Hardcore Bits Research Articles

Classical verification of quantum measurement for the computational basis and the XY -plane basis

Recent advances in quantum technologies raise the urgent need of verifying the correct functionality of a quantum device. Certifying the correctness of a quantum device in a fully classical manner is an important research branch. In this paper, we present a measurement protocol that allows a classical verifier to interact with an efficient quantum prover to verify the computational basis or the $XY$-plane basis measurement on a quantum state. With the help of two adaptive hardcore bit properties of a noisy trapdoor claw-free family, the security of measurement protocol is proved, which is under quantum hardness of the learning with error. The security characterizes the distance between the output distribution of measurement protocol and the distribution obtained by measuring certain quantum states in the designated basis, with or without the presence of honest behavior of the prover. Moreover, exploiting the measurement protocol, we present two device-noise-independent verification protocols of graph states and a classical verification protocol of delegated quantum computing whose soundness is 0.5757.

Classically verifiable quantum advantage from a computational Bell test

Existing experimental demonstrations of quantum computational advantage have had the limitation that verifying the correctness of the quantum device requires exponentially costly classical computations. Here we propose and analyse an interactive protocol for demonstrating quantum computational advantage, which is efficiently classically verifiable. Our protocol relies on a class of cryptographic tools called trapdoor claw-free functions. Although this type of function has been applied to quantum advantage protocols before, our protocol employs a surprising connection to Bell’s inequality to avoid the need for a demanding cryptographic property called the adaptive hardcore bit, while maintaining essentially no increase in the quantum circuit complexity and no extra assumptions. Leveraging the relaxed cryptographic requirements of the protocol, we present two trapdoor claw-free function constructions, based on Rabin’s function and the Diffie–Hellman problem, which have not been used in this context before. We also present two independent innovations that improve the efficiency of our implementation and can be applied to other quantum cryptographic protocols. First, we give a scheme to discard so-called garbage bits, removing the need for reversibility in the quantum circuits. Second, we show a natural way of performing postselection that reduces the fidelity needed to demonstrate quantum advantage. Combining these results, we describe a blueprint for implementing our protocol on Rydberg atom-based quantum devices, using hardware-native operations that have already been demonstrated experimentally.

A Cryptographic Test of Quantumness and Certifiable Randomness from a Single Quantum Device

We consider a new model for the testing of untrusted quantum devices, consisting of a single polynomial time bounded quantum device interacting with a classical polynomial time verifier. In this model, we propose solutions to two tasks—a protocol for efficient classical verification that the untrusted device is “truly quantum” and a protocol for producing certifiable randomness from a single untrusted quantum device. Our solution relies on the existence of a new cryptographic primitive for constraining the power of an untrusted quantum device: post-quantum secure trapdoor claw-free functions that must satisfy an adaptive hardcore bit property. We show how to construct this primitive based on the hardness of the learning with errors (LWE) problem.

Erasures versus errors in local decoding and property testing

AbstractWe initiate the study of the role of erasures in local decoding and use our understanding to prove a separation between erasure‐resilient and tolerant property testing. We first investigate local list‐decoding in the presence of erasures. We prove an analog of a famous result of Goldreich and Levin on local list‐decodability of the Hadamard code. Specifically, we show that the Hadamard code is locally list‐decodable in the presence of a constant fraction of erasures, arbitrarily close to 1, with list sizes and query complexity better than in the Goldreich–Levin theorem. We further study approximate locally erasure list‐decodable codes and use them to construct a property that is erasure‐resiliently testable with query complexity independent of the input length, , but requires queries for tolerant testing. We also investigate the general relationship between local decoding in the presence of errors and in the presence of erasures.

