Quantum-secure message authentication via blind-unforgeability

TL;DR

This paper introduces a new quantum-aware notion of message unforgeability called blind unforgeability, supporting classical and quantum cryptographic constructions and demonstrating its strength over previous definitions.

Contribution

The paper proposes the blind unforgeability definition for quantum adversaries, extending classical unforgeability notions and validating it with cryptographic examples and constructions.

Findings

Blind unforgeability coincides with EUF-CMA classically.

Hash-and-MAC and Lamport signatures are unforgeable under this definition.

Blind unforgeability is stronger than previous quantum unforgeability notions.

Abstract

Formulating and designing authentication of classical messages in the presence of adversaries with quantum query access has been a longstanding challenge, as the familiar classical notions of unforgeability do not directly translate into meaningful notions in the quantum setting. A particular difficulty is how to fairly capture the notion of "predicting an unqueried value" when the adversary can query in quantum superposition. We propose a natural definition of unforgeability against quantum adversaries called blind unforgeability. This notion defines a function to be predictable if there exists an adversary who can use "partially blinded" oracle access to predict values in the blinded region. We support the proposal with a number of technical results. We begin by establishing that the notion coincides with EUF-CMA in the classical setting and go on to demonstrate that the notion is satisfied by a number of simple guiding examples, such as random functions and quantum-query-secure pseudorandom functions. We then show the suitability of blind unforgeability for supporting canonical constructions and reductions. We prove that the "hash-and-MAC" paradigm and the Lamport one-time digital signature scheme are indeed unforgeable according to the definition. To support our analysis, we additionally define and study a new variety of quantum-secure hash functions called Bernoulli-preserving. Finally, we demonstrate that blind unforgeability is stronger than a previous definition of Boneh and Zhandry [EUROCRYPT '13, CRYPTO '13] in the sense that we can construct an explicit function family which is forgeable by an attack that is recognized by blind-unforgeability, yet satisfies the definition by Boneh and Zhandry.

Equations

$$B_{ϵ}{\mathsf{Mac}}_k(x):=\{\begin{array}{ll}\perp & \text{if x∈Bϵ},\\ {\mathsf{Mac}}_k(x)& \text{otherwise.}\end{array}$$

$$\underset{B_{ϵ}}{E}{\Vert {\mathcal{A}}^f(1^n)-{\mathcal{A}}^{f\oplus g_{B_{ϵ}}}(1^n)\Vert }_1\le 2T\sqrt{ϵ}.$$

$$M_k(x)=\{\begin{array}{ll}g(x^{\prime }\mathrm{mod}p)\Vert f(x^{\prime })& x=1\Vert x^{\prime },\\ 0^n\Vert h(x^{\prime })& x=0\Vert x^{\prime },x^{\prime }\ne p,\\ 0^{2n}& x=0\Vert p.\end{array}$$

$$\sum _{x,y}|1,x{⟩}_X|0^n{⟩}_{Y_1}|y{⟩}_{Y_2}⟼\sum _{x,y}|1,x{⟩}_X|g_p(x){⟩}_{Y_1}|y\oplus f(x){⟩}_{Y_2};$$

$$\begin{array}{ccccc}\mathsf{EUF}\text{mbox}-\mathsf{CMA}& \stackrel{\text{cite}[cite][\text{@@bibref}BZ13a]}{⟺}& \mathsf{PO}& \stackrel{\text{hyperref@@ii[prop:MAC-EUF=BU]Proposition refprop:MAC-EUF=BU}}{⟺}& \mathsf{BU}\end{array}$$

$$\begin{array}{ccccc}\mathsf{PO}& \stackrel{\text{hyperref@@ii[cor:separation]Corollary refcor:separation}}{/⟹}& \mathsf{BU}& \begin{array}{c}\stackrel{\text{Observation}}{/⟹}\\ \underset{\text{hyperref@@ii[cor:qprfandk-wise]Corollary refcor:qprfandk-wise}}{⟸}\end{array}& \mathsf{qPRF}\end{array}$$

$$\Bigl{|}\underset{k\in_{R}K}{\Pr}\bigl{[}\mathcal{D}^{f_{k}}(1^{n})=1\bigr{]}-\underset{g\in_{R}\mathcal{F}_{X}^{Y}}{\Pr}\bigl{[}\mathcal{D}^{g}(1^{n})=1\bigr{]}\Bigr{|}\,\leq\mathrm{negl}(n)\,.$$

$$\underset{k\in_{R}K}{\Pr}\bigl{[}\mathcal{D}^{f_{k}}(1^{n})=1\bigr{]}=\underset{g\in_{R}\mathcal{F}_{X}^{Y}}{\Pr}\bigl{[}\mathcal{D}^{g}(1^{n})=1\bigr{]}\,.$$

$${\eta }_F=|{\varphi }_0⟩⟨{\varphi }_0{|}^{\otimes 2^n},|{\varphi }_0⟩=2^{-\frac{m}{2}}\sum _{y\in \{0,1{\}}^m}|y⟩,$$

$$U_H({\mathrm{CNOT}}^{\otimes m}{)}_{F_x:Y}{U}_H^{†}$$

$$H_A\otimes H_B{\mathrm{CNOT}}_{A:B}{H}_A\otimes H_B={\mathrm{CNOT}}_{B:A},$$

$$|x{⟩}_X|{\varphi }_y{⟩}_Y|0^m{⟩}^{\otimes 2^n}⟼|x{⟩}_X|{\varphi }_y{⟩}_Y|0^m{⟩}^{\otimes (\text{lex}(x)-1)}|y{⟩}_{F_x}|0^m{⟩}^{\otimes (2^n-\text{lex}(x))},$$

$$U_{XYF}^{\mathrm{FO}}={\left(H^{\otimes m{2}^n}\right)}_F{U}_{XYF}^{\mathrm{O}}{\left(H^{\otimes m{2}^n}\right)}_F.$$

$$N_F=\sum _{x\in \{0,1{\}}^n}(\text{mathds}1-|0⟩⟨0|{)}_{F_x}\otimes \text{mathds}{1}^{\otimes (2^n-1)}.$$

$$N_F$$

$$S_l$$

$$Bf(x)=\{\begin{array}{ll}\perp & \text{if x∈B},\\ f(x)& \text{otherwise.}\end{array}$$

$$\Pr\bigl{[}\mathsf{BlindForge}_{\mathcal{A},\Pi}(n,\epsilon(n))=1]\leq\negl\,.$$

$$\Pr\bigl{[}\mathsf{BlindForge}^{q}_{\mathcal{A},\Pi}(n,\epsilon(n))=1]\leq\negl\,.$$

$$B_{ϵ}{\mathsf{Mac}}_{k;r}(m):=\{\begin{array}{ll}\perp & \text{ if }(m,{\mathsf{Mac}}_k(m;r))\in B_{ϵ},\\ {\mathsf{Mac}}_k(m;r)& \text{ otherwise.}\end{array}$$

$$\operatorname*{\mathbb{E}}_{B}\bigl{[}\delta\bigl{(}\mathcal{A}^{F}(1^{n}),\mathcal{A}^{F\oplus P}(1^{n})\bigr{)}\bigr{]}\leq 2T\sqrt{\epsilon}.$$

$$\tilde{p}:={\mathrm{Pr}}_{k,(m,t)\leftarrow {\mathcal{A}}^{{\mathsf{Mac}}_k}(1^n)}\left[{\mathsf{Mac}}_k(m)=t\wedge m\notin \mathsf{supp}(\mathcal{A})\right]\ge n^{-c},$$

$$p:=$$

$$\ge$$

$$=$$

$$\ge$$

$${\mathbb{E}}_{r,k}{\Vert {\left({\Pi }_{\mathsf{Ver},k}\right)}_{MT}(V-W{)}_{MTB}{\left(U_{\mathsf{Mac},r,k}\right)}_{MT}|\psi {⟩}_{MB}|0{⟩}_T\Vert }^2\le \epsilon ,$$

$${\Pi }_{\mathsf{Ver},k}=\sum _{(m,t)\mathrm{valid}}|m⟩⟨m|\otimes |t⟩⟨t|$$

$${\mathbb{E}}_{B_{\epsilon }}\left[{\Pi }_A^{(\epsilon )}{M}_{AB}{\bar{\Pi }}_A^{(\epsilon )}{\rho }_{AB}{\bar{\Pi }}_A^{(\epsilon )}{M}_{AB}^{†}{\Pi }_A^{(\epsilon )}\right]\ge {\epsilon }^2(1-\epsilon {)}^2{M}_{AB}{\rho }_{AB}{M}_{AB}^{†},$$

$$M_{AB}=\sum _{x\ne y}|x⟩{⟨y|}_A\otimes M_B^{(xy)}$$

$${\rho }_{AB}=\sum _{xy}|x⟩{⟨y|}_A\otimes {\rho }_B^{(xy)}.$$

$${\mathbb{E}}_{B_{\epsilon }}\left[{\Pi }_A^{(\epsilon )}{M}_{AB}{\bar{\Pi }}_A^{(\epsilon )}\rho {\bar{\Pi }}_A^{(\epsilon )}{M}_{AB}^{†}{\Pi }_A^{(\epsilon )}\right]$$

Full text

We propose a natural definition of unforgeability against quantum adversaries called blind unforgeability. This notion defines a function to be predictable if there exists an adversary who can use “partially blinded” oracle access to predict values in the blinded region. We support the proposal with a number of technical results. We begin by establishing that the notion coincides with EUF-CMA in the classical setting and go on to demonstrate that the notion is satisfied by a number of simple guiding examples, such as random functions and quantum-query-secure pseudorandom functions. We then show the suitability of blind unforgeability for supporting canonical constructions and reductions. We prove that the “hash-and-MAC” paradigm and the Lamport one-time digital signature scheme are indeed unforgeable according to the definition. To support our analysis, we additionally define and study a new variety of quantum-secure hash functions called Bernoulli-preserving.

Finally, we demonstrate that blind unforgeability is stronger than a previous definition of Boneh and Zhandry [EUROCRYPT ’13, CRYPTO ’13] in the sense that we can construct an explicit function family which is forgeable by an attack that is recognized by blind-unforgeability, yet satisfies the definition by Boneh and Zhandry.

Note: An earlier version of this article contained a theorem that the new security notion “blind-unforgeability” ($\mathsf{BU}$) we introduce implies the notion of “plus-one” unforgeability ($\mathsf{PO}$) that was hitherto the only proposed generalization of $\mathsf{EUF\mbox{-}CMA}$ to $>1$ quantum chosen-message queries. Unfortunately the proof contained an error. We thank Shih-Han Hung for discovering the error. We have now removed the claim and the question whether the implication holds is currently open. We would like to emphasize that the example presented in Section 8 disqualifies $\mathsf{PO}$ as a quantum-access generalization of $\mathsf{EUF\mbox{-}CMA}$, so currently there are two reasonable possible definitions of “quantum-access $\mathsf{EUF\mbox{-}CMA}$”: the notion of blind-unforgeability proposed in this article, and its conjunction with plus-one unforgeability.

