How to Construct Quantum Random Functions

Abstract

In the presence of a quantum adversary, there are two possible definitions of security for a pseudorandom function. The first, which we call standard-security, allows the adversary to be quantum, but requires queries to the function to be classical. The second, quantum-security, allows the adversary to query the function on a quantum superposition of inputs, thereby giving the adversary a superposition of the values of the function at many inputs at once. Existing techniques for proving the security of pseudorandom functions fail when the adversary can make quantum queries. We give the first quantum-security proofs for pseudorandom functions by showing that some classical constructions of pseudorandom functions are quantum-secure. Namely, we show that the standard constructions of pseudorandom functions from pseudorandom generators or pseudorandom synthesizers are secure, even when the adversary can make quantum queries. We also show that a direct construction from lattices is quantum-secure. To prove security, we develop new tools to prove the indistinguishability of distributions under quantum queries.In light of these positive results, one might hope that all standard-secure pseudorandom functions are quantum-secure. To the contrary, we show a separation: under the assumption that standard-secure pseudorandom functions exist, there are pseudorandom functions secure against quantum adversaries making classical queries, but insecure once the adversary can make quantum queries.

Secure Signatures and Chosen Ciphertext Security in a Quantum Computing World

“…The next definition and lemma are given by Zhandry [Zha12b] and allow for the efficient simulation of an exponentially-large list of samples, given only a polynomial number of samples: Definition 2.3 (Small-range distributions [Zha12b] A special case of this theorem is when F is a constant function and each of the distirbutions D x are the uniform distribution. In this case, Lemma 2.6 reduces to the following result of Boneh and Zhandry [BZ13]: any quantum algorithm making q queries to a random oracle H from X to Y can output q + 1 input/output pairs of H with probability at most (q + 1)/|Y|.…”

“…Along these lines, Zhandry [Zha12b] showed how to construct pseudorandom functions (PRFs) that remain secure even when the adversary is allowed to issue quantum queries to the PRF. A quantum query is a superposition of inputs x ψ x |x of the attacker's choice.…”

Mitigating Multi-target Attacks in Hash-Based Signatures

“…For completeness, we give a clean proof using a tool developed by Zhandry [32]. We describe below a simplified version of the tool, taken from [31]. …”

Quantum cryptography beyond quantum key distribution

“…Zhandry [240] showed how to plant challenges in the QRO model at the beginning of the execution, and Unruh [222] showed how to reprogram the RO during runtime. Security definitions allowing superposition access have subsequently been studied by Boneh and Zhandry [37,240] in the context of encryption, digital signatures and the construction of pseudo-random functions. See also related work by Damgård, Funder, Nielsen and Salvail [92], who study superposition attacks on secret-sharing and multi-party protocols.…”

“…Related to the topic of quantum security notions (Sect. 4.4), Zhandry [240] has shown how to construct quantum-security pseudo-random functions (qPRF). Classically, it is well-known that using the PRF in a three-round Feistel network yields a pseudo-random permutation.…”