Fully secure wicked identity-based encryption resilient to continual auxiliary- inputs leakage

To allow more general key derivation patterns, the concept of wicked identity-based encryption (wicked IBE) was introduced. It is an extension of hierarchical identity based encryption (HIBE). Recently, research on leakage-resilient wicked IBE has attracted much attention for its consideration on the problem of key leakage in system. However, the existing works implement leakage resistance under the bounded leakage model and fail to capture general form of leakage attacks. Through designing the generation of the master secret key and the user secret key reasonably, a wicked IBE scheme resilient to continual auxiliary-inputs leakage is proposed in this paper. The leakage of our scheme is not only from the user secret key, but also from the master secret key. We show the scheme is proven fully secure in the standard model based on the subgroup decision assumption in composite-order bilinear groups and the Goldreich-Levin theorem in Galois field. To achieve this goal, the dual system encryption technology is exploited in the security proof. Compared with existing leakage-resilient wicked IBE, our scheme has a better performance in leakage resilience and security.

Implicit Computational Complexity of Subrecursive Definitions and Applications to Cryptographic Proofs

We define a call-by-value variant of Godel’s system $$\textsf {T} $$ with references, and equip it with a linear dependent type and effect system, called $$\textsf {d}\ell \textsf {T} $$ , that can estimate the time complexity of programs, as a function of the size of their inputs. We prove that the type system is intentionally sound, in the sense that it over-approximates the complexity of executing the programs on a variant of the CEK abstract machine. Moreover, we define a sound and complete type inference algorithm which critically exploits the subrecursive nature of $$\textsf {d}\ell \textsf {T} $$ . Finally, we demonstrate the usefulness of $$\textsf {d}\ell \textsf {T} $$ for analyzing the complexity of cryptographic reductions by providing an upper bound for the constructed adversary of the Goldreich–Levin theorem.

The Magic of ELFs

We introduce the notion of an Extremely Lossy Function (ELF). An ELF is a family of functions with an image size that is tunable anywhere from injective to having a polynomial-sized image. Moreover, for any efficient adversary, for a sufficiently large polynomial r (necessarily chosen to be larger than the running time of the adversary), the adversary cannot distinguish the injective case from the case of image size r. We develop a handful of techniques for using ELFs, and show that such extreme lossiness is useful for instantiating random oracles in several settings. In particular, we show how to use ELFs to build secure point function obfuscation with auxiliary input, as well as polynomially many hardcore bits for any one-way function. Such applications were previously known from strong knowledge assumptions—for example, polynomially many hardcore bits were only known from differing inputs obfuscation, a notion whose plausibility has been seriously challenged. We also use ELFs to build a simple hash function with output intractability, a new notion we define that may be useful for generating common reference strings. Next, we give a construction of ELFs relying on the exponential hardness of the decisional Diffie–Hellman problem, which is plausible in elliptic curve groups. Combining with the applications above, our work gives several practical constructions relying on qualitatively different—and arguably better—assumptions than prior works.

On the Implausibility of Differing-Inputs Obfuscation and Extractable Witness Encryption with Auxiliary Input

The notion of differing-inputs obfuscation (diO) was introduced by Barak et al. (CRYPTO, pp 1–18, 2001). It guarantees that, for any two circuits \(C_0, C_1\) for which it is difficult to come up with an input x on which \(C_0(x) \ne C_1(x)\), it should also be difficult to distinguish the obfuscation of \(C_0\) from that of \(C_1\). This is a strengthening of indistinguishability obfuscation, where the above is only guaranteed for circuits that agree on all inputs. Two recent works of Ananth et al. (Differing-inputs obfuscation and applications, http://eprint.iacr.org/, 2013) and Boyle et al. (Lindell, pp 52–73, 2014) study the notion of diO in the setting where the attacker is also given some auxiliary information related to the circuits, showing that this notion leads to many interesting applications. In this work, we show that the existence of general-purpose diO with general auxiliary input has a surprising consequence: it implies that a specific circuit \(C^*\) with specific auxiliary input \({\mathsf {aux}}^*\) cannot be obfuscated in a way that hides some specific information. In other words, under the conjecture that such special-purpose obfuscation exists, we show that general-purpose diO cannot exist. This conjecture is a falsifiable assumption which we do not know how to break for candidate obfuscation schemes. We also show similar implausibility results for extractable witness encryption with auxiliary input and for “output-only dependent” hardcore bits for general one-way functions.