1 Introduction

Large-scale quantum computers will break widely-deployed public-key cryptography, and may even threaten certain post-quantum candidates [21, 8, 9, 10, 5]. Even elementary symmetric-key constructions like Feistel ciphers and CBC-MACs become vulnerable in quantum attack models where the adversary is presumed to have quantum query access to some part of the cryptosystem [15, 16, 14, 20]. As an example, consider encryption in the setting where the adversary has access to the unitary operator $|x\rangle|y\rangle\mapsto|x\rangle|y\oplus f_{k}(x)\rangle$, where $f_{k}$ is the encryption or decryption function with secret key $k$. While it is debatable if this model reflects physical implementations of symmetric-key cryptography, it appears necessary in a number of generic settings, such as public-key encryption and hashing with public hash functions. It could also be relevant when private-key primitives are composed in larger protocols, e.g., by exposing circuits via obfuscation [19]. Setting down appropriate security definitions in this quantum attack model is the subject of several threads of recent research [7, 11].

In this article, we study authentication of classical information in the quantum-secure model. Here, the adversary is granted quantum query access to the signing algorithm of a message authentication code (MAC) or a digital signature scheme, and is tasked with producing valid forgeries. In the purely classical setting, we insist that the forgeries are fresh, i.e., distinct from previous queries to the oracle. When the function may be queried in superposition, however, it’s unclear how to meaningfully reflect this constraint that a forgery was previously “unqueried.” For example, it is clear that an adversary that simply queries with a uniform superposition and then measures a forgery—a feasible attack against any function—should not be considered successful. On the other hand, an adversary that uses the same query to discover some structural property (e.g., a superpolynomial-size period in the MAC) should be considered a break. Examples like these indicate the difficulty of the problem. How do we correctly “price” the queries? How do we decide if a forgery is fresh? Furthermore, how can this be done in a manner that is consistent with these guiding examples? In fact, this problem has a natural interpretation that goes well beyond cryptography: *What does it mean for a classical function to appear unpredictable to a quantum oracle algorithm?*111The related notion of “appearing random to quantum oracle algorithms” has a satisfying definition, which can be fulfilled efficiently [27].

1.1 Previous approaches

The first approach to this problem was suggested by Boneh and Zhandry [6]. They define a MAC to be unforgeable if, after making $q$ queries to the MAC, no adversary can produce $q+1$ valid input-output pairs except with negligible probability. We will refer to this notion as “$\mathsf{PO}$ security” ($\mathsf{PO}$ for “plus one,” and $k$-$\mathsf{PO}$ when the adversary is permitted a maximum of $k$ queries). Among a number of results, Boneh and Zhandry prove that this notion can be realized by a quantum-secure pseudorandom function ($\mathsf{qPRF}$).

Another approach, due to Garg, Yuen and Zhandry [12] ($\mathsf{GYZ}$), considers a function one-time unforgeable if only a trivial “query, measure in computational basis, output result” attack222Technically, the Stinespring dilation [23] of a computational basis measurement is the most general attack. is allowed. Unfortunately, it is not clear how to extend $\mathsf{GYZ}$ to two or more queries. Furthermore, the single query is allowed in a limited query model with an non-standard restriction.333Compared to the standard quantum oracle for a classical function, GYZ require the output register to be empty prior to the query. Zhandry recently showed a separation between $\mathsf{PO}$ and $\mathsf{GYZ}$ by means of the powerful tool of obfuscation [29].

It is interesting to note that similar problems arise in encryption schemes of quantum data and a convincing solution was recently found [3, 2]. However, it relies on the fact that for quantum messages, authentication implies secrecy. This enables “tricking” the adversary by replacing their queries with “trap” plaintexts to detect replays. As unforgeability and secrecy are orthogonal in the classical world, adversaries would easily recognize the spoofed oracle. This renders the approach of [3, 2] inapplicable in this case.

1.2 Unresolved issues

$\mathsf{PO}$ security, the only candidate definition of quantum-secure unforgeability in the general, multi-query setting, appears to be insufficient for several reasons. First, as observed in [12], it is a priori unclear if $\mathsf{PO}$ security rules out forging on a message region $A$ while making queries to a signing oracle supported on a disjoint message region $B$. Second, there may be unique features of quantum information, such as the destructiveness of quantum measurement, which $\mathsf{PO}$ does not capture. In particular, quantum algorithms must sometimes “consume” (i.e., fully measure) a state to extract some useful information, such as a symmetry in the oracle. There might be an adversary that makes one or more quantum queries but then must consume the post-query states completely in order to make a single, but convincing, forgery.

Surprisingly, prior to this work none of these plausible attack strategies have been exploited to give a separation between $\mathsf{PO}$ and “intuitive security.”

2 Summary of results

2.1 A new definition: Blind-unforgeability

To address the abovementioned issues, and in light of the concrete “counterexample” presented below as Construction 1, we develop a new definition of many-time unforgeability we call “blind-unforgeability” (or $\mathsf{BU}$). In this approach we examine the behavior of adversaries in the following experiment. The adversary is granted quantum oracle access to the MAC, “blinded” at a random region $B$. Specifically, we set $B$ to be a random $\epsilon$-fraction of the message space, and declare that the oracle function will output $\bot$ on all of $B$.

[TABLE]

Given a MAC $(\mathsf{Mac},\mathsf{Ver})$, an adversary $\mathcal{A}$, and $\mathcal{A}$-selected parameter $\epsilon$, the “blind forgery experiment” is:

Generate key $k$ and random blinding $B_{\epsilon}$; 2. 2.

Produce candidate forgery $(m,t)\leftarrow\mathcal{A}^{B_{\epsilon}\mathsf{Mac}_{k}}(1^{n})$. 3. 3.

Output $\mathsf{win}$ if $\mathsf{Ver}_{k}(m,t)=\mathsf{acc}$ and $m\in B_{\epsilon}$; otherwise output $\mathsf{rej}$.

Definition 1**.**

A MAC is blind-unforgeable ($\mathsf{BU}$) if for every adversary $(\mathcal{A},\epsilon)$, the probability of winning the blind forgery experiment is negligible.

In this work, $\mathsf{BU}$ will typically refer to the case where $\mathcal{A}$ is an efficient quantum algorithm (QPT) and the oracle is quantum, i.e., $|x\rangle|y\rangle\mapsto|x\rangle|y\oplus B_{\epsilon}\mathsf{Mac}_{k}(x)\rangle$. We will also consider $q$-$\mathsf{BU}$, the information-theoretic variant where the total number of queries is a priori fixed to $q$. We remark that the above definition is also easy to adapt to other settings, e.g., classical security against PPT adversaries, quantum or classical security for digital signatures, etc.

We remark that one could define a variant of the above where the adversary is allowed to describe the blinding distribution, rather than it being uniform. However, this is not a stronger notion. By a straightforward argument, an adversary wins in the chosen-blinding $\mathsf{BU}$ game if and only if it wins with a uniform $\epsilon$-blinding for inverse-polynomial $\epsilon$. Indeed, the adversary can just simulate its chosen blinding herself, and this still succeeds with inverse polynomial probability when interacting with a standard-blinded oracle (see Theorem 1 below).

2.2 Results about blind-unforgeability

To solidify our confidence in the new notion, we collect a series of results which we believe establish $\mathsf{BU}$ as a definition of unforgeability that captures the desired intuitive security requirement. In particular, we show that $\mathsf{BU}$ classifies a host of representative examples (in fact, all examples examined thus far) as either forgeable or unforgeable in a way that agrees with our cryptographic intuition. We show that $\mathsf{PO}$ certifies certain MACs as secure but are completely broken by a quantum-access attack in a strong and intuitive sense (Section 2.3 below). While we cannot currently prove that $\mathsf{BU}$ is strictly stronger than $\mathsf{PO}$ as a security notion, we can show that $\mathsf{BU}$ implies a weaker version of $\mathsf{PO}$ in Section 5.2.3.

Relations and characterizations.

One key technical ingredient that informs our intuition and characterization results about $\mathsf{BU}$ is a general simulation theorem, which tightly controls the deviation in the behavior of an algorithm when subjected to the $\mathsf{BU}$ experiment.

Theorem 1**.**

Let $\mathcal{A}$ be a quantum query algorithm making at most $T$ queries. Let $f:X\to Y$ be a function, $B_{\epsilon}$ a random $\epsilon$-blinding subset of $X$, and for each $B\subset X$, let $g_{B}$ be a function with support $B$. Then

[TABLE]

This result can be viewed as strong evidence that algorithms that produce “good forgeries” in any reasonable sense will not be disturbed too much by blinding, and will thus also win the $\mathsf{BU}$ experiment. We can formulate and prove this intuition explicitly for a wide class of adversaries, as follows. Given an oracle algorithm $\mathcal{A}$, we let $\mathsf{supp}(\mathcal{A})$ denote the union of the supports of all the queries of $\mathcal{A}$, taken over all choices of oracle function.

Theorem 2** (informal).**

Let $\mathcal{A}$ be QPT and $\mathsf{supp}(\mathcal{A})\cap R=\emptyset$ for some $R\neq\emptyset$. Let $\mathsf{Mac}$ be a MAC, and suppose $\mathcal{A}^{\mathsf{Mac}_{k}}(1^{n})$ outputs a valid pair $(m,\mathsf{Mac}_{k}(m))$ with $m\in R$ with noticeable probability. Then $\mathsf{Mac}$ is not $\mathsf{BU}$ secure.

Blind-unforgeable MACs.

Next, we show that several natural constructions satisfy $\mathsf{BU}$. We first show that a random function is blind-unforgeable.

Theorem 3**.**

Let $R:X\to Y$ be a random function such that $1/|Y|$ is negligible. Then $R$ is a blind-unforgeable MAC.

This together with results of Zhandry [27] and Boneh and Zhandry [6] leads to efficient $\mathsf{BU}$-secure constructions.

Corollary 1**.**

Quantum-secure pseudorandom functions ($\mathsf{qPRF}$) are $\mathsf{BU}$-secure MACs, and (4q+1)-wise independent functions are $q$-$\mathsf{BU}$-secure MACs.

We can then invoke a recent result about the quantum-security of domain-extension schemes such as NMAC and HMAC [22], and obtain variable-length $\mathsf{BU}$-secure MACs from any $\mathsf{qPRF}$.

In the setting of public verification, we show that the one-time Lamport signature scheme [17] is $\mathsf{BU}$-secure, provided that the underlying hash function family $\mathcal{R}:X\to Y$ is modeled as a random oracle.

Theorem 4**.**

Let $\mathcal{R}:X\to Y$ be a random function family. Then the Lamport scheme $L_{\mathcal{R}}$ is $\mathsf{BU}$ against adversaries which make one quantum query to $L_{\mathcal{R}}$ and poly-many quantum queries to $\mathcal{R}$.

