We introduce a computational problem of distinguishing between two specific quantum states as a new cryptographic problem to design a quantum cryptographic scheme that is "secure" against any polynomial-time quantum adversary. Our problem, QSCDff, is to distinguish between two types of random coset states with a hidden permutation over the symmetric group of finite degree. This naturally generalizes the commonly-used distinction problem between two probability distributions in computational cryptography. As our major contribution, we show that QSCDff has three properties of cryptographic interest: (i) QSCDff has a trapdoor; (ii) the average-case hardness of QSCDff coincides with its worst-case hardness; and (iii) QSCDff is computationally at least as hard as the graph automorphism problem in the worst case. These cryptographic properties enable us to construct a quantum public-key cryptosystem, which is likely to withstand any chosen plaintext attack of a polynomial-time quantum adversary. We further discuss a generalization of QSCDff, called QSCDcyc, and introduce a multi-bit encryption scheme that relies on similar cryptographic properties of QSCDcyc.
We introduce a computational problem of distinguishing between the output of an ideal coarse-grained boson sampler and the output of a true random number generator, as a resource for cryptographic schemes, which are secure against computationally unbounded adversaries. Moreover, we define a cryptographic setting for the implementation of such schemes, including message encryption and authentication, as well as entity authentication.
We study the notion of indistinguishability obfuscation for null quantum circuits (quantum null-iO). We present a construction assuming: - The quantum hardness of learning with errors (LWE). - Post-quantum indistinguishability obfuscation for classical circuits. - A notion of ''dual-mode'' classical verification of quantum computation (CVQC). We give evidence that our notion of dual-mode CVQC exists by proposing a scheme that is secure assuming LWE in the quantum random oracle model (QROM). Then we show how quantum null-iO enables a series of new cryptographic primitives that, prior to our wor…
From Worst-Case Hardness of $\mathsf{NP}$ to Quantum Cryptography via Quantum Indistinguishability Obfuscation
Yukawa Institute for Theoretical Physics, Kyoto University（京都大学汤川理论物理研究所）；NTT Social Informatics Laboratories（NTT社会信息学实验室）；NTT Research Center for Theoretical Quantum Information（NTT理论量子信息中心）
We investigate the definition of security for encryption scheme in quantum context. We systematically define the indistinguishability and semantic security for quantum public-key and private-key encryption schemes, and for computational security, physical security and information-theoretic security. Based on our definition, we present a necessary and sufficient condition that leads to information-theoretic indistinguishability for quantum encryption scheme. The equivalence between the indistinguishability and semantic security of quantum encryption scheme is also proved.
This paper, mostly expository in nature, surveys four measures of distinguishability for quantum-mechanical states. This is done from the point of view of the cryptographer with a particular eye on applications in quantum cryptography. Each of the measures considered is rooted in an analogous classical measure of distinguishability for probability distributions: namely, the probability of an identification error, the Kolmogorov distance, the Bhattacharyya coefficient, and the Shannon distinguishability (as defined through mutual information). These measures have a long history of use in statis…
Bosonic interference is a fundamental physical phenomenon, and it is believed to lie at the heart of quantum computational advantage. It is thus necessary to develop practical tools to witness its presence, both for a reliable assessment of a quantum source and for fundamental investigations. Here we describe how linear interferometers can be used to unambiguously witness genuine n-boson indistinguishability. The amount of violation of the proposed witnesses bounds the degree of multi-boson indistinguishability, for which we also provide a novel intuitive model using set theory. We experimenta…
Leonard Shelby, the protagonist of Memento, uses mementos in the form of tattoos and pictures to handle his amnesia. Similar to Leonard, contemporary quantum computers suffer from "quantum amnesia": the inability to store quantum registers for a long duration. Quantum computers can only retain classical "mementos" of quantum registers by measuring them before those vanish. Some quantum skeptics argue that this quantum amnesia is inherent. We point out that this variant of a skeptic world is roughly described by the quantum bounded storage model, and although it is a computational obstacle that…
An indistinguishability obfuscator is a probabilistic polynomial-time algorithm that takes a circuit as input and outputs a new circuit that has the same functionality as the input circuit, such that for any two circuits of the same size that compute the same function, the outputs of the indistinguishability obfuscator are indistinguishable. Here, we study schemes for indistinguishability obfuscation for quantum circuits. We present two definitions for indistinguishability obfuscation: in our first definition (qiO) the outputs of the obfuscator are required to be indistinguishable if the input…
Secure software leasing is a quantum cryptographic primitive that enables us to lease software to a user by encoding it into a quantum state. Secure software leasing has a mechanism that verifies whether a returned software is valid or not. The security notion guarantees that once a user returns a software in a valid form, the user no longer uses the software. In this work, we introduce the notion of secret-key functional encryption (SKFE) with secure key leasing, where a decryption key can be securely leased in the sense of secure software leasing. We also instantiate it with standard cryptog…
Quantum cloud computing is emerging as a popular model for users to experience the power of quantum computing through the internet, enabling quantum computing as a service. The question is, when the scale of the computational problems becomes out of reach of classical computers, how can users be sure that the output strings sent by the server are really from a quantum hardware? In 2008, Shepherd and Bremner proposed a cryptographic verification protocol based on a simplified circuit model called IQP (instantaneous quantum polynomial-time), which can potentially be applied to most existing quan…
