Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

The classical and quantum complexity of the Goldreich-Levin problem with applications to bit commitment

Mark Adcock

Published Jan 1, 2004• 1 citation
Publisher

Abstract

The classical Goldreich-Levin (G-L) theorem is presented as a block-box query prob­lem, referred to herein as the G-L problem. The query complexity of this problem is bounded in both classical and quantum settings. The well-known upper bound of the classical G-L problem is analyzed in a pedagogical manner. A proof of the lower bound of the classical G-L problem is given using the techniques of classical information theory. This classical analysis is then extended to the realm of quantum computin g by noting the similarity of the noiseless G-L problem to the inner-product query problem solved by the quantum circuit defined by Bernstein and Vazirani (B-V) . An upper bound of the query complexity of the quantum G-L problem is proven by extension of the B-V circuit to incorporate noisy inner-product queries. The lower bound of the query complexity of the quantum G-L problem is proven by adapting the proof of the optimaliy of the quantum search algorithm to include modified inner-product queries. Both the classical and quantum versions of the Goldreich-Levi n theorem have cryptographic applications in the area of bit commitment. A discussion of the im­possibility of unconditional quantum bit commitment is followed by the presentation of both classical and quantum bit commitment protocols that are based on the as­sumption of the existence of classical and quantum one-way permutations. The relative security of the classical and quant m protocols are compared where it is shown that the quantum version is quantitatively more secure.

DOI
10.11575/prism/12092

Related papers

A quantum Goldreich-Levin theorem with cryptographic applications

Mark Adcock, Richard Cleve

We investigate the Goldreich-Levin Theorem in the context of quantum information. This result is a reduction from the computational problem of inverting a one-way function to the problem of predicting a particular bit associated with that function. We show that the quantum version of the reduction -- between quantum one-way functions and quantum hard-predicates -- is quantitatively more efficient than the known classical version. Roughly speaking, if the one-way function acts on n-bit strings then the overhead in the reduction is by a factor of O(n/epsilon^2) in the classical case but only by a factor of O(1/epsilon) in the quantum case, where 1/2 + epsilon is the probability of predicting the hard-predicate. Moreover, we prove via a lower bound that, in a black-box framework, the classical version of the reduction cannot have overhead less than order n/epsilon^2. We also show that, using this reduction, a quantum bit commitment scheme that is perfectly binding and computationally concealing can be obtained from any quantum one-way permutation. This complements a recent result by Dumais, Mayers and Salvail, where the bit commitment scheme is perfectly concealing and computationally binding. We also show how to perform qubit commitment by a similar approach.

arXiv:quant-ph/0108095•Aug 22, 2001•2 citations

A Quantum Goldreich-Levin Theorem with Cryptographic Applications

Mark Adcock, Richard Cleve

We investigate the Goldreich-Levin Theorem in the context of quantum information. This result is a reduction from the problem of inverting a one-way function to the problem of predicting a particular bit associated with that function. We show that the quantum version of the reduction is quantitatively more ecient than the known classical version. If the one-way function acts on n-bit strings then the overhead in the reduction is by a factor of O(n=" ) in the classical case but only by a factor of O(1=") in the quantum case, where 2 + " is the probability of predicting the hard-predicate. We also show that, using the GoldreichLevin Theorem, a quantum bit (or qubit) commitment scheme that is perfectly binding and computationally concealing can be obtained from any quantum one-way permutation.

•Jan 1, 2001•0 citations

Quantum lower bounds for the Goldreich-Levin problem

AdcockMark, CleveRichard, IwamaKazuo +2 more

At the heart of the Goldreich-Levin theorem is the problem of determining an n-bit string a by making queries to two oracles, referred to as IP (inner product) and EQ (equivalence). The IP oracle, ...