Hash-and-MAC.

Consider the following natural variation on the blind-forgery experiment. To blind $F:X\to Y$, we first select a hash function $h:X\to Z$ and a blinding set $B_{\epsilon}\subseteq Z$; we then declare that $F$ will be blinded on $x\in X$ whenever $h(x)\in B_{\epsilon}$. We refer to this as “hash-blinding.” We call $h$ a Bernoulli-preserving hash if, for every oracle function $F$, no QPT can distinguish between an oracle that has been hash-blinded with $h$, and an oracle that has been blinded in the usual sense. Recall the notion of collapsing from [25].

Theorem 5**.**

Let $h:X\to Y$ be a hash function. If $h$ is Bernoulli-preserving hash, then it is also collapsing. Moreover, against adversaries with classical oracle access, $h$ is a Bernoulli-preserving hash if and only if it is collision-resistant.

We apply this new notion to show security of the Hash-and-MAC construction $\Pi^{h}=(\mathsf{Mac}^{h},\mathsf{Ver}^{h})$ with $\mathsf{Mac}^{h}_{k}(m):=\mathsf{Mac}_{k}(h(m))$.

Theorem 6**.**

Let $\Pi=(\mathsf{Mac}_{k},\mathsf{Ver}_{k})$ be a $\mathsf{BU}$-secure MAC with $\mathsf{Mac}_{k}:X\to Y$, and let $h:Z\to X$ a Bernoulli-preserving hash. Then $\Pi^{h}$ is a $\mathsf{BU}$-secure MAC.

We also show that the Bernoulli-preserving property can be satisfied by pseudorandom constructions, as well as a (public-key) hash based on lossy functions from $\mathsf{LWE}$ [18, 24].

2.3 A concrete “counterexample” for $\mathsf{PO}$

Supporting our motivation to devise a new unforgeability definition, we present a construction of a MAC which is forgeable (in a strong intuitive sense) and yet is classified by $\mathsf{PO}$ as secure.

Construction 1**.**

Given $k=(p,f,g,h)$ where $p\in\{0,1\}^{n}$ is a random period and $f,g,h:\{0,1\}^{n}\to\{0,1\}^{n}$ are random functions, define $M_{k}:\{0,1\}^{n+1}\to\{0,1\}^{2n}$ by

[TABLE]

Define $g_{p}(x):=g(x\bmod p)$ and consider an adversary that queries only on messages starting with $1$, as follows:

[TABLE]

discarding the first qubit and $Y_{2}$ then yields $\sum_{x}|x\rangle|g_{p}(x)\rangle$, as $\sum_{y}|y\oplus f(x)\rangle_{Y_{2}}=\sum_{y}|y\rangle_{Y_{2}}$. One can then recover $p$ via period-finding and output $(0\|p,0^{2n})$. We emphasize that the forgery was queried with zero amplitude. In practice, we can interpret it as, e.g., the attacker queries only on messages starting with “From: Alice” and then forges a message starting with “From: Bob”. Despite this, we can show that it is $\mathsf{PO}$-secure.

Theorem 7**.**

The family $M_{k}$ (for uniformly random $k=(p,f,g,h)$) is $\mathsf{PO}$-secure.

The $\mathsf{PO}$ security of $M$ relies on a dilemma the adversary faces at each query: either learn an output of $f$, or obtain a superposition of $(x,g(x))$-pairs for Fourier sampling. Our proof shows that, once the adversary commits to one of these two choices, the other option is irrevocably lost. Our result can thus be understood as a refinement of an observation of Aaronson: quantumly learning a property sometimes requires uncomputing some information [1]. Note that, while Aaronson could rely on standard (asymptotic) query complexity techniques, our problem is quite fragile: $\mathsf{PO}$ security describes a task which should be hard with $q$ queries, but is completely trivial given $q+1$ queries. Our proof makes use of a new quantum random oracle technique of Zhandry [28].

A straightforward application of Theorem 2 shows that Construction 1 is $\mathsf{BU}$-insecure. In particular, we have the following.

Corollary 2**.**

There exists a $\mathsf{PO}$-secure MAC which is $\mathsf{BU}$-insecure.

The relationship between $\mathsf{BU}$, $\mathsf{PO}$ and a few other notions are visualized in Figure 1.

2.4 Acknowledgements

The authors thanks Shih-Han Hung for discovering an error in an earlier version of this paper. CM thanks Ronald de Wolf for helpful discussions on query complexity. GA acknowledges support from the NSF under grant CCF-1763736, from the U.S. Army Research Office under Grant Number W911NF-20-1-0015, and from the U.S. Department of Energy under Award Number DE-SC0020312. CM was funded by a NWO VIDI grant (Project No. 639.022.519) and a NWO VENI grant (Project No. VI.Veni.192.159). FS acknowledges support from NSF grant CCF-2042414. AR acknowledges support from NSF grant CCF-1763773.

3 Preliminaries

Basic notation and conventions.

Given a finite set $X$, the notation $x\in_{R}X$ will mean that $x$ is a uniformly random element of $X$. Given a subset $B$ of a set $X$, let $\chi_{B}:X\to\{0,1\}$ denote the characteristic function of $B$, i.e., $\chi_{B}(x)=1$ if $x\in B$ and $\chi_{B}(x)=0$ otherwise. When we say that a classical function $F$ is efficiently computable, we mean that there exists a uniform family of deterministic classical circuits which computes $F$. We will consider three classes of algorithms: (i.) unrestricted algorithms, modeling computationally unbounded adversaries, (ii.) probabilistic poly-time algorithms (PPTs), modeling classical adversaries, and (iii.) quantum poly-time algorithms (QPTs), modeling quantum adversaries. We assume that the latter two are given as polynomial-time uniform families of circuits. For PPTs, these are probabilistic circuits. For QPTs, they are quantum circuits, which may contain both unitary gates and measurements. We will often assume (without loss of generality) that the measurements are postponed to the end of the circuit, and that they take place in the computational basis. Given an algorithm $\mathcal{A}$, we let $\mathcal{A}(x)$ denote the (in general, mixed) state output by $\mathcal{A}$ on input $x$. In particular, if $\mathcal{A}$ has classical output, then $\mathcal{A}(x)$ denotes a probability distribution. Unless otherwise stated, the probability is taken over all random coins and measurements of $\mathcal{A}$ and any randomness used to select the input $x$. If $\mathcal{A}$ is an oracle algorithm and $F$ a classical function, then $\mathcal{A}^{F}(x)$ is the mixed state output by $\mathcal{A}$ equipped with oracle $F$ and input $x$; the probability is now also taken over any randomness used to generate $F$.

We will distinguish between two ways of presenting a function $F:\{0,1\}^{n}\to\{0,1\}^{m}$ as an oracle. First, the usual “classical oracle access” simply means that each oracle call grants one classical invocation $x\mapsto F(x)$. This will always be the oracle model for PPTs. Second, “quantum oracle access” will mean that each oracle call grants an invocation of the $(n+m)$-qubit unitary gate $|x\rangle|y\rangle\mapsto|x\rangle|y\oplus F(x)\rangle\,.$ This will always be the oracle model for QPTs. Note that both QPTs and unrestricted algorithms could in principle receive either oracle type.

We will need the following lemma. We use the formulation from [7, Lemma 2.1], which is a special case of a more general “pinching lemma” of Hayashi [13].

Lemma 1**.**

Let $\mathcal{A}$ be a quantum algorithm and $x\in\{0,1\}^{*}$. Let $\mathcal{A}_{0}$ be another quantum algorithm obtained from $\mathcal{A}$ by pausing $\mathcal{A}$ at an arbitrary stage of execution, performing a partial measurement that obtains one of $k$ outcomes, and then resuming $\mathcal{A}$. Then $\Pr[\mathcal{A}_{0}(1^{n})=x]\geq\Pr[\mathcal{A}(1^{n})=x]/k$.

We denote the trace distance between states $\rho$ and $\sigma$ by $\delta(\rho,\sigma)$. Recall that this is simply half the trace norm of the difference, i.e., $\delta(\rho,\sigma)=({1}/{2})\|\rho-\sigma\|_{1}$. When $\rho$ and $\sigma$ are classical probability distributions, the trace distance is equal to the total variation distance.

3.1 Quantum-secure pseudorandomness

A quantum-secure pseudorandom function ($\mathsf{qPRF}$) is a family of classical, deterministic, efficiently-computable functions which appear random to QPT adversaries with quantum oracle access.

Definition 2**.**

An efficiently computable function family $f:K\times X\to Y$ is a quantum-secure pseudorandom function ($\mathsf{qPRF}$) if, for all QPTs $\mathcal{D}$,

[TABLE]

Here $\mathcal{F}_{X}^{Y}$ denotes the set of all functions from $X$ to $Y$. The standard “GGM+GL” construction of a $\mathsf{PRF}$ yields a $\mathsf{qPRF}$ when instantiated with a quantum-secure one-way function [27]. One can also construct a $\mathsf{qPRF}$ directly from the Learning with Errors assumption [27]. If we have an a priori bound on the number of allowed queries, then a computational assumption is not needed.

Theorem 8** (Lemma 6.4 in [6]).**

Let $q,c\geq 0$ be integers, and $f:K\times X\to Y$ a $(2q+c)$-wise independent family of functions. Let $\mathcal{D}$ be an algorithm making no more than $q$ quantum oracle queries and $c$ classical oracle queries. Then

[TABLE]

3.2 $\mathsf{PO}$-unforgeability

Boneh and Zhandry define unforgeability (against quantum queries) for classical MACs as follows [6]. They also show that random functions satisfy this notion.

Definition 3**.**

Let $\Pi=(\mathsf{KeyGen},\mathsf{Mac},\mathsf{Ver})$ be a MAC with message set $X$. Consider the following experiment with an algorithm $\mathcal{A}$:

Generate key:* $k\leftarrow\mathsf{KeyGen}(1^{n})$.* 2. 2.

Generate forgeries:* $\mathcal{A}$ receives quantum oracle for $\mathsf{Mac}_{k}$, makes $q$ queries, and outputs a string $s$;* 3. 3.

Outcome:* output win if $s$ contains $q+1$ distinct input-output pairs of $\mathsf{Mac}_{k}$, and fail otherwise.*

We say that $\Pi$ is $\mathsf{PO}$-secure if no adversary can succeed at the above experiment with better than negligible probability.

3.3 The Fourier Oracle

Our separation proof will make use of a new technique of Zhandry [28] for analyzing random oracles. We briefly describe this framework.