Cryptographic protocols, such as protocols for secure function evaluation (SFE), have played a crucial role in the development of modern cryptography. The extensive theory of these protocols, however, deals almost exclusively with classical attackers. If we accept that quantum information processing is the most realistic model of physically feasible computation, then we must ask: what classical protocols remain secure against quantum attackers? Our main contribution is showing the existence of classical two-party protocols for the secure evaluation of any polynomial-time function under reasona…
Quantum-mechanical devices have the potential to transform cryptography. Most research in this area has focused either on the information-theoretic advantages of quantum protocols or on the security of classical cryptographic schemes against quantum attacks. In this work, we initiate the study of another relevant topic: the encryption of quantum data in the computational setting. In this direction, we establish quantum versions of several fundamental classical results. First, we develop natural definitions for private-key and public-key encryption schemes for quantum data. We then define notio…
Attacks on classical cryptographic protocols are usually modeled by allowing an adversary to ask queries from an oracle. Security is then defined by requiring that as long as the queries satisfy some constraint, there is some problem the adversary cannot solve, such as compute a certain piece of information. In this paper, we introduce a fundamentally new model of quantum attacks on classical cryptographic protocols, where the adversary is allowed to ask several classical queries in quantum superposition. This is a strictly stronger attack than the standard one, and we consider the security of…
In the classical model of computation, it is well established that one-way functions (OWF) are minimal for computational cryptography: They are essential for almost any cryptographic application that cannot be realized with respect to computationally unbounded adversaries. In the quantum setting, however, OWFs appear not to be essential (Kretschmer 2021; Ananth et al., Morimae and Yamakawa 2022), and the question of whether such a minimal primitive exists remains open. We consider EFI pairs -- efficiently samplable, statistically far but computationally indistinguishable pairs of (mixed) quant…
We present a protocol for the amplification and distribution of a one-time-pad cryptographic key over a point-to-multipoint optical network based on computational ghost imaging (GI) and compressed sensing (CS). It is shown experimentally that CS imaging can perform faster authentication and increase the key generation rate by an order of magnitude compared with the scheme using computational GI alone. The protocol is applicable for any number of legitimate user, thus, the scheme could be used in real intercity networks where high speed and high security are crucial.
As the building block in symmetric cryptography, designing Boolean functions satisfying multiple properties is an important problem in sequence ciphers, block ciphers, and hash functions. However, the search of $n$-variable Boolean functions fulfilling global cryptographic constraints is computationally hard due to the super-exponential size $\mathcal{O}(2^{2^n})$ of the space. Here, we introduce a codification of the cryptographically relevant constraints in the ground state of an Ising Hamiltonian, allowing us to naturally encode it in a quantum annealer, which seems to provide a quantum spe…
We investigate the Goldreich-Levin Theorem in the context of quantum information. This result is a reduction from the computational problem of inverting a one-way function to the problem of predicting a particular bit associated with that function. We show that the quantum version of the reduction -- between quantum one-way functions and quantum hard-predicates -- is quantitatively more efficient than the known classical version. Roughly speaking, if the one-way function acts on n-bit strings then the overhead in the reduction is by a factor of O(n/epsilon^2) in the classical case but only by …
We propose and analyze a novel interactive protocol for demonstrating quantum computational advantage, which is efficiently classically verifiable. Our protocol relies upon the cryptographic hardness of trapdoor claw-free functions (TCFs). Through a surprising connection to Bell's inequality, our protocol avoids the need for an adaptive hardcore bit, with essentially no increase in the quantum circuit complexity and no extra cryptographic assumptions. Crucially, this expands the set of compatible TCFs, and we propose two new constructions: one based upon the decisional Diffie-Hellman problem a…
We predict the preservation of temporal indistinguishability of photons propagating through helical coupled-resonator optical waveguides (H-CROWs). H-CROWs exhibit a pseudospin-momentum locked dispersion, which we show suppresses onsite disorder-induced backscattering and group velocity fluctuations. We simulate numerically the propagation of two-photon wavepackets, demonstrating that they exhibit almost perfect Hong-Ou-Mandel dip visibility and then can preserve their quantum coherence even in the presence of moderate disorder, in contrast to regular CROWs which are highly sensitive to disord…
We propose an efficient quantum protocol performing quantum bit commitment, which is a simple cryptographic primitive involved with two parties, called a committer and a verifier. Our protocol is non-interactive, uses no supplemental shared information, and achieves computational concealing and statistical binding under a natural complexity-theoretical assumption. An earlier protocol in the literature relies on the existence of an efficient quantum one-way function. Our protocol, on the contrary, exploits a seemingly weaker assumption on computational difficulty of distinguishing two specific …
Methods of quantum mechanics promise information-theoretic security for various protocols in cryptography. However, impossibility of some cryptographic applications such as standard bit commitment, oblivious transfer, multiparty secure computations and ideal coin tossing in quantum regime leaves an obvious question on the completeness of quantum cryptography. Instead of using wide range of rules and techniques for a variety of cryptographic applications, we demonstrate here a unified structure for quantum cryptography based on quantum non-local correlations. The unified framework achieves same…
Quantum hashing is a promising generalization of the cryptographic hashing concept on the quantum domain. In this paper, we construct a quantum hash via a sequence of single-photon states and perform a proof-of-principle experiment using orbital angular momentum (OAM) encoding. We experimentally verify the collision resistance of the quantum hash function depending on the number of qubits in use. Based on these results, we conclude that theoretical estimates are confirmed for different bases of OAM states and the proposed technique can be useful in computational and cryptographic scenarios. Th…
