Prior work has established that all problems in NP admit classical zero-knowledge proof systems, and under reasonable hardness assumptions for quantum computations, these proof systems can be made secure against quantum attacks. We prove a result representing a further quantum generalization of this fact, which is that every problem in the complexity class QMA has a quantum zero-knowledge proof system. More specifically, assuming the existence of an unconditionally binding and quantum computationally concealing commitment scheme, we prove that every problem in the complexity class QMA has a quantum interactive proof system that is zero-knowledge with respect to efficient quantum computations. Our QMA proof system is sound against arbitrary quantum provers, but only requires an honest prover to perform polynomial-time quantum computations, provided that it holds a quantum witness for a given instance of the QMA problem under consideration.Prior work has established that all problems in NP admit classical zero-knowledge proof systems, and under reasonable hardness assumptions for quantum computations, these proof systems can be made secure against quantum attacks. We prove a result representing a further quantum generalization of this fact, which is that every problem in the complexity class QMA has a quantum zero-knowledge proof system. More specifically, assuming the existence of an unconditionally binding and quantum computationally concealing commitment scheme, we prove that every problem in the complexity class QMA has a quantum interactive proof system that is zero-knowledge with respect to efficient quantum computations. Our QMA proof system is sound against arbitrary quantum provers, but only requires an honest prover to perform polynomial-time quantum computations, provided that it holds a quantum witness for a given instance of the QMA problem under consideration.

arXiv:1604.02804Annual Symposium on Foundations of Computer ScienceOct 1, 201644 citations

Zero-Knowledge Proof Systems for QMA

Anne Broadbent, Zhengfeng Ji, Fang Song +1 more

Prior work has established that all problems in NP admit classical zero-knowledge proof systems, and under reasonable hardness assumptions for quantum computations, these proof systems can be made secure against quantum attacks. We prove a result representing a further quantum generalization of this fact, which is that every problem in the complexity class QMA has a quantum zero-knowledge proof system. More specifically, assuming the existence of an unconditionally binding and quantum computationally concealing commitment scheme, we prove that every problem in the complexity class QMA has a quantum interactive proof system that is zero-knowledge with respect to efficient quantum computations. Our QMA proof system is sound against arbitrary quantum provers, but only requires an honest prover to perform polynomial-time quantum computations, provided that it holds a quantum witness for a given instance of the QMA problem under consideration. The proof system relies on a new variant of the QMA-complete local Hamiltonian problem in which the local terms are described by Clifford operations and standard basis measurements. We believe that the QMA-completeness of this problem may have other uses in quantum complexity.Prior work has established that all problems in NP admit classical zero-knowledge proof systems, and under reasonable hardness assumptions for quantum computations, these proof systems can be made secure against quantum attacks. We prove a result representing a further quantum generalization of this fact, which is that every problem in the complexity class QMA has a quantum zero-knowledge proof system. More specifically, assuming the existence of an unconditionally binding and quantum computationally concealing commitment scheme, we prove that every problem in the complexity class QMA has a quantum interactive proof system that is zero-knowledge with respect to efficient quantum computations. Our QMA proof system is sound against arbitrary quantum provers, but only requires an honest prover to perform polynomial-time quantum computations, provided that it holds a quantum witness for a given instance of the QMA problem under consideration. The proof system relies on a new variant of the QMA-complete local Hamiltonian problem in which the local terms are described by Clifford operations and standard basis measurements. We believe that the QMA-completeness of this problem may have other uses in quantum complexity.

SIAM Journal on ComputingJan 1, 202014 citations

QMA-Hardness of Consistency of Local Density Matrices with Applications to Quantum Zero-Knowledge

