使用签名提升保护量子拖延者：以加密货币为例的案例研究
Protecting Quantum Procrastinators with Signature Lifting: A Case Study in Cryptocurrencies
AI总结：
针对未及时迁移到后量子密码学的用户，提出签名提升技术，基于 Picnic 方案将前量子签名方案提升为后量子方案，在加密货币中实现量子对手下安全花费前量子代币，且无需保密 ECDSA 公钥或依赖后量子代币。
摘要：
当前针对广泛使用的密码方案量子漏洞的解决方案，涉及在量子攻击变得可行之前将用户迁移到后量子方案。本工作致力于保护量子拖延者：即未及时迁移到后量子密码学的用户。为了在数字签名背景下解决此问题，我们引入了一种名为签名提升的技术，该技术允许我们将满足特定属性的已部署前量子签名方案提升为使用相同密钥的后量子签名方案。通俗地说，该属性是指在从私钥派生公钥的过程中“沿途某处”使用了后量子单向函数。我们的签名提升构造严重依赖于后量子数字签名方案 Picnic (Chase et al., CCS'17)。我们的主要案例研究是加密货币，其中该属性在两种场景下成立：当公钥通过密钥派生函数生成时，或者当发布的是公钥哈希而非公钥本身时。我们提出了一种基于签名提升的修改方案，可应用于许多加密货币，以在存在量子对手的情况下安全地花费前量子代币。我们的构造在两个主要方面改进了现有构造：它不限于 ECDSA 公钥已保密的前量子代币（特别是，它处理存储在由 HD 钱包生成的地址中的所有代币），并且它不需要访问后量子代币或使用侧向支付来支付发布交易的费用。
英文摘要：
Current solutions to quantum vulnerabilities of widely used cryptographic schemes involve migrating users to post-quantum schemes before quantum attacks become feasible. This work deals with protecting quantum procrastinators: users that failed to migrate to post-quantum cryptography in time. To address this problem in the context of digital signatures, we introduce a technique called signature lifting, that allows us to lift a deployed pre-quantum signature scheme satisfying a certain property to a post-quantum signature scheme that uses the same keys. Informally, the said property is that a post-quantum one-way function is used "somewhere along the way" to derive the public-key from the secret-key. Our constructions of signature lifting relies heavily on the post-quantum digital signature scheme Picnic (Chase et al., CCS'17). Our main case-study is cryptocurrencies, where this property holds in two scenarios: when the public-key is generated via a key-derivation function or when the public-key hash is posted instead of the public-key itself. We propose a modification, based on signature lifting, that can be applied in many cryptocurrencies for securely spending pre-quantum coins in presence of quantum adversaries. Our construction improves upon existing constructions in two major ways: it is not limited to pre-quantum coins whose ECDSA public-key has been kept secret (and in particular, it handles all coins that are stored in addresses generated by HD wallets), and it does not require access to post-quantum coins or using side payments to pay for posting the transaction.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
