量子随机预言模型中Fiat-Shamir变换的安全性
Security of the Fiat-Shamir Transformation in the Quantum Random-Oracle Model
摘要：
著名的Fiat-Shamir变换将任何公共硬币的三轮交互式证明，即，任何所谓的西格玛协议，在随机预言模型的非交互式证明。我们研究这种转换的设置中的量子对手，特别是可能会查询量子叠加的随机预言。我们的主要结果是一个通用的减少，将任何量子不诚实的证明攻击的Fiat-Shamir变换在量子随机预言模型到一个类似的成功的量子不诚实的证明攻击底层的西格玛协议（在标准模型）。应用到标准的可靠性和知识证明的定义，我们的减少意味着这两个安全属性，在计算和统计变量，即使在允许量子攻击的情况下，在Fiat-Shamir变换下也能保持。我们的结果改进和完善了迄今为止已知的部分结果，但也证明了文献中的某些主张是错误的。在后量子安全签名方案的背景下，我们的结果意味着，对于任何sigma协议，这是一个知识证明对量子不诚实的证明（并满足一些额外的自然属性），相应的Fiat-Shamir签名方案是安全的量子随机预言模型。例如，我们可以得出结论，Fish的非优化版本，即NIST候选Picnic的裸Fiat-Shamir变体，在量子随机预言模型中是安全的。
英文摘要：
The famous Fiat-Shamir transformation turns any public-coin three-round interactive proof, i.e., any so-called sigma-protocol, into a non-interactive proof in the random-oracle model. We study this transformation in the setting of a quantum adversary that in particular may query the random oracle in quantum superposition. Our main result is a generic reduction that transforms any quantum dishonest prover attacking the Fiat-Shamir transformation in the quantum random-oracle model into a similarly successful quantum dishonest prover attacking the underlying sigma-protocol (in the standard model). Applied to the standard soundness and proof-of-knowledge definitions, our reduction implies that both these security properties, in both the computational and the statistical variant, are preserved under the Fiat-Shamir transformation even when allowing quantum attacks. Our result improves and completes the partial results that have been known so far, but it also proves wrong certain claims made in the literature. In the context of post-quantum secure signature schemes, our results imply that for any sigma-protocol that is a proof-of-knowledge against quantum dishonest provers (and that satisfies some additional natural properties), the corresponding Fiat-Shamir signature scheme is secure in the quantum random-oracle model. For example, we can conclude that the non-optimized version of Fish, which is the bare Fiat-Shamir variant of the NIST candidate Picnic, is secure in the quantum random-oracle model.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
