Quantum relational Hoare logic

Abstract

We present a logic for reasoning about pairs of interactive quantum programs -quantum relational Hoare logic (qRHL). This logic follows the spirit of probabilistic relational Hoare logic (Barthe et al. 2009) and allows us to formulate how the outputs of two quantum programs relate given the relationship of their inputs. Probabilistic RHL was used extensively for computer-verified security proofs of classical cryptographic protocols. Since pRHL is not suitable for analyzing quantum cryptography, we present qRHL as a replacement, suitable for the security analysis of post-quantum cryptography and quantum protocols. The design of qRHL poses some challenges unique to the quantum setting, e.g., the definition of equality on quantum registers. Finally, we implemented a tool for verifying proofs in qRHL and developed several example security proofs in it.

Quantum Hoare Logic with Ghost Variables

“…This language is intentionally minimalistic. It seems to lack a number of features that are present, e.g., in [19]: Initializing variables with states other than |0 . Performing measurements.…”

“…Extensions of this basic quantum Hoare logic can make some statements about probabilities: Quantum Hoare logic whose pre-/postconditions are expectations [7,20] can, e.g., express that a certain predicate will hold with a certain probability. And [19] can express that the outputs of two programs are identical, even taking into account their distributions. But both still lack the possibility of stating, as part of a pre-/postcondition, e.g., that a variable has a particular distribution.…”

“…See also discussion in Section 8.2 for further discussion on the limitations of 11 Strictly speaking, "recap" is not the right word since as far as we know this variant of quantum Hoare logic has not explicitly been spelled out in the literature. However, we still consider it folklore because it is a relatively simple generalization of [4] (allowing for more general programs, density operator based semantics, and changing the presentation from weakest precondition transformers to Hoare triples), it is a simplification of [19] (which considers pairs of programs instead of single programs), and it is a special case of [20] (by considering only "strict" predicates there, i.e., predicates that are projectors, we get a logic that is roughly the same). 12 The usual formal definition of supp ρ is supp ρ := im P where P is the smallest projector such that P ρP * = ρ.…”

“…Quantum Hoare logics and predicate transformer calculi for quantum programs have been presented by D'Hondt and Panangaden [7], Chadha, Mateus and Sernadas [5], Feng, Duan, Ji, and Ying [9], Ying [20], and Kakutani [13]. Unruh [19] gives a quantum Hoare logic for analyzing pairs of programs (based on the classical pRHL [2]). A different approach is taken by pictorial calculi where quantum processes can be formalized and rewritten as diagrams, starting with Abramsky and Coecke [1].…”

Fifty years of Hoare’s logic

“…For a recent overview of the developments on this subject, that successfully parallel the developments of the customary Hoare's logic, see [Yin19]. A related approach of [Unr19] follows the line of research started with [Ben04] and [BGB09] and introduces quantum Relational Hoare Logic (qRHL) that allows one to reason about how the outputs of two quantum programs relate given a relation between their inputs.…”