←{1,..,q} set aʹ := ai from i-th query on answer with Hʹ where Hʹ(ai) = Hʹ(aʹ) := cʹ and Hʹ := H otherwise

P Pʹ

set zʹ := z

Transformation: P attacking FS[S] in ROM ⇝ Pʹ attacking S

Hʹ(ai) Hʹ(aq)

The Proof

a1 H(a1) ai aq a,z

aʹ cʹ zʹ

… …

Pr[V(x,a,H(a),z) ] ³ d choose i ←{1,..,q} set aʹ := ai from i-th query on answer with Hʹ where Hʹ(ai) = Hʹ(aʹ) := cʹ and Hʹ := H otherwise

P Pʹ

set zʹ := z

Pr[V(x,aʹ,cʹ,zʹ) ] > d/q

~

Transformation: P attacking FS[S] in ROM ⇝ Pʹ attacking S Need to make sure: a = ai Pr[V(x,a,Hʹ(a),z) ] ³ d Easy to see: holds with prob. »1/q

Hʹ(ai) Hʹ(aq)

Part II: The Quantum Random Oracle Model

FS[S] in the Quantum RO Model (QROM)

PROVER P

FS[S]

RO

p = (a,z) Dishonest prover P can query the RO many times and in quantum superposition, i.e. åba|añ ↦ åba|añ |H(a)ñ

a a

If dishonest P is equipped with a quantum computer in real life: P can compute H in quantum superposition in RO model: must allow P superposition queries

• Theorem. If S is secure then FS[S] is secure in the ROM.

Bit Question

(here: security always refers to dishonest prover P) Classical result:

Is that still true in the Quantum ROM???

What’s the Problem?

åba1|a1ñ åba1|a1ñ |H(a1)ñ a,z

aʹ cʹ zʹ

… …

Pr[V(x,a,H(a),z) ] ³ d choose i ←{1,..,q} set aʹ := ai from i-th query on answer with Hʹ where Hʹ(ai) = Hʹ(aʹ) := cʹ and Hʹ := H otherwise

P Pʹ

set zʹ := z åbai|aiñ åbai|aiñ |Hʹ (ai)ñ åbaq|aqñ åbaq|aqñ |Hʹ (aq)ñ

???

Problem: Disturbs the state Unclear how this affects P Natural approach: Measure åbai|aiñ to obtain aʹ

Known Results

Partial positive results [Unruh15 & 17]: Security of another, less efficient, transformation S is statistically sound ⇒ FS[S] computationally sound in the QROM. Negative claims: [DFG13] claim impossibility for proof-of-knowledge [Unruh17] claims necessity of stat-to-comp degradation (both claims have unconvincing reasoning)

• Theorem. If S is secure then FS[S] is secure in the QROM.

Our Result

Also here: security is w.r.t. secure Î {comp./stat. sound, comp./stat. proof-of-knowledge}

• r any reasonable notion regarding a dishonest prover P.

Small caveat: Our security reduction is less tight: q2 loss, rather than q. Remark: In independent work, Lie & Zhandry showed the same kind of result, but with a q9 loss.

Intuition

åba1|a1ñ åba1|a1ñ |H(a1)ñ a,z

… …

Pr[V(x,a,H(a),z) ] ³ d choose i ←{1,..,q} set aʹ := ai obtained by measuring from i-th query on answer with Hʹ Recall: Hʹ(ai) = Hʹ(aʹ) := cʹ and Hʹ := H otherwise

P Pʹ

set zʹ := z

Natural approach:

åbai|aiñ |aiñ |cʹñ åbaq|aqñ åbaq|aqñ |Hʹ (aq)ñ

aʹ cʹ zʹ

Intuition

åba1|a1ñ åba1|a1ñ |H(a1)ñ a,z

… …

Pr[V(x,a,H(a),z) ] ³ d choose i ←{1,..,q} set aʹ := ai obtained by measuring from i-th query on answer with Hʹ Recall: Hʹ(ai) = Hʹ(aʹ) := cʹ and Hʹ := H otherwise

P Pʹ

set zʹ := z

Natural approach:

åbai|aiñ |aiñ |cʹñ åbaq|aqñ åbaq|aqñ |Hʹ (aq)ñ

aʹ cʹ zʹ But: such detection destroys info gained on H ! Problem: May be detected by P ! Can this be turned into a rigorous proof ? No! Thus: should work if i is the query where P learns H(a)

A Small Tweak

åba1|a1ñ åba1|a1ñ |H(a1)ñ a,z

… …

Pr[V(x,a,H(a),z) ] ³ d choose i ←{1,..,q} set aʹ := ai obtained by measuring

P Pʹ

set zʹ := z

Our approach:

åbai|aiñ |aiñ |cʹñ

• r |aiñ

|H(ai)ñ åbaq|aqñ åbaq|aqñ |Hʹ (aq)ñ

aʹ cʹ zʹ

Recall: Hʹ(ai) = Hʹ(aʹ) := cʹ and Hʹ := H otherwise from i-th query on answer with Hʹ

• r (i +1)-st

Remark: The uniformly random H can be dealt with by replacing it with a 2q-wise independent function.

Part III: The Proof

For fixed aʹ, let PH = å |aʹñ áaʹ|Ä|H(aʹ)ñ áH(aʹ)|Ä|zñ áz| be the projection/measurement that measures a,h,z and checks if a = aʹ, h = H(a) and V(x,a,H(a),z) .

Preliminaries

Assume wlog: P makes all measurements at the end Let |f0ñ be P’s initial state

… … …

a h z |f0ñ |fiñ P

z :V(x,aʹ,H(aʹ),z)

|fqñ be unitary from query j to i Î {0,...,q -1} UH

ji

UH

ji

|fiñ := |f0ñ be P’s state at query i UH

0i

(the “continuation” of P) ΠH

iq := ΠHU H iq

• utputs h = H(a) as well.

For fixed aʹ, let PH = å |aʹñ áaʹ|Ä|H(aʹ)ñ áH(aʹ)|Ä|zñ áz| be the projection/measurement that measures a,h,z and checks if a = aʹ, h = H(a) and V(x,a,H(a),z) .

Preliminaries

Assume wlog: P makes all measurements at the end Let |f0ñ be P’s initial state

… … …

a h z |f0ñ |fiñ P

z :V(x,aʹ,H(aʹ),z)

|fqñ be unitary from query j to i Î {0,...,q -1} UH

ji

UH

ji

|fiñ := |f0ñ be P’s state at query i UH

0i

(the “continuation” of P) ΠH

iq := ΠHU H iq

We are interested in where A = |aʹñ áaʹ |, and Hʹ(aʹ) := cʹ and Hʹ(a) := H(a) for a ¹ aʹ

i,b,cʹ

E

• ΠH0

i+bqU H ii+bA|φii

• 2

Want: E

• ΠH0

i+bqU H ii+bA|φii

• 2 &
• ΠH

0q|φ0i

• 2

• utputs h = H(a) as well.

It thus holds that = Pr[a = aʹ ÙV(x,a,H(a),z) ]

• ΠH

0q|φ0i

• 2

The Math

Observe that = ΠH0

iqA|φii + ΠH0 i+1qU H0 ii+1(IA)|φii

= ΠH0

iqA|φii + ΠH0 i+1qU H ii+1(IA)|φii

= ΠH0

iqA|φii + ΠH0 i+1q|φi+1i ΠH0 i+1qU H ii+1A|φii

ΠH0

iq|φii

= ΠH0

iqA|φii + ΠH0 iq(IA)|φii

Want: E

• ΠH0

i+bqU H ii+bA|φii

• 2 &
• ΠH

0q|φ0i

• 2

Observe that = ΠH0

iqA|φii + ΠH0 i+1q|φi+1i ΠH0 i+1qU H ii+1A|φii

ΠH0

iq|φii

Adding up from i = 0 to q -1, we get By rearranging terms, taking norms, applying ∆-inequality: X

i,b

• ΠH0

i+bqU H ii+bA|φii

• ΠH0

0q|φ0i

• ΠH0|φqi
• <latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit><latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit><latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit><latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit>