A random function $f$ from $n$ bits to $m$ bits can be viewed as the outcome of a quantum measurement. More precisely, let $\mathcal{H}_{F}=\bigotimes_{x\in\{0,1\}^{n}}\mathcal{H}_{F_{x}}$, where $\mathcal{H}_{F_{x}}\cong\mathbb{C}^{2^{m}}$. Then set $f(x)\leftarrow\mathcal{M}_{F_{x}}(\eta_{F})$, where

[TABLE]

and $\mathcal{M}_{F_{x}}$ denotes the measurement of the register $F_{x}$ in the computational basis. This measurement commutes with any $\mathrm{CNOT}_{A:B}$ gate with control qubit $A$ in $F_{x}$ and target qubit $B$ outside $F_{x}$. It follows that, for any quantum algorithm making queries to a random oracle, the output distribution is identical if the algorithm is instead run with the following oracle:

Setup: Prepare the state $\eta_{F}$. 2. 2.

Upon a query with query registers $X$ and $Y$, controlled on $X$ being in state $|x\rangle$, apply $(\mathrm{CNOT}^{\otimes m})_{F_{x}:Y}$. 3. 3.

After the algorithm has finished, measure $F$ to determine the success of the computation.

We denote the oracle unitary defined in step 2 above by $U^{\mathrm{O}}_{XYF}$. Having defined this oracle representation, we are free to apply any unitary $U_{H}$ to the oracle state, so long as we then also apply the conjugated query unitary

[TABLE]

in place of $U^{\mathrm{O}}_{XYF}$. We choose $U_{H}=H^{\otimes m2^{n}}$, which means that the oracle register starts in the all-zero state now. Applying Hadamard to both qubits reverses the direction of CNOT, i.e.,

[TABLE]

so the adversary-oracle-state after a first query with query state $|x\rangle_{X}|\phi_{y}\rangle_{Y}$ is

[TABLE]

where $\textsf{lex}(x)$ denotes the position of $x$ in the lexicographic ordering of $\{0,1\}^{n}$, and we defined the Fourier basis state $|\phi_{y}\rangle=H^{\otimes m}|y\rangle$. In the rest of this section, we freely change the order in which tensor products are written, and keep track of the tensor factors through the use of subscripts. This adjusted representation is called the Fourier oracle (FO), and we denote its oracle unitary by

[TABLE]

An essential fact about the FO is that each query can only change the number of non-zero entries in the FO’s register by at most one. To formalize this idea, we define the “number operator”

[TABLE]

The number operator can also be written in its spectral decomposition,

[TABLE]

Note that the initial joint state of a quantum query algorithm and the oracle (in the FO-oracle picture described above) is in the image of $P_{0}$. The following fact is essential for working with the Fourier Oracle; to avoid disrupting the flow of the article, the proof is given in Appendix A.1.

Lemma 2**.**

The number operator satisfies \bigl{\|}\left[N_{F},U_{XYF}^{FO}\right]\bigr{\|}_{\infty}=1. In particular, the joint state of a quantum query algorithm and the oracle after the $q$-th query is in the kernel of $P_{l}$ for all $l>q$.

4 The new notion: Blind-Unforgeability

4.1 Formal definition

For ease of exposition, we begin by introducing our new security notion in a form analogue to the standard notion of existential unforgeability under chosen-message attacks, $\mathsf{EUF\mbox{-}CMA}$. We will also later show how to extend our approach to obtain a corresponding analogue of strong unforgeability. We begin by defining a “blinding” operation. Let $f:X\rightarrow Y$ and $B\subseteq X$. We let

[TABLE]

We say that $f$ has been “blinded” by $B$. In this context, we will be particularly interested in the setting where elements of $X$ are placed in $B$ independently at random with a particular probability $\epsilon$; we let $B_{\epsilon}$ denote this random variable. (It will be easy to infer $X$ from context so we do not reflect it in the notation.)

Next, we define a security game in which an adversary is tasked with using a blinded MAC oracle to produce a valid input-output pair in the blinded set.

Definition 4**.**

Let $\Pi=(\mathsf{KeyGen},\mathsf{Mac},\mathsf{Ver})$ be a MAC with message set $X$. Let $\mathcal{A}$ be an algorithm, and $\epsilon:\mathbb{N}\to\mathbb{R}_{\geq 0}$ an efficiently computable function. The blind forgery experiment $\mathsf{BlindForge}_{\mathcal{A},\Pi}(n,\epsilon)$ proceeds as follows:

Generate key:* $k\leftarrow\mathsf{KeyGen}(1^{n})$.* 2. 2.

Generate blinding:* select $B_{\epsilon}\subseteq X$ by placing each $m$ into $B_{\epsilon}$ independently with probability $\epsilon(n)$.* 3. 3.

Produce forgery:* $(m,t)\leftarrow\mathcal{A}^{B_{\epsilon}\mathsf{Mac}_{k}}(1^{n})$.* 4. 4.

Outcome:* output $1$ if $\mathsf{Ver}_{k}(m,t)=\mathsf{acc}$ and $m\in B_{\epsilon}$; otherwise output [math].*

We say that a scheme is blind-unforgeable if, for any efficient adversary, the probability of winning the game is negligible. The probability is taken over the choice of key, the choice of blinding set, and any internal randomness of the adversary. We remark that specifying an adversary requires specifying (in a uniform fashion) both the algorithm $\mathcal{A}$ and the blinding fraction $\epsilon$.

Definition 5**.**

A MAC $\Pi$ is blind-unforgeable (BU) if for every polynomial-time uniform adversary $(\mathcal{A},\epsilon)$,

[TABLE]

We also define the “$q$-time” variant of the blinded forgery game, which is identical to Definition 4 except that the adversary is only allowed to make $q$ queries to $B_{\epsilon}\mathsf{Mac}_{k}$ in step (3). We call the resulting game $\mathsf{BlindForge}^{q}_{\mathcal{A},\Pi}(n,\epsilon)$, and give the corresponding definition of $q$-time security (now against computationally unbounded adversaries).

Definition 6**.**

A MAC $\Pi$ is $q$-time blind-unforgeable ($q$-BU) if for every $q$-query adversary $(\mathcal{A},\epsilon)$, we have

[TABLE]

The above definitions are agnostic regarding the computational power of the adversary and the type of oracle provided. For example, selecting PPT adversaries and classical oracles in Definition 5 yields a definition of classical unforgeability; we will later show that this is equivalent to standard $\mathsf{EUF\mbox{-}CMA}$. The main focus of our work will be on $\mathsf{BU}$ against QPTs with quantum oracle access, and $q$-$\mathsf{BU}$ against unrestricted adversaries with quantum oracle access.

4.2 Some technical details

We now remark on a few details in the usage of $\mathsf{BU}$. First, strictly speaking, the blinding sets in the security games above cannot be generated efficiently. However, a pseudorandom blinding set will suffice. Pseudorandom blinding sets can be generated straightforwardly using an appropriate pseudorandom function, such as a $\mathsf{PRF}$ against PPTs or a $\mathsf{qPRF}$ against QPT. A precise description of how to perform this pseudorandom blinding is given in the proof of Corollary 4. Note that simulating the blinding requires computing and uncomputing the random function, so we must make two quantum queries for each quantum query of the adversary. Moreover, verifying whether the forgery is in the blinding set at the end requires one additional classical query. This means that $(4q+1)$-wise independent functions are both necessary and sufficient for generating blinding sets for $q$-query adversaries (see [6, Lemma 6.4]). In any case, an adversary which behaves differently in the random-blinding game versus the pseudorandom-blinding game immediately yields a distinguisher against the corresponding pseudorandom function.

The blinding symbol. There is some flexibility in how one defines the blinding symbol $\bot$. In situations where the particular instantiation of the blinding symbol might matter, we will adopt the convention that the blinded version $Bf$ of $f:\{0,1\}^{n}\to\{0,1\}^{\ell}$ is defined by setting $Bf:\{0,1\}^{n}\to\{0,1\}^{\ell+1}$, where $Bf(m)=0^{\ell}||1$ if $m\in B$ and $Bf(m)=f(m)||0$ otherwise. One advantage of this convention (i.e., that $\bot=0^{\ell}||1$) is that we can compute on and/or measure the blinded bit (i.e., the $(\ell+1)$-st bit) without affecting the output register of the function. This will also turn out to be convenient for uncomputation.

Strong blind-unforgeability. The security notion $\mathsf{BU}$ given in Definition 5 is an analogue of simple unforgeability, i.e., $\mathsf{EUF\mbox{-}CMA}$, for the case of a quantum-accessible MAC/Signing oracle. It is, however, straightforward to define a corresponding analogue of strong unforgeability, i.e., $\mathsf{SUF\mbox{-}CMA}$, as well.

The notion of strong blind-unforgeability, $\mathsf{sBU}$, is obtained by a simple adjustment compared to $\mathsf{BU}$: we blind (message, tag) pairs rather than just messages. We briefly describe this for the case of MACs. Let $\Pi=(\mathsf{KeyGen},\mathsf{Mac},\mathsf{Ver})$ be a MAC with message set $M$, randomness set $R$ and tag set $T$, so that $\mathsf{Mac}_{k}:M\times R\to T$ and $\mathsf{Ver}_{k}:M\times T\to\{\mathsf{acc},\mathsf{rej}\}$ for every $k\leftarrow\mathsf{KeyGen}$. Given a parameter $\epsilon$ and an adversary $\mathcal{A}$, the strong blind forgery game proceeds as follows:

Generate key: $k\leftarrow\mathsf{KeyGen}$; generate blinding: select $B_{\epsilon}\subseteq M\times T$ by placing pairs $(m,t)$ in $B_{\epsilon}$ independently with probability $\epsilon$; 2. 2.

Produce forgery: produce $(m,t)$ by executing $\mathcal{A}(1^{n})$ with quantum oracle access to the function

[TABLE]

where $r$ is sampled uniformly for each oracle call. 3. 3.

Outcome: output $1$ if $\mathsf{Ver}_{k}(m,t)=\mathsf{acc}\wedge(m,t)\in B_{\epsilon}$; otherwise output [math].

Security is then defined as before: $\Pi$ is $\mathsf{sBU}$-secure if for all adversaries $\mathcal{A}$ (and their declared $\epsilon$), the success probability at winning the above game is negligible. Note that, for the case of canonical MACs, this definition coincides with Definition 5, just as $\mathsf{EUF\mbox{-}CMA}$ and $\mathsf{SUF\mbox{-}CMA}$ coincide in this case.

5 Intuitive security and the meaning of $\mathsf{BU}$

In this section, we gather a number of results which build confidence in $\mathsf{BU}$ as a satisfactory definition of unforgeability in our setting. We begin by showing that a wide range of “intuitively forgeable” MACs (indeed, all such examples we have examined) are correctly characterized by $\mathsf{BU}$ as insecure.

