Computationally Binding Quantum Commitments

Unruh, Dominique

doi:10.1007/978-3-662-49896-5_18

Cited by 98 publications

(98 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [Unr16], Unruh introduced the notion of collapsingness, a quantum generalization of the collisionresistance property for hash functions. It is straight-forward to generalize this notion to apply to binary relations instead of just functions.…”

Section: Extractable σ-Protocols From Quantum Computationally Unique mentioning

confidence: 99%

See 1 more Smart Citation

Security of the Fiat-Shamir Transformation in the Quantum Random-Oracle Model

Don

Fehr

Majenz

et al. 2019

Lecture Notes in Computer Science

115

View full text Add to dashboard Cite

The famous Fiat-Shamir transformation turns any public-coin three-round interactive proof, i.e., any so-called Σ-protocol, into a non-interactive proof in the random-oracle model. We study this transformation in the setting of a quantum adversary that in particular may query the random oracle in quantum superposition. Our main result is a generic reduction that transforms any quantum dishonest prover attacking the Fiat-Shamir transformation in the quantum random-oracle model into a similarly successful quantum dishonest prover attacking the underlying Σ-protocol (in the standard model). Applied to the standard soundness and proof-of-knowledge definitions, our reduction implies that both these security properties, in both the computational and the statistical variant, are preserved under the Fiat-Shamir transformation even when allowing quantum attacks. Our result improves and completes the partial results that have been known so far, but it also proves wrong certain claims made in the literature. In the context of post-quantum secure signature schemes, our results imply that for any Σ-protocol that is a proof-of-knowledge against quantum dishonest provers (and that satisfies some additional natural properties), the corresponding Fiat-Shamir signature scheme is secure in the quantum randomoracle model. For example, we can conclude that the non-optimized version of Fish, which is the bare Fiat-Shamir variant of the NIST candidate Picnic, is secure in the quantum random-oracle model. learn x α x |x |H(x) by making a single query to the RO. This is referred to as the quantum random-oracle model (QROM) [BDF + 11].Unfortunately, these superposition queries obstruct the above mentioned advantages of the ROM. By basic properties of quantum mechanics one cannot observe or locally copy such superposition queries made by the adversary without disturbing them. Also, reprogramming is usually done for an x that is queried by the adversary at a certain point, so also here we are stuck with the problem that we cannot look at the queries without disturbing them.As a consequence, security proofs in the ROM almost always do not carry over to the QROM. This lack of proof does not mean that the schemes become insecure; on the contrary, unless there is some failure because of some other reason 5 , we actually expect typical schemes to remain secure. However, it is often not obvious how to find a security proof in the QROM. Some examples where security in the QROM has been established are [Unr14, Zha15, ES15, Unr15, KLS18, ABB + 17, Zha18, SXY18, BDK + 18].Main technical result. Our main technical result (Theorem 2) can be understood as a particular way to overcome -to some extent -the above described limitation in the QROM of not being able to "read out" any query to the RO and to then reprogram the corresponding hash value. Concretely, we achieve the following.We consider an arbitrary quantum algorithm A that makes queries to the RO and in the end outputs a pair (x, z), where z is supposed to satisfy some relation with respect to H(x...

show abstract

Section: Extractable σ-Protocols From Quantum Computationally Unique mentioning

confidence: 99%

“…Definition 23 (generalized from [Unr16]) Let R : X × Y → {0, 1} be a relation with |X| and |Y | superpolynomial in the security parameter η, and define the following two games for polynomial-time two-stage adversaries A = (A 1 , A 2 ),…”

Section: Extractable σ-Protocols From Quantum Computationally Unique mentioning

confidence: 99%

Security of the Fiat-Shamir Transformation in the Quantum Random-Oracle Model

Don

Fehr

Majenz

et al. 2019

Lecture Notes in Computer Science

115

View full text Add to dashboard Cite

show abstract

“…The Collapsing Property. Unruh [5] proposed the notion of collapsing; in the context of commitment schemes as a counterpart for the computational binding property when considering quantum attacks, and in the context of hash functions as a counterpart for collision resistance. In essence, for hash functions, the collapsing property requires that for any computationally bounded adversary that output a hash value together with a quantum superposition of corresponding preimages, he should not be able to tell if the superposition gets measured or not.…”

Section: Introductionmentioning

confidence: 99%

“…Some of those have already been claimed and proven in the work mentioned above; however, our proofs are much simpler. For instance, proving that the collapsing property is preserved under nested composition takes 2 full pages in [5] (see Lemma 27 in the full version of [5]), with various quantum circuits depicted; our proof (see Lemma 5) is a few lines. The main reason for this difference lies in the "algebraic" nature of our formulation, compared to the "algorithmic" approach used in prior work.…”

Section: Introductionmentioning

confidence: 99%

Classical Proofs for the Quantum Collapsing Property of Classical Hash Functions

Fehr

2018

Theory of Cryptography

View full text Add to dashboard Cite

Hash functions are of fundamental importance in theoretical and in practical cryptography, and with the threat of quantum computers possibly emerging in the future, it is an urgent objective to understand the security of hash functions in the light of potential future quantum attacks. To this end, we reconsider the collapsing property of hash functions, as introduced by Unruh, which replaces the notion of collision resistance when considering quantum attacks. Our contribution is a formalism and a framework that offers significantly simpler proofs for the collapsing property of hash functions. With our framework, we can prove the collapsing property for hash domain extension constructions entirely by means of decomposing the iteration function into suitable elementary composition operations. In particular, given our framework, one can argue purely classically about the quantum-security of hash functions; this is in contrast to previous proofs which are in terms of sophisticated quantum-information-theoretic and quantum-algorithmic reasoning.

show abstract

“…In addition, some QBC with computational security were proposed. Unconditionally binding and computationally concealing QBC schemes were presented by Tanaka [27] and Chailloux [28], respectively, and in 2016, another computationally binding commitment scheme was proposed and it can be realized from hash functions like SHA-3 [29]. The security of these QBC protocols depends on the limited computing power of the adversary.…”

Section: Introductionmentioning

confidence: 99%

Practical Quantum Bit Commitment Protocol Based on Quantum Oblivious Transfer

Song

Yang

2018

Applied Sciences

View full text Add to dashboard Cite

Oblivious transfer (OT) and bit commitment (BC) are two-party cryptographic protocols which play crucial roles in the construction of various cryptographic protocols. We propose three practical quantum cryptographic protocols in this paper. We first construct a practical quantum random oblivious transfer (R-OT) protocol based on the fact that non-orthogonal states cannot be reliably distinguished. Then, we construct a fault-tolerant one-out-of-two oblivious transfer ( O T 1 2 ) protocol based on the quantum R-OT protocol. Afterwards, we propose a quantum bit commitment (QBC) protocol which executes the fault-tolerant O T 1 2 several times. Mayers, Lo and Chau (MLC) no-go theorem proves that QBC protocol cannot be unconditionally secure. However, we find that computing the unitary transformation of no-go theorem attack needs so many resources that it is not realistically implementable. We give a definition of physical security for QBC protocols and prove that the practical QBC we proposed is physically secure and can be implemented in the real world.

show abstract

Computationally Binding Quantum Commitments

Cited by 98 publications

References 20 publications

Security of the Fiat-Shamir Transformation in the Quantum Random-Oracle Model

Security of the Fiat-Shamir Transformation in the Quantum Random-Oracle Model

Classical Proofs for the Quantum Collapsing Property of Classical Hash Functions

Practical Quantum Bit Commitment Protocol Based on Quantum Oblivious Transfer

Contact Info

Product

Resources

About