= ΠH0|φqi + X

i

• ΠH0

iqA|φii ΠH0 i+1qU H ii+1A|φii

• <latexit sha1_base64="17brCmokxdY8yL6A10QCaTnF0=">ACunicdVHbtNAEF2bWwmXBvpGX0aNEUVlY1aLhJIKby0PAWJtJXiYK03G3uVvbi7Y6rI5K/4mX5Ff4FN6kgBwkgrHZ0zZzR7JiulcBhFV0F46/adu/c27rcePHz0eLP95OmpM5VlvM+MNPY8o45LoXkfBUp+XlpOVSb5WTb5PNfPfnDrhNHfcFryoaK5FmPBKHoqbf/6CElPfK+PX8zgZ1IWIr1ILNW5LAHiatUKiDJRC53l21p7RlXGItW5AVSa80lXMzgqPGLpf8VwIpnL17r6nt9/Ujv+HfofBX7Mm13ov1oUbACDqP4/ZsY4obpkKZ6afs6GRlWKa6RSercI5KHNbUomCSz1pJ5XhJ2YTmfOChpoq7Yb1IdwbPTOCsbH+aYQFu+qoqXJuqjLfqSgW7m9tTq7VHCpqp3a0ThxUOH43rIUuK+Sa3WwxriSgfkdYSQsZyinHlBmhf8IsIJaytBfu+UTWsYA/wenr/dj78edLqfmqw2yDbZIbskJm9JlxyTHukTFjwLusFJ8CX8EGahCc3rWHQeLbIHxXiby4I2Hc=</latexit><latexit sha1_base64="17brCmokxdY8yL6A10QCaTnF0=">ACunicdVHbtNAEF2bWwmXBvpGX0aNEUVlY1aLhJIKby0PAWJtJXiYK03G3uVvbi7Y6rI5K/4mX5Ff4FN6kgBwkgrHZ0zZzR7JiulcBhFV0F46/adu/c27rcePHz0eLP95OmpM5VlvM+MNPY8o45LoXkfBUp+XlpOVSb5WTb5PNfPfnDrhNHfcFryoaK5FmPBKHoqbf/6CElPfK+PX8zgZ1IWIr1ILNW5LAHiatUKiDJRC53l21p7RlXGItW5AVSa80lXMzgqPGLpf8VwIpnL17r6nt9/Ujv+HfofBX7Mm13ov1oUbACDqP4/ZsY4obpkKZ6afs6GRlWKa6RSercI5KHNbUomCSz1pJ5XhJ2YTmfOChpoq7Yb1IdwbPTOCsbH+aYQFu+qoqXJuqjLfqSgW7m9tTq7VHCpqp3a0ThxUOH43rIUuK+Sa3WwxriSgfkdYSQsZyinHlBmhf8IsIJaytBfu+UTWsYA/wenr/dj78edLqfmqw2yDbZIbskJm9JlxyTHukTFjwLusFJ8CX8EGahCc3rWHQeLbIHxXiby4I2Hc=</latexit><latexit sha1_base64="17brCmokxdY8yL6A10QCaTnF0=">ACunicdVHbtNAEF2bWwmXBvpGX0aNEUVlY1aLhJIKby0PAWJtJXiYK03G3uVvbi7Y6rI5K/4mX5Ff4FN6kgBwkgrHZ0zZzR7JiulcBhFV0F46/adu/c27rcePHz0eLP95OmpM5VlvM+MNPY8o45LoXkfBUp+XlpOVSb5WTb5PNfPfnDrhNHfcFryoaK5FmPBKHoqbf/6CElPfK+PX8zgZ1IWIr1ILNW5LAHiatUKiDJRC53l21p7RlXGItW5AVSa80lXMzgqPGLpf8VwIpnL17r6nt9/Ujv+HfofBX7Mm13ov1oUbACDqP4/ZsY4obpkKZ6afs6GRlWKa6RSercI5KHNbUomCSz1pJ5XhJ2YTmfOChpoq7Yb1IdwbPTOCsbH+aYQFu+qoqXJuqjLfqSgW7m9tTq7VHCpqp3a0ThxUOH43rIUuK+Sa3WwxriSgfkdYSQsZyinHlBmhf8IsIJaytBfu+UTWsYA/wenr/dj78edLqfmqw2yDbZIbskJm9JlxyTHukTFjwLusFJ8CX8EGahCc3rWHQeLbIHxXiby4I2Hc=</latexit><latexit sha1_base64="17brCmokxdY8yL6A10QCaTnF0=">ACunicdVHbtNAEF2bWwmXBvpGX0aNEUVlY1aLhJIKby0PAWJtJXiYK03G3uVvbi7Y6rI5K/4mX5Ff4FN6kgBwkgrHZ0zZzR7JiulcBhFV0F46/adu/c27rcePHz0eLP95OmpM5VlvM+MNPY8o45LoXkfBUp+XlpOVSb5WTb5PNfPfnDrhNHfcFryoaK5FmPBKHoqbf/6CElPfK+PX8zgZ1IWIr1ILNW5LAHiatUKiDJRC53l21p7RlXGItW5AVSa80lXMzgqPGLpf8VwIpnL17r6nt9/Ujv+HfofBX7Mm13ov1oUbACDqP4/ZsY4obpkKZ6afs6GRlWKa6RSercI5KHNbUomCSz1pJ5XhJ2YTmfOChpoq7Yb1IdwbPTOCsbH+aYQFu+qoqXJuqjLfqSgW7m9tTq7VHCpqp3a0ThxUOH43rIUuK+Sa3WwxriSgfkdYSQsZyinHlBmhf8IsIJaytBfu+UTWsYA/wenr/dj78edLqfmqw2yDbZIbskJm9JlxyTHukTFjwLusFJ8CX8EGahCc3rWHQeLbIHxXiby4I2Hc=</latexit>

