On parallel composition of zero-knowledge proofs with black-box quantum

Abstract

Let $L$ be a language decided by a constant-round quantum Arthur-Merlin ($\QAM$) protocol with negligible soundness error and all but possibly the last message being classical. We prove that if this protocol is zero knowledge with a black-box, quantum simulator $\cS$, then $L \in \BQP$. Our result also applies to any language having a three-round quantum interactive proof ($\QIP$), with all but possibly the last message being classical, with negligible soundness error and a black-box quantum simulator. These results in particular make it unlikely that certain protocols can be composed in parallel in order to reduce soundness error, while maintaining zero knowledge with a black-box quantum simulator. They generalize analogous classical results of Goldreich and Krawczyk (1990). Our proof goes via a reduction to quantum black-box search. We show that the existence of a black-box quantum simulator for such protocols when $L \notin \BQP$ would imply an impossibly-good quantum search algorithm.