量子世界中的Fiat-Shamir变换
The Fiat-Shamir Transformation in a Quantum World
摘要：
Fiat-Shamir变换是将身份识别方案转化为数字签名方案的著名技术。该方案在随机预言模型下对经典攻击是可证明安全的。尽管如此，该技术也被建议用于量子免疫识别方案，以获得量子免疫签名方案。然而，Boneh等人最近的一篇论文（Asiacrypt 2011）提出了一个问题，即随机预言模型的结果可能无法立即适用于量子对手，因为这样的对手应该被允许以叠加的方式查询随机预言。目前还不清楚Fiat-Shamir技术在这个量子预言模型（QROM）中是否仍然安全。在这里，我们讨论了在QROM中给出Fiat-Shamir变换的证明可能是困难的。我们表明，不可能有黑盒提取器，只要潜在的量子免疫识别方案是安全的，对活跃的对手和证明者的第一个消息是独立的证人。大多数计划都是这种类型。然后，我们讨论，对于某些计划，人们可能能够复活的Fiat-Shamir结果在QROM通过修改底层协议第一。我们讨论特别是一个版本的Lyubashevsky计划，这是可证明安全的QROM。
英文摘要：
The Fiat-Shamir transformation is a famous technique to turn identification schemes into signature schemes. The derived scheme is provably secure in the random-oracle model against classical adversaries. Still, the technique has also been suggested to be used in connection with quantum-immune identification schemes, in order to get quantum-immune signature schemes. However, a recent paper by Boneh et al. (Asiacrypt 2011) has raised the issue that results in the random-oracle model may not be immediately applicable to quantum adversaries, because such adversaries should be allowed to query the random oracle in superposition. It has been unclear if the Fiat-Shamir technique is still secure in this quantum oracle model (QROM). Here, we discuss that giving proofs for the Fiat-Shamir transformation in the QROM is presumably hard. We show that there cannot be black-box extractors, as long as the underlying quantum-immune identification scheme is secure against active adversaries and the first message of the prover is independent of its witness. Most schemes are of this type. We then discuss that for some schemes one may be able to resurrect the Fiat-Shamir result in the QROM by modifying the underlying protocol first. We discuss in particular a version of the Lyubashevsky scheme which is provably secure in the QROM.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