5.1 Intuitively forgeable schemes

As indicated earlier, $\mathsf{BU}$ security rules out any MAC schemes where an attacker can query a subset of the message space and forge outside that region. To make this claim precise, we first define the query support $\mathsf{supp}(\mathcal{A})$ of an oracle algorithm $\mathcal{A}$. Let $\mathcal{A}$ be a quantum query algorithm with oracle access to the quantum oracle $O$ for a classical function from $n$ to $m$ bits. Without loss of generality $\mathcal{A}$ proceeds by applying the sequence of unitaries $\mathcal{O}U_{q}\mathcal{O}U_{q-1}...U_{1}$ to the initial state $|0\rangle_{XYZ}$, followed by a POVM $\mathcal{E}$. Here, $X$ and $Y$ are the input and output registers of the function and $Z$ is the algorithm’s workspace. Let $|\psi_{i}\rangle$ be the intermediate state of of $\mathcal{A}$ after the application of $U_{i}$. Then $\mathsf{supp}(\mathcal{A})$ is defined to be the set of input strings $x$ such that there exists a function $f:\{0,1\}^{n}\to\{0,1\}^{m}$ such that $\langle x|_{X}|\psi_{i}\rangle\neq 0$ for at least one $i\in\{1,...,q\}$ when $\mathcal{O}=\mathcal{O}_{f}$.

Theorem 9**.**

Let $\mathcal{A}$ be a QPT such that $\mathsf{supp}(\mathcal{A})\cap R=\emptyset$ for some $R\neq\emptyset$. Let $\mathsf{Mac}$ be a MAC, and suppose $\mathcal{A}^{\mathsf{Mac}_{k}}(1^{n})$ outputs a valid pair $(m,\mathsf{Mac}_{k}(m))$ with $m\in R$ with non-negligible probability. Then $\mathsf{Mac}$ is not $\mathsf{BU}$-secure.

To prove Theorem 9, we will need the following theorem, which controls the change in the output state of an algorithm resulting from applying a blinding to its oracle. Given an oracle algorithm $\mathcal{A}$ and two oracles $F$ and $G$, the trace distance between the output of $\mathcal{A}$ with oracle $F$ and $\mathcal{A}$ with oracle $G$ is denoted by $\delta(\mathcal{A}^{F}(1^{n}),\mathcal{A}^{G}(1^{n}))$. Given two functions $F,P:\{0,1\}^{n}\to\{0,1\}^{m}$, we define the function $F\oplus P$ by $(F\oplus P)(x)=F(x)\oplus P(x)$.

Theorem 10**.**

Let $\mathcal{A}$ be a quantum query algorithm making at most $T$ queries, and $F:\{0,1\}^{n}\rightarrow\{0,1\}^{m}$ a function. Let $B\subseteq\{0,1\}^{n}$ be a subset chosen by independently including each element of $\{0,1\}^{n}$ with probability $\epsilon$, and $P:\{0,1\}^{n}\rightarrow\{0,1\}^{m}$ be any function with support $B$. Then

[TABLE]

The proof is a relatively straightforward hybrid argument in the spirit of the lower bound for Grover search [4]. We provide the complete proof in Appendix A.2. We are now ready to prove Theorem 9.

Proof of Theorem 9.

Let $\mathcal{A}$ be a quantum algorithm with $\mathsf{supp}(\mathcal{A})$ for any oracle. By our hypothesis,

[TABLE]

for some $c>0$ and sufficiently large $n$. Since $\mathsf{supp}(A)$ is a fixed set, we can think of sampling a random $B_{\varepsilon}$ as picking $B_{0}:=B_{\varepsilon}\cap\mathsf{supp}(A)$ and $B_{1}:=B_{\varepsilon}\cap\overline{\mathsf{supp}(A)}$ independently. Let “blind” denote the random experiment of $\mathcal{A}$ running on $\mathsf{Mac}_{k}$ blinded by a random $B_{\varepsilon}$: $k,B_{\varepsilon},(m,t)\leftarrow\mathcal{A}^{B_{\varepsilon}\mathsf{Mac}_{k}}(1^{n})$, which is equivalent to $k,B_{0},B_{1},(m,t)\leftarrow\mathcal{A}^{B_{0}\mathsf{Mac}_{k}}(1^{n})$. The probability that $\mathcal{A}$ wins the BU game is

[TABLE]

Here the second-to-last step follows from Theorem 10; in the last step, we chose $\varepsilon=(\tilde{p}/3T)^{2}$. We conclude that $\mathcal{A}$ breaks the $\mathsf{BU}$ security of the MAC. ∎

5.2 Relationship to other definitions

5.2.1 Classical $\mathsf{BU}$ is equivalent to $\mathsf{EUF\mbox{-}CMA}$

In the purely classical setting, our notion is equivalent to EUF-CMA. In the strong unforgeability case, this means $\mathsf{BU}$ with blinding on message-tag pairs, as described in Section 4.2.

Proposition 1**.**

A MAC is EUF-CMA if and only if it is blind-unforgeable against classical adversaries.

Proof.

Set $F_{k}=\mathsf{Mac}_{k}$. Consider an adversary $\mathcal{A}$ which violates EUF-CMA. Such an adversary, given $1^{n}$ and oracle access to $F_{k}$ (for $k\in_{R}\{0,1\}^{n}$), produces a forgery $(m,t)$ with non-negligible probability $s(n)$; in particular, $|m|\geq n$ and $m$ is not among the messages queried by $\mathcal{A}$. This same adversary (when coupled with an appropriate $\epsilon$) breaks the system under the blind-forgery definition. Specifically, let $p(n)$ be the running time of $\mathcal{A}$, in which case $\mathcal{A}$ clearly makes no more than $p(n)$ queries, and define $\epsilon(n)={1}/{p(n)}$. Consider now a particular $k\in\{0,1\}^{n}$ and a particular sequence $r$ of random coins for $\mathcal{A}^{F_{k}}(1^{n})$. If this run of $\mathcal{A}$ results in a forgery $(m,t)$, observe that with probability at least $(1-\epsilon)^{p(n)}\approx e^{-1}$ in the choice of $B_{\epsilon}$, we have $F_{k}(q)=B_{\epsilon}F_{k}(q)$ for every query $q$ made by $\mathcal{A}$. On the other hand, $B_{\epsilon}(m)=\bot$ with (independent) probability $\epsilon$. It follows $\phi(n,\epsilon_{n})$ is at least $\epsilon s(n)/e=\Omega(s(n)/p(n))$.

On the the other hand, suppose that $(\mathcal{A},\epsilon)$ is an adversary that breaks blind-unforgeability. Consider now the EUF-CMA adversary $\mathcal{A^{\prime}}^{F_{k}}(1^{n})$ which simulates the adversary $\mathcal{A}^{(\cdot)}(1^{n})$ by answering oracle queries according to a locally-simulated version of $B_{\epsilon}F_{k}$; specifically, the adversary $\mathcal{A^{\prime}}$ proceeds by drawing a subset $B_{\epsilon(n)}\subseteq\{0,1\}^{*}$ as described above and answering queries made by $\mathcal{A}$ according to $B_{\epsilon}F$. Two remarks are in order:

• •

When $x\in B_{\epsilon}$, this query is answered without an oracle call to $F(x)$.

• •

$\mathcal{A}^{\prime}$ can construct the set $B_{\epsilon}$ “on the fly,” by determining, when a particular query $q$ is made by $\mathcal{A}$, whether $q\in B_{\epsilon}$ and “remembering” this information in case the query is asked again (“lazy sampling”).

With probability $\phi(n,\epsilon(n))$ $\mathcal{A}$ produces a forgery on a point which was not queried by $\mathcal{A^{\prime}}$, as desired. It follows that $\mathcal{A}$ produces a (conventional) forgery with non-negligible probability when given $F_{k}$ for $k\in_{R}\{0,1\}^{n}$. ∎

5.2.2 $\mathsf{BU}$ implies $\mathsf{GYZ}$

In this section, we sketch how our new security notion, $\mathsf{BU}$, implies the one-time security notion put forward by Garg, Yuen and Zhandry [12]. We do this for unitary adversaries without loss of generality. We expect that the ideas carry over to the fully general case. For the special case we consider here, $\mathsf{GYZ}$ unforgeability can be defined as follows.

Definition 7** ($\mathsf{GYZ}$ unforgeability).**

Let $\Pi=(\mathsf{KeyGen},\mathsf{Mac},\mathsf{Ver})$ be a MAC. $\Pi$ is called $\varepsilon$-$\mathsf{GYZ}$-unforgeable, if for attack unitary $V_{MTB}$, there exists a simulator sub-unitary $W_{MTB}$444A matrix $V$ is sub-unitary if $V^{\dagger}V\leq\mathds{1}$. such that $\langle i|_{C}W|j\rangle_{C}=0$ for $i\neq j$ and for all initial states $|\psi\rangle_{MB}$

[TABLE]

where $U_{\mathsf{Mac},r,k}|m\rangle_{M}|y\rangle_{T}=|m\rangle_{M}|y\oplus\mathsf{Mac}_{r;k}(m)\rangle_{T}$ and

[TABLE]

is the projector onto the subspace of valid message-tag-pairs.

We are now ready to state the desired theorem. Here, $\delta$-1-$\mathsf{BU}$ denotes the one-time version of $\mathsf{BU}$ that allows for maximal adversarial advantage $\delta$, and similarly for $\delta^{\prime}$-$\mathsf{GYZ}$. The theorem is easiest proven using the measured version of $\mathsf{BU}$, $\mathsf{mBU}$.

Theorem 11**.**

Let $\Pi=(\mathsf{KeyGen},\mathsf{Mac},\mathsf{Ver})$ be unconditionally555Here, “unconditionally” means without any assumption on the computational complexity of the adversary. $\delta$-1-$\mathsf{mBU}$-secure. Then it is $16\delta$-$\mathsf{GYZ}$-unforgeable.

$\mathsf{mBU}$ implies $\mathsf{BU}$, so we immediately obtain the following

Corollary 3**.**

Let $\Pi=(\mathsf{KeyGen},\mathsf{Mac},\mathsf{Ver})$ be $\delta$-1-$\mathsf{BU}$-secure. Then it is $16\delta$-$\mathsf{GYZ}$-unforgeable.

For the proof of Theorem 11, we need the following lemma stating that an algorithm’s success probability does not degrade too much if some operation that never leaves a computational basis state unchanged is sandwiched between a blinding projector and its complement.

Lemma 3**.**

Let $\Pi^{(\varepsilon)}_{A}$ be the projector onto the subspace spanned by the computational basis states corresponding to strings in the blinding set $B_{\varepsilon}$ sampled as for the definition of $\mathsf{BU}$. Let further $M_{AB}$ be a matrix such that $\langle x|_{A}M|x\rangle_{A}=0$ for all $x$. Then for all $\rho\geq 0$

[TABLE]

where $\bar{\Pi}^{(\varepsilon)}_{A}=\mathds{1}-\Pi^{(\varepsilon)}_{A}$.

Proof.