Information Processing Letters•Mar 16, 2006•0 citations

Quantum Computational Complexity Theory and Lower Bounds

Phillip Kaye, Raymond Laflamme, Michele Mosca

We have seen in the previous chapters that quantum computers seem to be more powerful than classical computers for certain problems. There are limits on the power of quantum computers, however. Since a classical computer can simulate a quantum computer, a quantum computer can only compute the same set of functions that a classical computer can. The advantage of using a quantum computer is that the amount of resources needed by a quantum algorithm might be much less than what is needed by the best classical algorithm. In Section 9.1 we briefly define some classical and quantum complexity classes and give some relationships between them. Most of the interesting questions relating classical and quantum complexity classes remain open. For example, we do not yet know if a quantum computer is capable of efficiently solving an NP-complete problem (defined later). One can prove upper bounds on the difficulty of a problem by providing an algorithm that solves that problem, and proving that it will work within in a given running time. But how does one prove a lower bound on the computational complexity of a problem? For example, if we wish to find the product of two n-bit numbers, computing the answer requires outputting roughly 2n bits and that requires Ω(n) steps (in any computing model with finite-sized gates). The best-known upper bound for integer multiplication is O(n log n log log n) steps. It has proved extremely difficult to derive non-trivial lower bounds on the computational complexity of a problem. Most of the known non-trivial lower bounds are in the ‘black-box’ model (for both classical and quantum computing), where we only query the input via a ‘black-box’ of a specific form. We discuss the black-box model in more detail in Section 9.2. We then sketch several approaches for proving black-box lower bounds. The first technique has been called the ‘hybrid method’ and was used to prove that quantum searching requires Ω(√n) queries to succeed with constant probability. The second technique is called the ‘polynomial method’. We then describe a technique based on ‘block sensitivity’, and conclude with a technique known as the ‘adversary method’.

Oxford University Press eBooks•Nov 16, 2006•0 citations

Commitment Capacity of Classical-Quantum Channels

Masahito Hayashi, Naqueeb Ahmad Warsi

We study commitment scheme for classical-quantum channels. To accomplish this we define various notions of commitment capacity for these channels and prove matching upper and lower bound on it in terms of the conditional entropy. Our achievability (lower bound) proof is quantum generalisation of the work of one of the authors (arXiv:2103.11548) which studied the problem of secure list decoding and its application to bit-string commitment. The techniques we use in the proof of converse (upper bound) is similar in spirit to the techniques introduced by Winter, Nascimento and Imai (Cryptography and Coding 2003) to prove upper bound on the commitment capacity of classical channels. However, generalisation of this technique to the quantum case is not so straightforward and requires some new constructions, which can be of independent interest.

IEEE Transactions on Information Theory•Apr 19, 2023•4 citations

Commitment capacity of classical-quantum channels

Masahito Hayashi, Naqueeb Ahmad Warsi

We study commitment scheme for classical-quantum channels. To accomplish this we define various notions of commitment capacity for these channels and prove matching upper and lower bound on it in terms of the conditional entropy. Our achievability (lower bound) proof is quantum generalisation of the work of one of the authors (arXiv:2103.11548) which studied the problem of secure list decoding and its application to bit-string commitment. The techniques we use in the proof of converse (upper bound) is similar in spirit to the techniques introduced by Winter, Nascimento and Imai (Cryptography and Coding 2003) to prove upper bound on the commitment capacity of classical channels. However, generalisation of this technique to the quantum case is not so straightforward and requires some new constructions, which can be of independent interest.

