Quantum-secure message authentication via blind-unforgeability

TL;DR

This paper introduces a new quantum-aware notion of message unforgeability called blind unforgeability, supporting classical and quantum cryptographic constructions and demonstrating its strength over previous definitions.

Contribution

The paper proposes the blind unforgeability definition for quantum adversaries, extending classical unforgeability notions and validating it with cryptographic examples and constructions.

Findings

Blind unforgeability coincides with EUF-CMA classically.

Hash-and-MAC and Lamport signatures are unforgeable under this definition.

Blind unforgeability is stronger than previous quantum unforgeability notions.

Abstract

Formulating and designing authentication of classical messages in the presence of adversaries with quantum query access has been a longstanding challenge, as the familiar classical notions of unforgeability do not directly translate into meaningful notions in the quantum setting. A particular difficulty is how to fairly capture the notion of "predicting an unqueried value" when the adversary can query in quantum superposition. We propose a natural definition of unforgeability against quantum adversaries called blind unforgeability. This notion defines a function to be predictable if there exists an adversary who can use "partially blinded" oracle access to predict values in the blinded region. We support the proposal with a number of technical results. We begin by establishing that the notion coincides with EUF-CMA in the classical setting and go on to demonstrate that the notion is satisfied by a number of simple guiding examples, such as random functions and quantum-query-secure pseudorandom functions. We then show the suitability of blind unforgeability for supporting canonical constructions and reductions. We prove that the "hash-and-MAC" paradigm and the Lamport one-time digital signature scheme are indeed unforgeable according to the definition. To support our analysis, we additionally define and study a new variety of quantum-secure hash functions called Bernoulli-preserving. Finally, we demonstrate that blind unforgeability is stronger than a previous definition of Boneh and Zhandry [EUROCRYPT '13, CRYPTO '13] in the sense that we can construct an explicit function family which is forgeable by an attack that is recognized by blind-unforgeability, yet satisfies the definition by Boneh and Zhandry.

Equations

$$B_{ϵ}{\mathsf{Mac}}_k(x):=\{\begin{array}{ll}\perp & \text{if x∈Bϵ},\\ {\mathsf{Mac}}_k(x)& \text{otherwise.}\end{array}$$

$$\underset{B_{ϵ}}{E}{\Vert {\mathcal{A}}^f(1^n)-{\mathcal{A}}^{f\oplus g_{B_{ϵ}}}(1^n)\Vert }_1\le 2T\sqrt{ϵ}.$$

$$M_k(x)=\{\begin{array}{ll}g(x^{\prime }\mathrm{mod}p)\Vert f(x^{\prime })& x=1\Vert x^{\prime },\\ 0^n\Vert h(x^{\prime })& x=0\Vert x^{\prime },x^{\prime }\ne p,\\ 0^{2n}& x=0\Vert p.\end{array}$$

$$\sum _{x,y}|1,x{⟩}_X|0^n{⟩}_{Y_1}|y{⟩}_{Y_2}⟼\sum _{x,y}|1,x{⟩}_X|g_p(x){⟩}_{Y_1}|y\oplus f(x){⟩}_{Y_2};$$

$$\begin{array}{ccccc}\mathsf{EUF}\text{mbox}-\mathsf{CMA}& \stackrel{\text{cite}[cite][\text{@@bibref}BZ13a]}{⟺}& \mathsf{PO}& \stackrel{\text{hyperref@@ii[prop:MAC-EUF=BU]Proposition refprop:MAC-EUF=BU}}{⟺}& \mathsf{BU}\end{array}$$

$$\begin{array}{ccccc}\mathsf{PO}& \stackrel{\text{hyperref@@ii[cor:separation]Corollary refcor:separation}}{/⟹}& \mathsf{BU}& \begin{array}{c}\stackrel{\text{Observation}}{/⟹}\\ \underset{\text{hyperref@@ii[cor:qprfandk-wise]Corollary refcor:qprfandk-wise}}{⟸}\end{array}& \mathsf{qPRF}\end{array}$$