Let

[TABLE]

and

[TABLE]

We calculate

[TABLE]

In the last three lines,

[TABLE]

is the computational basis pinching channel, we used the condition $\langle i|_{A}M|i\rangle_{B}=0$ so we can add these terms for free, and the second, third and fourth term arise because of the increase of the probability $\Pr\left[y,z\in B_{\varepsilon},x,t\notin B_{\varepsilon}\right]$ if $y=z$, $x=t$, or both. But the second, third and fourth term are positive semidefinite, so the claimed operator inequality follows. ∎

Proof of Theorem 11.

Let

[TABLE]

be an attack unitary that breaks $\delta^{\prime}$-$\mathsf{GYZ}$, and define the simulator sub-unitary

[TABLE]

to be the diagonal part of $V$. By assumption there exists a state $|\psi\rangle_{MB}$ such that

[TABLE]

Now we use the initial state $|\psi\rangle_{MB}|0\rangle_{T}$ and the unitary $V$ as attacker $\mathcal{A}$ for 1-$\mathsf{mBU}$: $\mathcal{A}$ queries the $\mathsf{mBU}$-type oracle for $\mathsf{Mac}_{k}$ on $|\psi\rangle_{MB}|0\rangle_{T}$, applies $V$, measures $MT$ and outputs the result. The success probability $p_{\mathrm{succ}}$ of this adversary can be lower bounded by the probability that the first measurement turns up “not blinded” and the adversary is successful. So for a fixed key $k$ and randomness $r$, and defining $\rho=|\phi\rangle\langle\phi|$ with $|\phi\rangle=\left(U_{\mathsf{Mac},r,k}\right)_{MT}|\psi\rangle_{MB}|0\rangle_{T}$ we get

[TABLE]

Here we have used the fact that $\Pi^{(\varepsilon)}_{M}W_{MTB}\bar{\Pi}^{(\varepsilon)}_{M}=0$ for all blinding sets in the second line, and Lemma 3 in the second-to-last line. Taking the expectation over $k$ and $r$ and using Equation (16), we arrive at

[TABLE]

Choosing $\epsilon=1/2$ we obtain

[TABLE]

∎

5.2.3 $\mathsf{BU}$ implies quadratic $\mathsf{PO}$

It is interesting to ask if $\mathsf{BU}$-security implies $\mathsf{PO}$-security, as the $\mathsf{PO}$ definition certainly captures a natural family of attacks that one would like to rule out. We are unable to settle this question completely, but provide some weaker connection. Specifically, we show that if a function is BU-secure, then it is $\mathsf{PO}$-secure with a weaker definition of $\mathsf{PO}$-security that forbids an adversary from producing $ck^{2}$ forgeries from $k$ queries with high probability.

For this purpose, consider a function $M:X\rightarrow Y$ and a $\mathsf{PO}$-type adversary $\mathcal{A}$ which, given oracle access to $M$, makes some $k$ queries and produces $ck^{2}$ forgeries (with probability 1); here $c\geq 1$ is a constant we set later in the discussion. We consider the behavior of this adversary $\mathcal{A}^{B_{\epsilon}M}$ supplied with an oracle $B_{\epsilon}M$ blinded at a random set $B_{\epsilon}$. We will show that for an appropriate value of $c$ and $\epsilon$, this adversary produces a family of forgeries which includes at least one blinded forgery with constant probability. Finally selecting one of these forgeries at random produces an adversary that breaks the BU security definition.

Returning to the $\mathsf{PO}$-adversary $\mathcal{A}$, we say that a particular blinding set $B$ is $\gamma$-evasive if

[TABLE]

(Note that this event is determined by running $\mathcal{A}$ with the unblinded oracle $M$.) Observing that

[TABLE]

We note that (by Markov’s inequality),

[TABLE]

Similarly, we say that a particular blinding set $B$ is $\gamma$-divergent if

[TABLE]

where $D_{M}$ is the distribution of outputs of $\mathcal{A}^{M}$ and $D_{BM}$ is the distribution of outputs of $\mathcal{A}^{BM}$ when $M$ is blinded on set $B$. In light of Theorem 1,

[TABLE]

and it follows by Markov’s inequality that

[TABLE]

Fixing $\gamma\leq 1/2-\delta$ for $\delta>0$, note that if $B$ is neither $\gamma$-evasive nor $\gamma$-divergent then

[TABLE]

(associated with the distribution $D_{M}$), and hence

[TABLE]

Finally, note that the probability that $B$ is $(1/2-\delta)$-evasive or $(1/2-\delta)$-divergent is no more than

[TABLE]

Then it is clear that one can choose the constants $\delta$ and $c$, and the blinding probability $\epsilon=\Theta(1/k^{2})$, so that this quantity is a constant bounded away from one. (For example, set $\delta=1/6$. Then, with $\epsilon=1/(144k^{2})$ the second term of $(\dagger)$ above is no more than $1/6$; setting $c=288$ guarantees the first term is likewise no more than $e^{-2}<1/6$ and the entire expression is a constant less than one. One can achieve better constants with more care, but the quadratic dependence on $\epsilon$ in Theorem 1 dictates the quadratic gap between $k$ and the number of forgeries achieved by this simple method of proof.)

Finally, we create a BU adversary for $M$ by running the $\mathsf{PO}$ adversary, blinded as above with $\epsilon=\Theta(1/k^{2})$, and selecting one of the $ck^{2}$ output values at random.

6 Blind-unforgeable schemes

6.1 Random schemes

We now show that suitable random and pseudorandom function families satisfy our notion of unforgeability.

Theorem 12**.**

Let $R:X\rightarrow Y$ be a uniformly random function such that $1/{|Y|}$ is negligible in $n$. Then $R$ is a blind-forgery secure MAC.

Proof.

For simplicity, we assume that the function is length-preserving; the proof generalizes easily. Let $\mathcal{A}$ be an efficient quantum adversary. The oracle $B_{\epsilon}R$ supplied to $\mathcal{A}$ during the blind-forgery game is determined entirely by $B_{\epsilon}$ and the restriction of $R$ to the complement of $B_{\epsilon}$. On the other hand, the forgery event

[TABLE]

depends additionally on values of $R$ at points in $B_{\epsilon}$. To reflect this decomposition, given $R$ and $B_{\epsilon}$ define $R_{\epsilon}:B_{\epsilon}\rightarrow Y$ to be the restriction of $R$ to the set $B_{\epsilon}$ and note that—conditioned on $B_{\epsilon}R$ and $B_{\epsilon}$—the random variable $R_{\epsilon}$ is drawn uniformly from the space of all (length-preserving) functions from $B_{\epsilon}$ into $Y$. Note, also, that for every $n$ the purported forgery $(m,t)\leftarrow\mathcal{A}^{B_{\epsilon}R}(1^{n})$ is a (classical) random variable depending only on $B_{\epsilon}R$. In particular, conditioned on $B_{\epsilon}$, $(m,t)$ is independent of $R_{\epsilon}$. It follows that, conditioned on $m\in B_{\epsilon}$, that $t=R_{\epsilon}(m)$ with probability no more than $1/2^{n}$ and hence $\phi(n,\epsilon)\leq 2^{-n}$, as desired. ∎

Next, we show that a $\mathsf{qPRF}$ is a blind-unforgeable MAC.

Corollary 4**.**

Let $m$ and $t$ be $\poly(n)$, and $F:\{0,1\}^{n}\times\{0,1\}^{m}\rightarrow\{0,1\}^{t}$ a $\mathsf{qPRF}$. Then $F$ is a blind-forgery-secure fixed-length MAC (with length $m(n)$).

Proof.

For a contradiction, let $\mathcal{A}$ be a QPT which wins the blind forgery game for a certain blinding factor $\varepsilon(n)$, with running time $q(n)$ success probability $\delta(n)$. We will use $\mathcal{A}$ to build a quantum oracle distinguisher $\mathcal{D}$ between the $\mathsf{qPRF}$ $F$ and the perfectly random function family $\mathcal{F}_{m}^{t}$ with the same domain and range.

First, let $k=q(n)$ and let $\mathcal{H}$ be a family of $(4k+1)$-wise independent functions with domain $\{0,1\}^{m}$ and range $\{0,1,\dots,1/\varepsilon(n)\}$. The distinguisher $\mathcal{D}$ first samples $h\in_{R}\mathcal{H}$. Set $B_{h}:=h^{-1}(0)$. Given its oracle $\mathcal{O}_{f}$, $\mathcal{D}$ can implement the function $B_{h}f$ (quantumly) as follows:

[TABLE]

Here we used the CCNOT (Toffoli) gate from step 2 to 3 (with one control bit reversed), and uncomputed both $h$ and $f$ in the last step. After sampling $h$, the distinguisher $\mathcal{D}$ will execute $\mathcal{A}$ with the oracle $B_{h}f$. If $\mathcal{A}$ successfully forges a tag for a message in $B_{h}$, $\mathcal{A}^{\prime}$ outputs “pseudorandom”; otherwise “random.”

Note that the function $B_{h}f$ is perfectly $\epsilon$-blinded if $h$ is a perfectly random function. Note also that the entire security experiment with $\mathcal{A}$ (including the final check to determine if the output forgery is blind) makes at most $2k$ quantum queries and $1$ classical query to $h$, and is thus (by Theorem 8) identically distributed to the perfect-blinding case.

Finally, by Theorem 12, the probability that $\mathcal{D}$ outputs “pseudorandom” when $f\in_{R}\mathcal{F}_{m}^{t}$ is negligible. By our initial assumption about $\mathcal{A}$, the probability that $\mathcal{D}$ outputs “pseudorandom” becomes $\delta(n)$ when $f\in_{R}F$. It follows that $\mathcal{D}$ distinguishes $F$ from perfectly random. ∎

Next, we give a information-theoretically secure $q$-time MACs (Definition 6).

Theorem 13**.**

Let $\mathcal{H}$ be a $(4q+1)$-wise independent function family with range $Y$, such that $1/|Y|$ is a negligible function. Then $\mathcal{H}$ is a $q$-time BU-secure MAC.

Proof.

Let $(\mathcal{A},\epsilon)$ be an adversary for the $q$-time game $\mathsf{BlindForge}^{q}_{\mathcal{A},h}(n,\epsilon(n))$, where $h$ is drawn from $\mathcal{H}$. We will use $\mathcal{A}$ to construct a distinguisher $\mathcal{D}$ between $\mathcal{H}$ and a random oracle. Given access to an oracle $\mathcal{O}$, $\mathcal{D}$ first runs $\mathcal{A}$ with the blinded oracle $B\mathcal{O}$, where the blinding operation is performed as in the proof of Corollary 4 (i.e., via a $(4q+1)$-wise independent function with domain size $1/\epsilon(n)$). When $\mathcal{A}$ is completed, it outputs $(m,\sigma)$. Next, $\mathcal{D}$ queries $\mathcal{O}$ on the message $m$ and outputs 1 if and only if $\mathcal{O}(m)=\sigma$ and $m\in B$. Let $\gamma_{\mathcal{O}}$ be the probability of the output being 1.