ABE with improved auxiliary input for big data security

Attribute-based encryption (ABE) is recommended by the Cloud Security Alliance (CSA) as one of the possible cryptographic tools for access control in big data applications. In ABE, the shared file can be encrypted with the specific policy only once, and it can be decrypted by any receiver whose attributes are satisfied. When ABE is deployed in some open network scenarios, it is inevitably attacked by side channel attacks, because the big data are coming from diverse end-points. In this paper, we propose leakage resilient CP-ABE and KP-ABE schemes in the improved auxiliary input model, which allows the attacker query more leakage information regarding the encryption randomness after seeing the challenge ciphertext. Moreover, we construct an improved strong extractor from the modified Goldreich–Levin theorem for the security proof and prove that our scheme security relies on the Wang et al. construction.

Public key cryptosystems secure against memory leakage attacks

The authors present a new general construction of public key encryption (PKE) based on the restricted subset membership (RSM) assumption, which can achieve the bounded-memory leakage resilient security and the auxiliary-input leakage resilient security simultaneously. The construction is BHHO-type, as Brakerski et al. work, but the message space is much larger and the proof is more concise benefiting from the RSM assumption. Instantiating the construction with the QR assumption, the authors get the first QR-based auxiliary-input secure PKE with a larger message space than {0,1}. Moreover, the authors generalise the Goldreich–Levin theorem to large rings. This theorem helps to improve the construction to achieve the same security level with fewer public parameters and shorter ciphertexts compared with Brakerski et al. work. For the bounded-memory leakage resilient security, the construction can achieve leakage rate of 1 − o(1) and avoid the dependence between the message length and the amount of leakage. Based on the general construction, the authors also can achieve both bounded-memory leakage resilient chosen ciphertext attack (CCA) security and the auxiliary-input leakage resilient CCA security via the well-known Naor–Yung paradigm.

Attribute-based encryption resilient to continual auxiliary leakage with constant size ciphertexts

For leakage-resilient ciphertext-policy attribute-based encryption (CP-ABE) at present, the size of the ciphertexts in most of them relies on the number of attributes. How to overcome this shortcoming is a challenge problem. Based on the Goldreich-Levin theorem and dual system encryption, an efficient CP-ABE scheme with constant size ciphertexts is proposed in this paper. It can tolerate leakage on master secret key and attribute-based secret keys with auxiliary inputs. Furthermore, the proposed scheme can be realized as resilience against continual leakage if keys are periodically updated. Under some static assumptions instead of other strong assumptions, the introduced scheme achieves adaptively security in the standard model.

Quadratic Goldreich--Levin Theorems

Decomposition theorems in classical Fourier analysis enable us to express a bounded function in terms of few linear phases with large Fourier coefficients plus a part that is pseudorandom with respect to linear phases. The Goldreich--Levin algorithm [O. Goldreich and L. Levin, “A Hard-Core Predicate for All One-Way Functions," in Proceedings of the 21st Annual ACM Symposium on Theory of Computing, 1989, pp. 25--32] can be viewed as an algorithmic analogue of such a decomposition as it gives a way to efficiently find the linear phases associated with large Fourier coefficients. In the study of “quadratic Fourier analysis,” higher-degree analogues of such decompositions have been developed in which the pseudorandomness property is stronger but the structured part is correspondingly weaker. For example, it has been shown that it is possible to express a bounded function as a sum of a few quadratic phases plus a part that is small in the $U^3$ norm, defined by Gowers for the purpose of counting arithmetic progressions of length 4. We give a polynomial time algorithm for computing such a decomposition. A key part of the algorithm is a local self-correction procedure for Reed--Muller codes of order 2 (over $\F_2^n$) for a function at distance $1/2-\e$ from a codeword. Given a function $f:\F_2^n \to \{-1,1\}$ at fractional Hamming distance $1/2-\e$ from a quadratic phase (which is a codeword of the Reed--Muller code of order 2), we give an algorithm that runs in time polynomial in $n$ and finds a codeword at distance at most $1/2-\eta$ for $\eta = \eta(\e)$. This is an algorithmic analogue of Samorodnitsky's result [A. Samorodnitsky, “Low-Degree Tests at Large Distances,” in Proceedings of the 39th Annual ACM Symposium on Theory of Computing, 2007, pp. 506--515], which gave a tester for the above problem. To our knowledge, it represents the first instance of a correction procedure for any class of codes, beyond the list-decoding radius. For this purpose, we give algorithmic versions of results from additive combinatorics used in Samorodnitsky's proof and a refined version of the inverse theorem for the Gowers $U^3$ norm over $\F_2^n$.