arXiv:2201.06333•Jan 17, 2022•0 citations
The classical Goldreich-Levin (G-L) theorem is presented as a block-box query prob­lem, referred to herein as the G-L problem. The query complexity of this problem is bounded in both classical and quantum settings. The well-known upper bound of the classical G-L problem is analyzed in a pedagogical manner. A proof of the lower bound of the classical G-L problem is given using the techniques of classical information theory. This classical analysis is then extended to the realm of quantum computin g by noting the similarity of the noiseless G-L problem to the inner-product query problem solved by the quantum circuit defined by Bernstein and Vazirani (B-V) . An upper bound of the query complexity of the quantum G-L problem is proven by extension of the B-V circuit to incorporate noisy inner-product queries. The lower bound of the query complexity of the quantum G-L problem is proven by adapting the proof of the optimaliy of the quantum search algorithm to include modified inner-product queries. Both the classical and quantum versions of the Goldreich-Levi n theorem have cryptographic applications in the area of bit commitment. A discussion of the im­possibility of unconditional quantum bit commitment is followed by the presentation of both classical and quantum bit commitment protocols that are based on the as­sumption of the existence of classical and quantum one-way permutations. The relative security of the classical and quant m protocols are compared where it is shown that the quantum version is quantitatively more secure.
We investigate the Goldreich-Levin Theorem in the context of quantum information. This result is a reduction from the computational problem of inverting a one-way function to the problem of predicting a particular bit associated with that function. We show that the quantum version of the reduction -- between quantum one-way functions and quantum hard-predicates -- is quantitatively more efficient than the known classical version. Roughly speaking, if the one-way function acts on n-bit strings then the overhead in the reduction is by a factor of O(n/epsilon^2) in the classical case but only by a factor of O(1/epsilon) in the quantum case, where 1/2 + epsilon is the probability of predicting the hard-predicate. Moreover, we prove via a lower bound that, in a black-box framework, the classical version of the reduction cannot have overhead less than order n/epsilon^2. We also show that, using this reduction, a quantum bit commitment scheme that is perfectly binding and computationally concealing can be obtained from any quantum one-way permutation. This complements a recent result by Dumais, Mayers and Salvail, where the bit commitment scheme is perfectly concealing and computationally binding. We also show how to perform qubit commitment by a similar approach.
We investigate the Goldreich-Levin Theorem in the context of quantum information. This result is a reduction from the problem of inverting a one-way function to the problem of predicting a particular bit associated with that function. We show that the quantum version of the reduction is quantitatively more ecient than the known classical version. If the one-way function acts on n-bit strings then the overhead in the reduction is by a factor of O(n=" ) in the classical case but only by a factor of O(1=") in the quantum case, where 2 + " is the probability of predicting the hard-predicate. We also show that, using the GoldreichLevin Theorem, a quantum bit (or qubit) commitment scheme that is perfectly binding and computationally concealing can be obtained from any quantum one-way permutation.
We have seen in the previous chapters that quantum computers seem to be more powerful than classical computers for certain problems. There are limits on the power of quantum computers, however. Since a classical computer can simulate a quantum computer, a quantum computer can only compute the same set of functions that a classical computer can. The advantage of using a quantum computer is that the amount of resources needed by a quantum algorithm might be much less than what is needed by the best classical algorithm. In Section 9.1 we briefly define some classical and quantum complexity classes and give some relationships between them. Most of the interesting questions relating classical and quantum complexity classes remain open. For example, we do not yet know if a quantum computer is capable of efficiently solving an NP-complete problem (defined later). One can prove upper bounds on the difficulty of a problem by providing an algorithm that solves that problem, and proving that it will work within in a given running time. But how does one prove a lower bound on the computational complexity of a problem? For example, if we wish to find the product of two n-bit numbers, computing the answer requires outputting roughly 2n bits and that requires Ω(n) steps (in any computing model with finite-sized gates). The best-known upper bound for integer multiplication is O(n log n log log n) steps. It has proved extremely difficult to derive non-trivial lower bounds on the computational complexity of a problem. Most of the known non-trivial lower bounds are in the ‘black-box’ model (for both classical and quantum computing), where we only query the input via a ‘black-box’ of a specific form. We discuss the black-box model in more detail in Section 9.2. We then sketch several approaches for proving black-box lower bounds. The first technique has been called the ‘hybrid method’ and was used to prove that quantum searching requires Ω(√n) queries to succeed with constant probability. The second technique is called the ‘polynomial method’. We then describe a technique based on ‘block sensitivity’, and conclude with a technique known as the ‘adversary method’.
We study commitment scheme for classical-quantum channels. To accomplish this we define various notions of commitment capacity for these channels and prove matching upper and lower bound on it in terms of the conditional entropy. Our achievability (lower bound) proof is quantum generalisation of the work of one of the authors (arXiv:2103.11548) which studied the problem of secure list decoding and its application to bit-string commitment. The techniques we use in the proof of converse (upper bound) is similar in spirit to the techniques introduced by Winter, Nascimento and Imai (Cryptography and Coding 2003) to prove upper bound on the commitment capacity of classical channels. However, generalisation of this technique to the quantum case is not so straightforward and requires some new constructions, which can be of independent interest.
We study commitment scheme for classical-quantum channels. To accomplish this we define various notions of commitment capacity for these channels and prove matching upper and lower bound on it in terms of the conditional entropy. Our achievability (lower bound) proof is quantum generalisation of the work of one of the authors (arXiv:2103.11548) which studied the problem of secure list decoding and its application to bit-string commitment. The techniques we use in the proof of converse (upper bound) is similar in spirit to the techniques introduced by Winter, Nascimento and Imai (Cryptography and Coding 2003) to prove upper bound on the commitment capacity of classical channels. However, generalisation of this technique to the quantum case is not so straightforward and requires some new constructions, which can be of independent interest.