ΠH0

0q|φ0i

= ΠH0|φqi + X

i,b

(1)b ΠH0

i+bqU H ii+bA|φii

The Math

Want: E

• ΠH0

i+bqU H ii+bA|φii

• 2 &
• ΠH

0q|φ0i

• 2

Want: E

• ΠH0

i+bqU H ii+bA|φii

• 2 &
• ΠH

0q|φ0i

• 2

By rearranging terms, taking norms, applying ∆-inequality: X

i,b

• ΠH0

i+bqU H ii+bA|φii

• ΠH0

0q|φ0i

• ΠH0|φqi
• <latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit><latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit><latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit><latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit>

»

measures a,h and checks if a = aʹ and h =Hʹ (aʹ) := cʹ

⇝ unlikely for random cʹ

The Math

= state P produces when interacting with H

Want: E

• ΠH0

i+bqU H ii+bA|φii

• 2 &
• ΠH

0q|φ0i

• 2

• Ei,b
• ΠH0

i+bqU H ii+bA|φii

• 2 &

1 4q2

• ΠH0

0q|φ0i

• 2

By rearranging terms, taking norms, applying ∆-inequality: X

i,b

• ΠH0

i+bqU H ii+bA|φii

• ΠH0

0q|φ0i

• ΠH0|φqi
• <latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit><latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit><latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit><latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit>

