Double-sided: tight proofs for guessing games in the quantum random oracle model

Abstract

The semi-classical One-Way to Hiding (SC-O2H) lemma given by Ambainis et al. (CRYPTO 2019) is a crucial technique to solve the reprogramming problem in the quantum random oracle model (QROM), which can lead to quadratically better bounds for many cases involving guessing games. To achieve tighter bounds, Bindel et al. (TCC, 2019) introduced the double-sided One-Way to Hiding (DS-O2H) lemma, which avoids the loss of query times suffered by the SC-O2H lemma. However, the potential of the DS-O2H lemma to provide better bounds for guessing games has not been considered by far. In this paper, a new double-sided O2H lemma is proposed. By using it, we for the first time give fully tight bounds for several cases involving guessing games. In summary, we show the following results in the QROM: (i) The hardness of inverting a random oracle with the leakage of a one-way injective function can be tightly reduced to the hardness of inverting the involved one-way injective function. (ii) Duman et al. (PKC 2023) introduced the randomness recoverability and defined two transformations ACWC0 and ACWC relative to random oracles. For ACWC0, we prove that its OW-CPA security can be tightly reduced to the OW-CPA security of the underlying public key encryption (PKE) scheme with the randomness recoverability. For ACWC, we design a variant ACWC1, and prove that its OW-CPA security can be tightly reduced to the OW-CPA security of the underlying PKE scheme with the unique randomness recoverability (a property slightly stronger than randomness recoverability). (iii) The OW-CPA security of the modular Fujisaki-Okamoto (FO) transformation T introduced by Hofheinz et al. (TCC 2017), can be tightly reduced to the OW-CPA security of the underlying PKE scheme with the unique randomness recoverability. Additionally, assuming the underlying PKE scheme is unique randomness recoverable, we prove the IND-CCA security of FO-like transformations (TCC, 2017) in the QROM, and as far as we know, our proof is tighter than the currently best proof.