Anne Broadbent, Alex B. Grilo

We provide several advances to the understanding of the class of quantum Merlin--Arthur (QMA) proof systems, the quantum analogue of NP. Our central contribution is proving a longstanding conjecture that the consistency of local density matrices (CLDM) problem is QMA-hard under Karp reductions. The input of CLDM consists of local reduced density matrices on sets of at most $k$ qubits, and the problem asks if there is an $n$ -qubit global quantum state that is locally consistent with all of the $k$ -qubit local density matrices. The containment of this problem in QMA and the QMA-hardness under Turing reductions were proved by Liu [in Proceeding of APPROX-RANDOM, 2006, pp. 438--449]. Liu also conjectured that CLDM is QMA-hard under Karp reductions, which is desirable for applications, and we finally prove this conjecture. We establish this result using the techniques of simulatable codes of Grilo, Slofstra, and Yuen [in Proceeding of FOCS, 2019, pp. 611--635], simplifying their proofs and tailoring them to the context of QMA. In order to develop applications of CLDM, we propose a framework that we call locally simulatable proofs for QMA: this provides QMA proofs that can be efficiently verified by probing only $k$ qubits and, furthermore, the reduced density matrix of any $k$ -qubit subsystem of an accepting witness can be computed in polynomial time, independently of the witness. Within this framework, we show several advances in zero-knowledge in the quantum setting. We show for the first time a commit-and-open computational zero-knowledge proof system for all of QMA, as a quantum analogue of a “sigma” protocol. We then define a proof of quantum knowledge, which guarantees that a prover is effectively in possession of a quantum witness in an interactive proof and show that our zero-knowledge proof system satisfies this definition. Finally, we show that our proof system can be used to establish that QMA has a quantum noninteractive zero-knowledge proof system in the secret parameter setting.We provide several advances to the understanding of the class of quantum Merlin--Arthur (QMA) proof systems, the quantum analogue of NP. Our central contribution is proving a longstanding conjecture that the consistency of local density matrices (CLDM) problem is QMA-hard under Karp reductions. The input of CLDM consists of local reduced density matrices on sets of at most $k$ qubits, and the problem asks if there is an $n$-qubit global quantum state that is locally consistent with all of the $k$-qubit local density matrices. The containment of this problem in QMA and the QMA-hardness under Turing reductions were proved by Liu [in Proceeding of APPROX-RANDOM, 2006, pp. 438--449]. Liu also conjectured that CLDM is QMA-hard under Karp reductions, which is desirable for applications, and we finally prove this conjecture. We establish this result using the techniques of simulatable codes of Grilo, Slofstra, and Yuen [in Proceeding of FOCS, 2019, pp. 611--635], simplifying their proofs and tailoring them to the context of QMA. In order to develop applications of CLDM, we propose a framework that we call locally simulatable proofs for QMA: this provides QMA proofs that can be efficiently verified by probing only $k$ qubits and, furthermore, the reduced density matrix of any $k$-qubit subsystem of an accepting witness can be computed in polynomial time, independently of the witness. Within this framework, we show several advances in zero-knowledge in the quantum setting. We show for the first time a commit-and-open computational zero-knowledge proof system for all of QMA, as a quantum analogue of a “sigma” protocol. We then define a proof of quantum knowledge, which guarantees that a prover is effectively in possession of a quantum witness in an interactive proof and show that our zero-knowledge proof system satisfies this definition. Finally, we show that our proof system can be used to establish that QMA has a quantum noninteractive zero-knowledge proof system in the secret parameter setting.

arXiv:1911.07782SIAM Journal on ComputingAug 1, 202228 citations

Quantum protocols for zero-knowledge systems

José Cláudio do Nascimento, Rubens Viana Ramos

Quantum Information ProcessingAug 10, 20095 citations

k

qubits, and the problem asks if there is an

n

-qubit global quantum state that is locally consistent with all of the

k

-qubit local density matrices. The containment of this problem in QMA and the QMA-hardness under Turing reductions were proved by Liu [in Proceeding of APPROX-RANDOM, 2006, pp. 438--449]. Liu also conjectured that CLDM is QMA-hard under Karp reductions, which is desirable for applications, and we finally prove this conjecture. We establish this result using the techniques of simulatable codes of Grilo, Slofstra, and Yuen [in Proceeding of FOCS, 2019, pp. 611--635], simplifying their proofs and tailoring them to the context of QMA. In order to develop applications of CLDM, we propose a framework that we call locally simulatable proofs for QMA: this provides QMA proofs that can be efficiently verified by probing only

k

qubits and, furthermore, the reduced density matrix of any

k

-qubit subsystem of an accepting witness can be computed in polynomial time, independently of the witness. Within this framework, we show several advances in zero-knowledge in the quantum setting. We show for the first time a commit-and-open computational zero-knowledge proof system for all of QMA, as a quantum analogue of a “sigma” protocol. We then define a proof of quantum knowledge, which guarantees that a prover is effectively in possession of a quantum witness in an interactive proof and show that our zero-knowledge proof system satisfies this definition. Finally, we show that our proof system can be used to establish that QMA has a quantum noninteractive zero-knowledge proof system in the secret parameter setting.