Verifiable Random Functions: Relations to Identity-Based Key Encapsulation and New Constructions

In this paper we show a relation between the notions of verifiable random functions (VRFs) and identity-based key encapsulation mechanisms (IB-KEMs). In particular, we propose a class of IB-KEMs that we call VRF-suitable, and we propose a direct construction of VRFs from VRF-suitable IB-KEMs. Informally, an IB-KEM is VRF-suitable if it provides what we call unique decapsulation (i.e., given a ciphertext C produced with respect to an identity ID, all the secret keys corresponding to identity ID′, decapsulate to the same value, even if ID≠ID′), and it satisfies an additional property that we call pseudo-random decapsulation. In a nutshell, pseudo-random decapsulation means that if one decapsulates a ciphertext C, produced with respect to an identity ID, using the decryption key corresponding to any other identity ID′, the resulting value looks random to a polynomially bounded observer. Our construction is of interest both from a theoretical and a practical perspective. Indeed, apart from establishing a connection between two seemingly unrelated primitives, our methodology is direct in the sense that, in contrast to most previous constructions, it avoids the inefficient Goldreich–Levin hardcore bit transformation. As an additional contribution, we propose a new VRF-suitable IB-KEM based on the decisional ℓ-weak Bilinear Diffie–Hellman Inversion assumption. Interestingly, when applying our transformation to this scheme, we obtain a new VRF construction that is secure under the same assumption, and it efficiently supports a large input space.

Quantum attacks on pseudorandom generators

There are advantages in the use of quantum computing in the elaboration of attacks on certain pseudorandom generators when compared with analogous attacks using classical computing. This paper presents a polynomial time quantum attack on the Blum–Micali generator, which is considered secure against threats from classical computers. The proposed attack uses a Grover inspired procedure together with the quantum discrete logarithm, and is able to recover previous and future outputs of the generator under attack, thereby completely compromising its unpredictability. The attack can also be adapted to other generators, such as Blum–Micali generators with multiple hard-core predicates and generators from the Blum–Micali construction, and also to scenarios where the requirements on the bits are relaxed. Such attacks represent a threat to the security of the pseudorandom generators adopted in many real-world cryptosystems.

Paillier’s trapdoor function hides Θ(n) bits

In this paper, we re-examine the bit security of Paillier's trapdoor function. We show that given a random w = g c y N mod N 2 ∈ Z N2 * the most significant bit of its class c is a hard-core predicate, under a standard assumption that is computing composite residuosity class is hard. For the simultaneous security, we prove that n number of the class c 's bits are simultaneously hard-core under the standard assumption, where n is the length of c .