We consider two cases: (i.) $\mathcal{O}$ is drawn as a random oracle $R$, and (ii.) $\mathcal{O}$ is drawn from the family $\mathcal{H}$. By Theorem 8, since $\mathcal{D}$ makes only $2q$ quantum queries and one classical query to $\mathcal{O}$, its output is identical in the two cases. Observe that $\gamma_{R}$ (respectively, $\gamma_{\mathcal{H}}$) is exactly the success probability of $\mathcal{A}$ in the blind-forgery game with random oracle $R$ (respectively, $\cal H$). We know from Theorem 12 that $\gamma_{R}$ is negligible; it follows that $\gamma_{\mathcal{H}}$ is as well. ∎

Several domain-extension schemes, including NMAC (a.k.a. encrypted cascade), HMAC, and AMAC, can transform a fixed-length $\mathsf{qPRF}$ to a $\mathsf{qPRF}$ that takes variable-length inputs [22] . As a corollary, starting from a $\mathsf{qPRF}$, we also obtain a number of quantum blind-unforgeable variable-length MACs.

6.2 Lamport one-time signatures

The Lamport signature scheme [17] is a EUF-1-CMA-secure signature scheme, specified as follows.

Construction 2** (Lamport signature scheme, [17]).**

For the Lamport signature scheme using a hash function family $h:\{0,1\}^{n}\times\{0,1\}^{n}\to\{0,1\}^{n}$, the algorithms $\mathsf{KeyGen},\mathsf{Sign}$ and $\mathsf{Ver}$ are specified as follows. $\mathsf{KeyGen}$, on input $1^{n}$, outputs a pair $(\pk,\sk)$ with

[TABLE]

The signing algorithm is defined by $\mathsf{Sign}_{\sk}(x)=(s_{i}^{x_{i}})_{i\in\{1,...,n\}}$ where $x_{i}$, $i=1,...,n$ are the bits of $x$. The verification procedure checks the signature’s consistency with the public key, i.e., $\mathsf{Ver}_{\pk}(x,s)=0$ if $p_{i}^{x_{i}}=h_{k}(s_{i})$ and $\mathsf{Ver}_{\pk}(x,s)=0$ otherwise.

We now show that the Lamport scheme is 1-$\mathsf{BU}$ secure in the quantum random oracle model.

Theorem 14**.**

Construction 2* is 1-$\mathsf{BU}$ secure if $h$ is modeled as a quantum-accessible random oracle.*

Proof.

We implement the random oracle $h$ as a superposition oracle with register $F$. In the 1-$\mathsf{BlindForge}$ experiment we execute the sampling part of the key generation by preparing a superposition as well. More precisely, we can just prepare $2n$ $n$-qubit registers $S_{i}^{j}$ in a uniform superposition, with the intention of measuring them to sample $s_{i}^{j}$ in mind. We are talking about a classical one-time signature scheme, and all computation that uses the secret key is done by an honest party, and is therefore classical. It follows that the measurement that samples $s_{i}^{j}$ commutes with all other operations which are implemented as quantum-controlled operations controlled on the secret key registers, i.e., we can postpone it to the very end of the 1-$\mathsf{BlindForge}$ experiment, just like the measurement that samples an actual random oracle using a superposition oracle. The joint state $|\psi_{0}\rangle$ with oracle register F and secret key register $S\!K=(S_{i}^{j})_{i\in\{1,...,n\},j=0,1}$ is now in a uniform superposition, i.e.,

[TABLE]

To subsequently generate the public key, the superposition oracle for $h$ is queried on each of the $S_{i}^{j}$ with an empty outrput register $P_{i}^{j}$, producing the state $|\psi_{1}\rangle_{S\!KP\!KF}$ equal to

[TABLE]

where $|f_{\sk,\pk}\rangle_{F}$ is the superposition oracle state where $F_{s_{i}^{j}}$ is in state $|p_{i}^{j}\rangle$ and all other registers are still in state $|\phi_{0}\rangle$. Then the registers $P_{i}^{j}$ are measured to produce an actual, classical, public key that can be handed to the adversary. Note that there is no hash function key $k$ now, as it has been replaced by the random oracle. Treating the public key as classical information from now on and removing the registers $P\!K$, the state takes the form

[TABLE]

Now the interactive phase of the 1-$\mathsf{BlindForge}$ experiment can begin, and we provide both the random oracle $h$ and the signing oracle (that can be called exactly once) as superposition oracles using the joint oracle state $|\psi_{2}(\pk)\rangle$ above. The random oracle answers queries as described in Section 3.3. The signing oracle, when queried with registers $XZ$ with $Z=Z_{1}...Z_{n}$, applies $\mathrm{CNOT}^{\otimes n}_{S_{i}^{x_{i}}:Z_{i}}$, $i=1,...,n$ controlled on $X$ being in the state $x\notin B_{\varepsilon}$.

Now suppose $\mathcal{A}$, after making at most one query to $\mathsf{Sign}$ and an arbitrary polynomial number of queries to $h$, outputs a candidate message signature pair $(x^{0},z^{0})$ with $z^{0}=z^{0}_{1}\|\cdots\|z^{0}_{n}$. If $x^{0}\notin B_{\varepsilon}$, $\mathcal{A}$ has lost. Suppose therefore that $x^{0}\in B_{\varepsilon}$. We will now make a measurement on the oracle register to find an index $i$ such that $S_{i}^{x^{0}_{i}}$ has not been queried. To this end we first need to decorrelate $S\!K$ and $F$. This is easily done, as the success test only needs computational basis measurement results from the register $S\!K$, allowing us to perform any controlled operation on $F$ controlled on $S\!K$. Therefore we can apply the operation $\bigoplus p_{i}^{j}$ followed by $H^{\otimes n}$ to the register $F_{s_{i}^{j}}$ controlled on $S_{i}^{j}$ being in state $|s_{i}^{j}\rangle$, for all $i=1,...,n$ and $j=0,1$. For an adversary that does not make any queries to $h$, this has the effect that all $F$-registers are in state $|\phi_{0}\rangle$ again now.

We can equivalently perform this restoring procedure before the adversary starts interaction, and answer the adversary’s $h$-queries as follows. Controlled on the adversary’s input being equal to one of the parts $s_{i}^{j}$ of the secret key, answer with the corresponding public key, otherwise use the superposition oracle for $h$.

For any fixed secret key register $S_{i}^{j}$, the unitary that is applied upon an $h$-query can hence be written as

[TABLE]

where $U_{\bot}$ acts trivially on $S_{i}^{j}$ and the second equality follows because the unitaries $U_{\bot}$ and $U_{x}$ are controlled unitaries with $X$ and $S_{i}^{j}$ part of the control register. Using the above equation we derive a bound on the operator norm of the commutator of this unitary and the projector onto $|\phi_{0}\rangle$,

[TABLE]

where the second equality follows again because $U_{\bot}$ and $U_{x}$ are controlled unitaries with $X$ and $S_{i}^{j}$ part of the control register.

It follows that a query to $h$ does not decrease the number of registers $S_{i}^{j}$ that are in state $|\phi_{0}\rangle$, except with negligible amplitude.

As we assume that $x^{0}$ is blinded, we have that for any message $x\notin B_{\varepsilon}$, there exists an $i\in\{1,...,n\}$ such that $x_{i}\neq x^{0}_{i}$. But $\mathcal{A}$ interacts with a blinded signing oracle, i.e., controlled on his input being not blinded, it is forwarded to the signing oracle, otherwise $\bot$ is XORed into his output register. Therefore only non-blinded queries have been forwarded to the actual signing oracle, so the final state is a superposition of states in which the register $S\!K$ has at least $n$ subregisters $S_{i}^{j}$ are in state $|\phi_{0}\rangle$, and at least one of them is such that $x^{0}_{i}=j$. We can therefore apply an $n$-outcome measurement to the oracle register to obtain an index $i_{0}$ such that $S_{i_{0}}^{x^{0}_{i_{0}}}$ is in state $|\phi_{0}\rangle$. By Lemma 1, this implies that $\mathcal{A}$’s forgery is independent of $s_{i_{0}}$, so $\mathcal{A}$’s probability of succeeding in $\mathsf{BlindForge}$ is negligible. ∎

A simple proof of the $\mathsf{PO}$-security of a random function can be given using a similar idea, see Theorem 20 in the appendix.

6.3 Hash-and-MAC

To authenticate messages of arbitrary length with a fixed-length MAC, it is common practice to first compress a long message by a collision-resistant hash functon and then apply the MAC. This is known as Hash-and-MAC. However, when it comes to $\mathsf{BU}$-security, collision-resistance may not be sufficient. We therefore propose a new notion, Bernoulli-preserving hash, generalizing collision-resistance in the quantum setting, and show that it is sufficient for Hash-and-MAC with $\mathsf{BU}$ security. Recall that, given a subset $B$ of a set $X$, $\chi_{B}:X\to\{0,1\}$ denotes the characteristic function of $B$.

Definition 8** (Bernoulli-preserving hash).**

Let $\mathcal{H}:X\to Y$ be an efficiently computable function family. Define the following distributions on subsets of $X$:

$\mathcal{B}_{\epsilon}$* : generate $B_{\epsilon}\subseteq X$ by placing $x\in B_{\epsilon}$ independently with probability $\epsilon$. Output $B_{\epsilon}$.* 2. 2.

$\mathcal{B}_{\epsilon}^{\mathcal{H}}$* : generate $C_{\epsilon}\subseteq Y$ by placing $y\in C_{\epsilon}$ independently with probability $\epsilon$. Sample $h\in\mathcal{H}$ and define $B_{\epsilon}^{h}:=\{x\in X:h(x)\in C_{\epsilon}\}$. Output $B_{\epsilon}^{h}$.*

We say that $\mathcal{H}$ is a Bernoulli-preserving hash if for all adversaries $(\mathcal{A},\epsilon)$,

[TABLE]

The motivation for the name Bernoulli-preserving hash is simply that selecting $\mathcal{B}_{\epsilon}$ can be viewed as a Bernoulli process taking place on the set $X$, while $\mathcal{B}_{\epsilon}^{h}$ can be viewed as the pullback (along $h$) of a Bernoulli process taking place on $Y$.

We show that the standard, so-called “Hash-and-MAC” construction will work w.r.t. to $\mathsf{BU}$ security, if we instantiate the hash funtion with a Bernoulli-preserving hash. Recall that, given a MAC $\Pi=(\mathsf{Mac}_{k},\mathsf{Ver}_{k})$ with message set $X$ and a function $h:Z\to X$, there is a MAC $\Pi^{h}:=(\mathsf{Mac}_{k}^{h},\mathsf{Ver}_{k}^{h})$ with message set $Z$ defined by $\mathsf{Mac}_{k}^{h}=\mathsf{Mac}_{k}\circ h$ and $\mathsf{Ver}_{k}^{h}(m,t)=\mathsf{Ver}_{k}(h(m),t)$.

