In a recent seminal work, Bitansky and Shmueli (STOC '20) gave the first construction of a constant round zero-knowledge argument for NP secure against quantum attacks. However, their construction has several drawbacks compared to the classical counterparts. Specifically, their construction only achieves computational soundness, requires strong assumptions of quantum hardness of learning with errors (QLWE assumption) and the existence of quantum fully homomorphic encryption (QFHE), and relies on non-black-box simulation. In this paper, we resolve these issues at the cost of weakening the notion of zero-knowledge to what is called
ε-zero-knowledge. Concretely, we construct the following protocols: - We construct a constant round interactive proof for NP that satisfies statistical soundness and black-box
ε-zero-knowledge against quantum attacks assuming the existence of collapsing hash functions, which is a quantum counterpart of collision-resistant hash functions. Interestingly, this construction is just an adapted version of the classical protocol by Goldreich and Kahan (JoC '96) though the proof of
ε-zero-knowledge property against quantum adversaries requires novel ideas. - We construct a constant round interactive argument for NP that satisfies computational soundness and black-box
ε-zero-knowledge against quantum attacks only assuming the existence of post-quantum one-way functions. At the heart of our results is a new quantum rewinding technique that enables a simulator to extract a committed message of a malicious verifier while simulating verifier's internal state in an appropriate sense.
We obtain the first constant-round post-quantum multi-party computation protocol for general classical functionalities in the plain model, with security against malicious corruptions. We assume mildly super-polynomial quantum hardness of learning with errors (LWE), and quantum polynomial hardness of an LWE-based circular security assumption. Along the way, we also construct the following protocols that may be of independent interest.
(1) Constant-round zero-knowledge against parallel quantum verifiers from quantum polynomial assumptions.
Here, we develop a novel parallel no-cloning non-black-box simulation technique. This uses as a starting point the recently introduced no-cloning technique of Bitansky and Shmueli (STOC 2020) and Ananth and La Placa (ePrint 2019), which in turns builds on the classical non-black-box technique of Bitansky, Khurana and Paneth (STOC 2019). Our approach relies on a new technical tool, spooky encryption for relations computable by quantum circuits, that we also construct.
(2) Constant-round post-quantum non-malleable commitments from mildly super-polynomial quantum hardness of LWE.
This is the first construction of post-quantum non-malleable commitments in the plain model, and is obtained by transforming the construction of Khurana and Sahai (FOCS 2017) to obtain post-quantum security.
We achieve quantum security by building a new straight-line non-black-box simulator against parallel verifiers that does not clone the adversary's state. This technique may also be relevant to the classical setting.
We initiate the study of multi-party computation for classical functionalities (in the plain model) with security against malicious polynomial-time quantum adversaries. We observe that existing techniques readily give a polynomial-round protocol, but our main result is a construction of *constant-round* post-quantum multi-party computation. We assume mildly super-polynomial quantum hardness of learning with errors (LWE), and polynomial quantum hardness of an LWE-based circular security assumption. Along the way, we develop the following cryptographic primitives that may be of independent interest: 1. A spooky encryption scheme for relations computable by quantum circuits, from the quantum hardness of an LWE-based circular security assumption. This yields the first quantum multi-key fully-homomorphic encryption scheme with classical keys. 2. Constant-round zero-knowledge secure against multiple parallel quantum verifiers from spooky encryption for relations computable by quantum circuits. To enable this, we develop a new straight-line non-black-box simulation technique against *parallel* verifiers that does not clone the adversary's state. This forms the heart of our technical contribution and may also be relevant to the classical setting. 3. A constant-round post-quantum non-malleable commitment scheme, from the mildly super-polynomial quantum hardness of LWE.
The traditional definition of quantum zero-knowledge stipulates that the knowledge gained by any quantum polynomial-time verifier in an interactive protocol can be simulated by a quantum polynomial-time algorithm. One drawback of this definition is that it allows the simulator to consume significantly more computational resources than the verifier. We argue that this drawback renders the existing notion of quantum zero-knowledge not viable for certain settings, especially when dealing with near-term quantum devices. In this work, we initiate a fine-grained notion of post-quantum zero-knowledge that is more compatible with near-term quantum devices. We introduce the notion of
(s,f) space-bounded quantum zero-knowledge. In this new notion, we require that an
s-qubit malicious verifier can be simulated by a quantum polynomial-time algorithm that uses at most
f(s)-qubits, for some function
f(⋅), and no restriction on the amount of the classical memory consumed by either the verifier or the simulator. We explore this notion and establish both positive and negative results: - For verifiers with logarithmic quantum space
s and (arbitrary) polynomial classical space, we show that
(s,f)-space-bounded QZK, for
f(s)=2s, can be achieved based on the existence of post-quantum one-way functions. Moreover, our protocol runs in constant rounds. - For verifiers with super-logarithmic quantum space
s, assuming the existence of post-quantum secure one-way functions, we show that
(s,f)-space-bounded QZK protocols, with fully black-box simulation (classical analogue of black-box simulation) can only be achieved for languages in BQP.