Learning unions of [formula omitted]-dimensional rectangles

We consider the problem of learning unions of rectangles over the domain [ b ] n , in the uniform distribution membership query learning setting, where both b and n are “large”. We obtain poly ( n , log b ) -time algorithms for the following classes: • poly ( n log b ) -way Majority of O ( log ( n log b ) log log ( n log b ) ) -dimensional rectangles. • Union of poly ( log ( n log b ) ) many O ( log 2 ( n log b ) ( log log ( n log b ) log log log ( n log b ) ) 2 ) -dimensional rectangles. • poly ( n log b ) -way Majority of poly ( n log b ) - Or of disjoint O ( log ( n log b ) log log ( n log b ) ) dimensional rectangles. Our main algorithmic tool is an extension of Jackson’s boosting- and Fourier-based Harmonic Sieve algorithm [J.C. Jackson, An efficient membership-query algorithm for learning DNF with respect to the uniform distribution, Journal of Computer and System Sciences 55 (3) (1997) 414–440] to the domain [ b ] n , building on work of Akavia et al. [A. Akavia, S. Goldwasser, S. Safra, Proving hard core predicates using list decoding, in: Proc. of the 44th Annual IEEE Symposium on Foundations of Computer Science, FOCS ’03, 2003, pp. 146–156]. Other ingredients used to obtain the results stated above are techniques from exact learning [A. Beimel, E. Kushilevitz, Learning boxes in high dimension, Algorithmica 22 (1/2) (1998) 76–90] and ideas from recent work on learning augmented AC 0 circuits [J.C. Jackson, A.R. Klivans, R.A. Servedio, Learnability beyond AC 0 , in: Proc. of the 34th Annual ACM Symposium on Theory of Computing, STOC ’02, 2002, pp. 776–784] and on representing Boolean functions as thresholds of parities [A.R. Klivans, R.A. Servedio, Learning DNF in time 2 O ̃ ( n 1 / 3 ) , Journal of Computer and System Sciences 68 (2) (2004) 303–318].

Logical concepts in cryptography

The thesis is about a breadth-first exploration of logical concepts in cryptography and their linguistic abstraction and model-theoretic combination in a comprehensive logical system, called CPL (for Cryptographic Protocol Logic ). We focus on two fundamental aspects of cryptography. Namely, the security of communication (as opposed to security of storage ) and cryptographic protocols (as opposed to cryptographic operators ). The logical concepts explored are the following. Primary concepts: the modal concepts of belief, knowledge, norms, provability, space, and time. Secondary concepts: belief with error control, individual and propositional knowledge, confidentiality norms, truth-functional and relevant (in particular, intuitionistic) implication, multiple and complex truth values, and program types. The distinguishing feature of CPL is that it unifies and refines a variety of existing approaches. This feature is the result of our wholistic conception of property-based (modal logics) and model-based (process algebra) formalisms. We illustrate the expressiveness of CPL on representative requirements engineering case studies. Further, we extend (core) CPL (qualitative time) with rational-valued time , i.e., time stamps, timed keys, and potentially drifting local clocks, to tCPL (quantitative time). Our extension is conservative and provides further evidence for Lamport's claim that adding real time to an untimed formalism is really simple. Furthermore, we sketch an extension of (core) CPL with a notion of probabilistic polynomial-time (PP) computation. We illustrate the expressiveness of this extended logic (ppCPL) on tentative formalisation case studies of fundamental and applied concepts. Fundamental concepts: (1) one-way function, (2) hard-core predicate, (3) computational indistinguishability, (4) ( n -party) interactive proof, and (5) ( n -prover) zero-knowledge. Applied concepts: (1) security of encryption schemes, (2) unforgeability of signature schemes, (3) attacks on encryption schemes, (4) attacks on signature schemes, and (5) breaks of signature schemes. In the light of logic, adding PP to a formalism for cryptographic protocols is perhaps also simple and can be achieved with an Ockham's razor extension of an existing core logic, namely CPL.