Theorem 15** (Hash-and-MAC with Bernoulli-preserving hash).**

Let $\Pi=(\mathsf{Mac}_{k},\mathsf{Ver}_{k})$ be a $\mathsf{BU}$-secure MAC with $\mathsf{Mac}_{k}:X\to Y$, and let $h:Z\to X$ a Bernoulli-preserving hash. Then $\Pi^{h}$ is a $\mathsf{BU}$-secure MAC.

Proof.

Let $\mathcal{A}$ be an adversary against $\Pi^{h}$. We build an adversary $\mathcal{A}_{0}$ against $\Pi$ which (given oracle $f:X\to Y$) runs $\mathcal{A}$ and answers its queries with $f\circ h$, i.e., $|m\rangle|t\rangle\mapsto|m\rangle|t\oplus f(h(m))\rangle$. This can be implemented by first computing $h$ into an extra register, then invoking the oracle, and then uncomputing $h$. When $\mathcal{A}$ produces its final output $(m,t)$, $\mathcal{A}_{0}$ outputs $(h(m),t)$ and terminates. We claim that

[TABLE]

Since the right-hand-side of the difference above is negligible by $\mathsf{BU}$-security of $\Pi$, establishing the claim will finish the proof.

We prove the claim by showing that the difference can be viewed as the success probability of a distinguisher $\mathcal{D}$ against the Bernoulli-preserving property of $h$. The distinguisher $\mathcal{D}$ receives an oracle for $\chi_{B}$ (where $B\subseteq Z$ is sampled according to either $\mathcal{B}_{\epsilon}$ or $\mathcal{B}^{h}_{\epsilon}$) and proceeds as follows:

generate a key $k$ for $\Pi$; 2. 2.

run $\mathcal{A}$, answering its oracle queries with

[TABLE]

where we invoked the oracle in the first step and CCNOT in the second; 3. 3.

when $\mathcal{A}$ outputs $(m,t)$, compute $b=\mathsf{Ver}^{h}_{k}(m,t)=\mathsf{Ver}_{k}(h(m),t)$. Query the oracle to compute $b^{\prime}=\chi_{B}(m)$, and output $b\wedge b^{\prime}$.

It now remains to check that (i.) if $B$ was sampled according to $\mathcal{B}_{\epsilon}$ (i.e., uniform blinding), then $\mathcal{D}$ is simulating the game $\mathsf{BlindForge}_{\mathcal{A},\Pi^{h}}(n,\epsilon)$, and (ii.) If $B$ was sampled according to $\mathcal{B}_{\epsilon}^{h}$ (i.e., hash-blinding), then $\mathcal{D}$ is simulating the game $\mathsf{BlindForge}_{\mathcal{A}_{0},\Pi}(n,\epsilon)$. Fact (i.) follows directly from the definition666Note that we have again used the convention that the blinding symbol $\bot$ is the string $0\dots 01$; in our case, the final bit corresponds to the register containing $\chi_{B}(m)$. If one chooses a different convention, it may be necessary to adjust $\mathcal{D}$ to uncompute that register with an extra call to the oracle. of the $\mathsf{BlindForge}$ game. To see fact (ii.), observe that the $\mathsf{BlindForge}$ game against $\mathcal{A}_{0}$ samples a uniform blinding set $C_{\epsilon}\subseteq X$ and executes algorithm $\mathcal{A}$ with oracle

[TABLE]

precisely as in the execution of $\mathcal{A}$ by $\mathcal{D}$. ∎

In the next section, we provide a number of additional results about Bernoulli-preserving hash functions.

7 Properties of Bernoulli-preserving hash functions

We explore the notion of Bernoulli-preserving hash functions. These results can be summarized as follows.

• •

If $H$ is a random oracle or a $\mathsf{qPRF}$, then it is a Bernoulli-preserving hash.

• •

If $H$ is $4q$-wise independent, then it is a Bernoulli-preserving hash against $q$-query adversaries.

• •

Under the $\mathsf{LWE}$ assumption, there is a (public-key) family of Bernoulli-preserving hash functions.

• •

If we only allow classical oracle access, then the Bernoulli-preserving property is equivalent to standard collision-resistance.

• •

Bernoulli-preserving hash functions are collapsing (another quantum generalization of collision-resistance proposed in [25]).

First, we show that random and pseudorandom functions are Bernoulli-preserving, and that this property is equivalent to collision-resistance against classical queries.

Lemma 4**.**

Let $H:X\to Y$ be a function such that $1/|Y|$ is negligible. Then:

If $H$ is a random oracle or a $\mathsf{qPRF}$, then it is a Bernoulli-preserving hash. 2. 2.

If $H$ is $4q$-wise independent, then it is a Bernoulli-preserving hash against $q$-query adversaries.

Proof.

The claim for random oracles is obvious: by statistical collision-resistance, uniform blinding is statistically indistinguishable from hash-blinding. The remaining claims follow from the observation that one can simulate one quantum query to $\chi_{B_{\epsilon}^{h}}$ using two quantum queries to $h$ (see, e.g., the proof of Corollary 4). ∎

Theorem 16**.**

A function $h:\{0,1\}^{*}\to\{0,1\}^{n}$ is Bernoulli-preserving against classical-query adversaries if and only if it is collision-resistant.

Proof.

First, the Bernoulli-preserving hash property implies collision-resistance: testing whether two colliding inputs are either (i.) both not blinded or both blinded, or (ii.) exactly one of them is blinded, yields always outcome (i.) when dealing with a hash-blinded oracle and a uniformly random outcome for a blinded oracle and $\varepsilon=1/2$. On the other hand, consider an adversary $\mathcal{A}$ that has inverse polynomial distinguishing advantage between blinding and hash-blinding, and let $x_{1},...,x_{q}$ be it’s queries. Assume for contradiction that with overwhelming probability $h(x_{i})\neq h(x_{j})$ for all $x_{i}\neq x_{j}$. Then with that same overwhelming probability the blinded and hash blinded oracles are both blinded independently with probability $\varepsilon$ on each $x_{i}$ and are hence statistically indistinguishable, a contradiction. It follows that with non-negligible probability there exist two queries $x_{i}\neq x_{j}$ such that $h(x_{i})=h(x_{j})$, i.e., $\mathcal{A}$ has found a collision. ∎

7.1 A Bernoulli-preserving hash from LWE

We have observed that any $\mathsf{qPRF}$ is a Bernoulli-preserving hash function, which can be constructed from various quantum-safe computational assumpiton (e.g., LWE). Nonetheless, $\mathsf{qPRF}$ typically does not give short digest, which would result in long tags, and it requires a secret key.777In practice, it is probably more convenient (and more reliable) to instantiate a $\mathsf{qPRF}$ from block ciphers, which may not be ideal for message authentication.

Here we point out an alternative construction of a public Bernoulli-preserving hash function based on the quantum security of LWE. In fact, we show that the collapsing hash function by Unruh [24] is also Bernoulli-preserving hash. This constructions relies on a lossy function family $F:X\to Y$ and a universal hash function $G=\{g_{k}:Y\to Z\}_{k\in\mathcal{K}}$. A lossy function family admits two types of keys: a lossy key $s\leftarrow\mathcal{D}_{\mathrm{los}}$ and an injective key $s\leftarrow\mathcal{D}_{inj}$, which are computationally indistinguishable. $F_{s}:X\to Y$ under a lossy key $s$ is compressing, i.e., $|\operatorname{im}(F_{s})|\ll|Y|$; whereas under an injective key $s$, $F_{s}$ is injective. We refer a formal definition to [24, Definition 2], and an explicit construction based on LWE to [18]. We will also use exist efficient constructions for universal hash families [26]. Then one constructs a hash funciton family $H=\{h_{s,k}\}$ by $h_{s,k}:=g_{k}\circ F_{s}$ with public parameters generated by $s\leftarrow\mathcal{D}_{\mathrm{los}},k\leftarrow\mathcal{K}$.

The proof of Bernoulli-preserving for this hash function is similar to Unruh’s proof that $H$ is collapsing. We begin with a lemma.

Lemma 5**.**

Any injective function $f$ is Bernoulli-preserving hash. Given any Bernoulli-preserving hash $f:X\to Y$ and $g:Y\to Z$ that is Bernoulli-preserving hash on $\operatorname{im}(f)$, then $h=g\circ f$ is also Bernoulli-preserving hash.

Proof.

The first part follows by observing that a $\varepsilon$-random subset in the codomain corresponds exactly to a $\varepsilon$-random subset in the domain under inverse of the function. Let $\mathcal{O}\approx\mathcal{O}^{\prime}$ denote that two oracles $\mathcal{O}$ and $\mathcal{O}$ are indistinguishable by any quantum poly-time algorithm. For the second part, we need to show that $\chi_{C:C\leftarrow_{\varepsilon}X}\approx\chi_{C:C=h^{-1}(C_{Z}),C_{Z}\leftarrow_{\varepsilon}Z}$, where $\leftarrow_{\varepsilon}$ indicates sampling a random subset of fraction $\varepsilon$. Since $f$ is Bernoulli-preserving hash, we have that

[TABLE]

The second equivalence holds by observing that for any $C_{Y}\subseteq Y$, $f^{-1}(C_{Y})=f^{-1}(C_{Y}\cap\operatorname{im}(f))$. Then because $g$ is Bernoulli-preserving on $\operatorname{im}(f)$,

[TABLE]

Therefore, we conclude that

[TABLE]

Theorem 17**.**

$H$* is Bernoulli-preserving hash if LWE holds against any efficient quantum distinguisher.*

Proof.

We proceed in three steps (with the help of Lemma 5 above):

Since $F_{s}$ is injective under an injective key, it is clearly Bernoulli-preserving hash. As a result, $F_{s},s\leftarrow\mathcal{D}_{\mathrm{los}}$ must be Bernoulli-preserving hash too, because a lossy key is indistinguishable from an injective key by definition. 2. 2)

Then $g_{k}$ is chosen properly so that it is injective when restricted to $\operatorname{im}(F_{s})$ of lossy key $s$. Therefore $g_{k}$ is Bernoulli-preserving hash too. 3. 3)

Finally, $H_{k,s}$ is Bernoulli-preserving hash by the composition of Bernoulli-preserving hash functions $g_{k}$ and $F_{s}$.

∎

7.2 Relationship to collapsing

Here we relate Bernoulli-preserving hash to the collapsing property, which is another quantum generalization of classical collision-resistance. We first describe the collapsing property (slightly adapting Unruh’s original definition [25]) as follows. Let $h:X\to Y$ be a hash function, and let $\mathcal{S}_{X}$ and $\mathcal{S}_{XY}$ be the set of quantum states (i.e., density operators) on registers corresponding to the sets $X$ and $X\times Y$, res