Secure Software Leasing from Standard Assumptions

Abstract

Secure software leasing (SSL) is a quantum cryptographic primitive that enables users to execute software only during the software is leased. It prevents users from executing leased software after they return the leased software to its owner. SSL can make software distribution more flexible and controllable.Although SSL is an attractive cryptographic primitive, the existing SSL scheme is based on public key quantum money, which is not instantiated with standard cryptographic assumptions so far. Moreover, the existing SSL scheme only supports a subclass of evasive functions.In this work, we present SSL schemes based on the learning with errors assumption (LWE). Specifically, our contributions consist of the following.• We construct an SSL scheme for pseudorandom functions from the LWE assumption against quantum adversaries.• We construct an SSL scheme for a subclass of evasive functions from the LWE assumption against sub-exponential quantum adversaries.• We construct SSL schemes for the functionalities above with classical communication from the LWE assumption against (sub-exponential) quantum adversaries.SSL with classical communication means that entities exchange only classical information though they run quantum computation locally.Our crucial tool is two-tier quantum lightning, which is introduced in this work and a relaxed version of quantum lighting. In two-tier quantum lightning schemes, we have a public verification algorithm called semi-verification and a private verification algorithm called full-verification. An adversary cannot generate possibly entangled two quantum states whose serial numbers are the same such that one passes the semi-verification, and the other also passes the full-verification. We show that we can construct a two-tier quantum lightning scheme from the LWE assumption.

Beating Classical Impossibility of Position Verification

“…This is simply because if somehow we can prepare two copies of this state, then measuring two copies in two bases will yield both 𝑥 and 𝑑. This computational unclonability property has also been observed and used in prior works, in particular in the context of semi-quantum money [RS19] and two-tier quantum lightning [KNY21]. Later we will see that the security proof for our CVPV protocol requires a stronger variant of computational unclonability than the ones considered in these works.…”

On the Concurrent Composition of Quantum Zero-Knowledge

“…First, we observe that this assumption is false for arbitrary R. This attack is implicit in the work of [RZ20,KNY20].…”

“…Ideally, we would like to not place any additional restriction on the adversary: for instance, the adversary can get access to cloned copies of their intermediate states at any point during its execution. However, it turns out that such an adversary is too powerful and can in fact break QLWE (such an attack was implicit in the works of [RZ20,KNY20]). However, we place certain restrictions on the behavior of the adversary that will allow us to make the security proof go through.…”

Uncloneable Decryptors from Quantum Copy-Protection

“…This implies that a general scheme for quantum copy protection for quantum unlearnable functions is also impossible. More recently, [KNY20] managed to construct SSL schemes for a subclass of the class of evasive functions. They also consider two weaker variants of SSLfinite-term SSL and SSL with classical communicationsand show constructions of such schemes for pseudo-random functions.…”