Improved algorithms for quantum identification of Boolean oracles

The oracle identification problem (OIP) was introduced by Ambainis et al. [A. Ambainis, K. Iwama, A. Kawachi, H. Masuda, R.H. Putra, S. Yamashita, Quantum identification of boolean oracles, in: Proc. of STACS’04, in: LNCS, vol. 2996, 2004, pp. 105–116]. It is given as a set S of M oracles and a blackbox oracle f . Our task is to figure out which oracle in S is equal to the blackbox f by making queries to f . OIP includes several problems such as the Grover Search as special cases. In this paper, we improve the algorithms in [A. Ambainis, K. Iwama, A. Kawachi, H. Masuda, R.H. Putra, S. Yamashita, Quantum identification of boolean oracles, in: Proc. of STACS’04, in: LNCS, vol. 2996, 2004, pp. 105–116] by providing a mostly optimal upper bound of query complexity for this problem: (i) For any oracle set S such that | S | ≤ 2 N d ( d < 1 ) , we design an algorithm whose query complexity is O ( N log M / log N ) , matching the lower bound proved in [A. Ambainis, K. Iwama, A. Kawachi, H. Masuda, R.H. Putra, S. Yamashita, Quantum identification of boolean oracles, in: Proc. of STACS’04, in: LNCS, vol. 2996, 2004, pp. 105–116]. (ii) Our algorithm also works for the range between 2 N d and 2 N / log N (where the bound becomes O ( N ) ), but the gap between the upper and lower bounds worsens gradually. (iii) Our algorithm is robust, namely, it exhibits the same performance (up to a constant factor) against noisy oracles as also shown in the literature [M. Adcock, R. Cleve, A quantum Goldreich–Levin theorem with cryptographic applications, in: Proc. of STACS’02, in: LNCS, vol. 2285, 2002, pp. 323–334; H. Buhrman, I. Newman, H. Röhrig, R. deWolf, Robust quantum algorithms and polynomials, in: Proc. of STACS’05, in: LNCS, vol. 3404, 2005, pp. 593–604; P. Høyer, M. Mosca, R. de Wolf, Quantum search on bounded-error inputs, in: Proc. of ICALP’03, in: LNCS, vol. 2719, 2003, pp. 291–299] for special cases of OIP.

Quantum lower bounds for the Goldreich–Levin problem

At the heart of the Goldreich–Levin theorem is the problem of determining an n-bit string a by making queries to two oracles, referred to as IP (inner product) and EQ (equivalence). The IP oracle, on input x, returns a bit that is biased towards a ⋅ x (the modulo two inner product of a with x) in the following sense. For a random x, the probability that IP ( x ) = a ⋅ x is at least 1 2 ( 1 + ɛ ) . The EQ oracle, on input x, returns a bit specifying whether or not x = a . It has been shown that a quantum algorithm can solve this problem with O ( 1 / ɛ ) IP and EQ queries, whereas any classical algorithm requires Ω ( n / ɛ 2 ) such queries. Also, the quantum algorithm requires only O ( n / ɛ ) auxiliary one- and two-qubit gates in addition to its queries. We show that the above quantum algorithm is optimal in terms of both EQ and IP queries. Specifically, Ω ( 1 / ɛ ) EQ queries are necessary, and Ω ( 1 / ɛ ) IP queries are necessary if the number of EQ queries is o ( 2 n ) .

Extractor Codes

We study error-correcting codes for highly noisy channels. For example, every received signal in the channel may originate from some half of the symbols in the alphabet. Our main conceptual contribution is an equivalence between error-correcting codes for such channels and extractors. Our main technical contribution is a new explicit error-correcting code based on Trevisan's extractor that can handle such channels, and even noisier ones. Our new code has polynomial-time encoding and polynomial-time soft-decision decoding. We note that Reed-Solomon codes cannot handle such channels, and our study exposes some limitations on list decoding of Reed-Solomon codes. Another advantage of our equivalence is that when the Johnson bound is restated in terms of extractors, it becomes the well-known Leftover Hash Lemma. This yields a new proof of the Johnson bound which applies to large alphabets and soft decoding. Our explicit codes are useful in several applications. First, they yield algorithms to extract many hardcore bits using few auxiliary random bits. Second, they are the key tool in a recent scheme to compactly store a set of elements in a way that membership in the set can be determined by looking at only one bit of the representation. Finally, they are the basis for the recent construction of high-noise, almost-optimal rate list-decodable codes over large alphabets.