» Dividing by 2q and squaring: Applying Jensen’s inequality: Ei,b

• ΠH0

i+bqU H ii+bA|φii

• 2 &

1 4q2

• ΠH0

0q|φ0i

• 2

The Math

Want: E

• ΠH0

i+bqU H ii+bA|φii

• 2 &
• ΠH

0q|φ0i

• 2

• Ei,b
• ΠH0

i+bqU H ii+bA|φii

• 2 &

1 4q2

• ΠH0

0q|φ0i

• 2

By rearranging terms, taking norms, applying ∆-inequality: X

i,b

• ΠH0

i+bqU H ii+bA|φii

• ΠH0

0q|φ0i

• ΠH0|φqi
• <latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit><latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit><latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit><latexit sha1_base64="h23YyBX8LUadA9AGeyLethtZc=">AC13icdVLbtQwFHVSHmV4DWXJxmJUgQRUCaIPdgU2XQ4S0xaNQ+R4nMSqHxn7hmqURuwQWz6NJV/BL+CZCaIdhitZOjrnvnzsrJLCQRT9DMKNa9dv3Ny81bt95+69+/0HW8fO1JbxETPS2NOMOi6F5iMQIPlpZTlVmeQn2dm7uX7ymVsnjP4As4onihZa5IJR8FTa/0FcrdJGPM9ajEkmCnJBhuJTc/Sk9eyzDBNXGgtWFCVQa805nrZ45PW5/K/oK1r8Bl+QqhSpIJbqQvKuL+6Rgk/DkmbaF3xexlg2ilwYuVDZdZ06tZaX8Q7USLwJfAbhS/3otx3DED1MUw7f8iE8NqxTUwSZ0bx1EFSUMtCZ52yO14xVlZ7TgYw81VdwlzcL6Fm97ZoJzY/3RgBfs5YqGKudmyruyrSiUblWbk2s1B4ramZ2sE8c15AdJI3RVA9dsuUVeSwGzx8ZT4TlDOTMA8qs8BfBrKSWMvBfoecd+mMD/j84frkTe/z+1eDwbefVJnqEHqOnKEb76BAdoSEaIRbsB0mQB0X4MfwSfg2/LVPDoKt5iK5E+P0301DmAg=</latexit>

» Dividing by 2q and squaring: Applying Jensen’s inequality:

= success probability of Pʹ = success probability of P when interacting with Hʹ (from the start)

(for random H & cʹ) Ei,b

• ΠH0

i+bqU H ii+bA|φii

• 2 &

1 4q2

• ΠH0

0q|φ0i

• 2

=

1 4q2

• ΠH

0q|φ0i

• 2

The Math

QED

Remarks

Above considers fixed instance x given to P. Extends to adaptive P that can choose x himself (that’s why one should set c := H(x,a) instead c := H(a)) Works beyond classical S-protocols: z may be quantum.

Implications for Signatures

and S is a S-protocol for L that is a proof of knowledge (against quantum P) is a (honest verifier) zero knowledge satisfies some additional mild properties, then signature scheme Sig[S], defined by setting pk = x (for random x Î L) and sk = w signing m by means of p = (a,z) where c = H(m,x,a) is a secure (EUF-CMA) in the QROM. If L is hard on average for quantum algorithms: for random x Î L it is hard to find w s.t. (x,w) Î R

Part IV: On quantum proof-of-knowledge

Proof of Knowledge

A S-protocol for L is a proof of knowledge if: any (dishonest) P must “know” w to have V accept x Formalized by requiring existence of an extractor that extracts w from any successful (possibly dishonest) P Typically (i.e. classically) this extraction involves rewinding P Problematic if P is quantum: measurements are irreversible

Quantum Proof of Knowledge

So far know [Unruh12,ARU14]: for S to be a quantum proof-of-knowledge (QPoK) it needs to have unique responses: i.e., "x Î L "a,c exists unique z : V(x,a,c,z) . Intuition: z unique ⇒ measuring it does not disturb state Caveat: often not satisfied Computational unique responses, where it is hard to compute more than one z, is not sufficient (even for a computational QPoK) Pity: often is (or seems) satisfied

Strong Computational Unique Responses

We can: circumvent (or relativize) negative result by strengthening notion of computational unique responses in the spirit of Unruh’s collapsing property Caveat 1: again property that is hard to prove On the other hand: no (convincing) separation examples Thus, for typical schemes: expect non-strong ⇒ strong Caveat 2: still require S to be special sound [LieZhandry19]: S underlying Dilithium has strong comp... ⇒ security of NIST candidate Dilithium

Conclusion - and Comparison

We (and [LieZhandry19]) show: a particular extract-and-reprogram technique in QROM Implies security of Fiat-Shamir in the QROM: whatever security S satisfies, FS[S] satisfies it as well (we lose a factor q2, [LieZhandry19] a factor q9) Implies: S QPoK (& ...) ⇒ Sig[S] secure We (and [LieZhandry19]) show: new notion of computational unique responses ⇒ QPoK We conjectured, [LieZhandry19] prove: S underlying Dilithium satisfies new notion Implies: security of Dilithium (in QROM)

Open Problems

Is the q2 loss optimal or can it be reduced to q ? Find new and better technical tools for proving our new and stronger notion of computational unique responses. Be able to relax the special soundness requirement.