Non-interactive Zero-Knowledge Arguments for QMA, with Preprocessing

Abstract

A non-interactive zero-knowledge (NIZK) proof system for a language L ∈ NP allows a prover (who is provided with an instance x ∈ L, and a witness w for x) to compute a classical certificate π for the claim that x ∈ L such that π has the following properties: 1) π can be verified efficiently, and 2) π does not reveal any information about w, besides the fact that it exists (i.e. that x ∈ L). NIZK proof systems have recently been shown to exist for all languages in NP in the common reference string (CRS) model and under the learning with errors (LWE) assumption. We initiate the study of NIZK arguments for languages in QMA. An argument system differs from a proof system in that the honest prover must be efficient, and that it is only sound against (quantum) polynomial-time provers. Our first main result is the following: if LWE is hard for quantum computers, then any language in QMA has an NIZK argument with preprocessing. The preprocessing in our argument system consists of (i) the generation of a CRS and (ii) a single (instance-independent) quantum message from verifier to prover. Meanwhile, the instance-dependent phase of our argument system involves only a single classical message from prover to verifier. Importantly, verification in our protocol is entirely classical, and the verifier needs not have quantum memory; its only quantum actions are in the preprocessing phase. NIZK proofs of (classical) knowledge are widely used in the construction of more advanced cryptographic protocols, and we expect the quantum analogue to likewise find a broad range of applications. In this respect, the fact that our protocol has an entirely classical verification phase is particularly appealing. Our second contribution is to extend the notion of a classical proof of knowledge to the quantum setting. We introduce the notions of arguments and proofs of quantum knowledge (AoQK/PoQK), and we show that our non-interactive argument system satisfies the definition of an AoQK. In particular, we explicitly construct an extractor which can recover a quantum witness from any prover who is successful in our protocol. We also show that any language in QMA has an (interactive) proof of quantum knowledge, again by exhibiting a particular proof system for all languages in QMA and constructing an extractor for it. That our NIZK argument system is also an AoQK further broadens the contexts in which it may be applied.

Classical Proofs of Quantum Knowledge

“…Our final contribution is to show that, under our definition, a classical argument of quantum knowledge exists for any relation in the class QMA. 3 The notion of a QMA relation was formalised jointly by [BG19] and [CVZ19], as a quantum analogue to the idea of an NP relation which was described in the first paragraphs of this introduction. [BG19] and [CVZ19] show that any QMA relation has a quantum proof of quantum knowledge.…”

“…3 The notion of a QMA relation was formalised jointly by [BG19] and [CVZ19], as a quantum analogue to the idea of an NP relation which was described in the first paragraphs of this introduction. [BG19] and [CVZ19] show that any QMA relation has a quantum proof of quantum knowledge. The protocol that we show to be a classical argument of quantum knowledge for QMA relations, meanwhile, is the celebrated verification protocol introduced recently by [Mah18b].…”

“…(In comparison, our proofs that specific quantum money schemes satisfy our definition of a proof of quantum knowledge do not use any cryptographic assumptions, and the protocols which we consider are very simple compared with the [Mah18b] protocol.) The [Mah18b] verification protocol can be shown to be an argument of quantum knowledge for any QMA relation; the only caveat, which was also a caveat for the quantum proofs of quantum knowledge for QMA exhibited by [BG19] and [CVZ19], is that an honest prover in the protocol may require multiple copies of a witness in order that the extractor can succeed in extracting one copy. We refer the reader to Section 7 for details.…”

“…Quantum proofs of quantum knowledge have recently been explored by [BG19] and [CVZ19]; these two papers give a joint definition for quantum proofs of quantum knowledge, and exhibit several examples which meaningfully instantiate the definition. However, if we are interested in testing quantum functionality with classical devices, as we are here, then we must approach the subject differently.…”

“…However, if we are interested in testing quantum functionality with classical devices, as we are here, then we must approach the subject differently. The reason is that, if we allow the extractor only black-box access to the prover (as is done in [BG19] and [CVZ19], as well as in the classical literature) in the setting where the verifier is classical but the prover is quantum, the problem the extractor faces becomes one of reconstructing a witness ρ based entirely on classical measurement outcomes, which seems as if it may be as hard as quantum state tomography. To give an idea of the difficulty of the problem, information-theoretic bounds have been proven which show that reconstructing a full classical description of a quantum state ρ from measurement outcomes requires (in general) measuring exponentially many copies of ρ [HHJ + 17], even when the the extractor is free to choose the measurements which are performed.…”