$$\Bigl{|}\underset{k\in_{R}K}{\Pr}\bigl{[}\mathcal{D}^{f_{k}}(1^{n})=1\bigr{]}-\underset{g\in_{R}\mathcal{F}_{X}^{Y}}{\Pr}\bigl{[}\mathcal{D}^{g}(1^{n})=1\bigr{]}\Bigr{|}\,\leq\mathrm{negl}(n)\,.$$

$$\underset{k\in_{R}K}{\Pr}\bigl{[}\mathcal{D}^{f_{k}}(1^{n})=1\bigr{]}=\underset{g\in_{R}\mathcal{F}_{X}^{Y}}{\Pr}\bigl{[}\mathcal{D}^{g}(1^{n})=1\bigr{]}\,.$$

$${\eta }_F=|{\varphi }_0⟩⟨{\varphi }_0{|}^{\otimes 2^n},|{\varphi }_0⟩=2^{-\frac{m}{2}}\sum _{y\in \{0,1{\}}^m}|y⟩,$$

$$U_H({\mathrm{CNOT}}^{\otimes m}{)}_{F_x:Y}{U}_H^{†}$$

$$H_A\otimes H_B{\mathrm{CNOT}}_{A:B}{H}_A\otimes H_B={\mathrm{CNOT}}_{B:A},$$

$$|x{⟩}_X|{\varphi }_y{⟩}_Y|0^m{⟩}^{\otimes 2^n}⟼|x{⟩}_X|{\varphi }_y{⟩}_Y|0^m{⟩}^{\otimes (\text{lex}(x)-1)}|y{⟩}_{F_x}|0^m{⟩}^{\otimes (2^n-\text{lex}(x))},$$

$$U_{XYF}^{\mathrm{FO}}={\left(H^{\otimes m{2}^n}\right)}_F{U}_{XYF}^{\mathrm{O}}{\left(H^{\otimes m{2}^n}\right)}_F.$$

$$N_F=\sum _{x\in \{0,1{\}}^n}(\text{mathds}1-|0⟩⟨0|{)}_{F_x}\otimes \text{mathds}{1}^{\otimes (2^n-1)}.$$

$$N_F$$

$$S_l$$

$$Bf(x)=\{\begin{array}{ll}\perp & \text{if x∈B},\\ f(x)& \text{otherwise.}\end{array}$$

$$\Pr\bigl{[}\mathsf{BlindForge}_{\mathcal{A},\Pi}(n,\epsilon(n))=1]\leq\negl\,.$$

$$\Pr\bigl{[}\mathsf{BlindForge}^{q}_{\mathcal{A},\Pi}(n,\epsilon(n))=1]\leq\negl\,.$$

$$B_{ϵ}{\mathsf{Mac}}_{k;r}(m):=\{\begin{array}{ll}\perp & \text{ if }(m,{\mathsf{Mac}}_k(m;r))\in B_{ϵ},\\ {\mathsf{Mac}}_k(m;r)& \text{ otherwise.}\end{array}$$

$$\operatorname*{\mathbb{E}}_{B}\bigl{[}\delta\bigl{(}\mathcal{A}^{F}(1^{n}),\mathcal{A}^{F\oplus P}(1^{n})\bigr{)}\bigr{]}\leq 2T\sqrt{\epsilon}.$$

$$\tilde{p}:={\mathrm{Pr}}_{k,(m,t)\leftarrow {\mathcal{A}}^{{\mathsf{Mac}}_k}(1^n)}\left[{\mathsf{Mac}}_k(m)=t\wedge m\notin \mathsf{supp}(\mathcal{A})\right]\ge n^{-c},$$

$$p:=$$

$$\ge$$

$$=$$

$$\ge$$

$${\mathbb{E}}_{r,k}{\Vert {\left({\Pi }_{\mathsf{Ver},k}\right)}_{MT}(V-W{)}_{MTB}{\left(U_{\mathsf{Mac},r,k}\right)}_{MT}|\psi {⟩}_{MB}|0{⟩}_T\Vert }^2\le \epsilon ,$$

$${\Pi }_{\mathsf{Ver},k}=\sum _{(m,t)\mathrm{valid}}|m⟩⟨m|\otimes |t⟩⟨t|$$

$${\mathbb{E}}_{B_{\epsilon }}\left[{\Pi }_A^{(\epsilon )}{M}_{AB}{\bar{\Pi }}_A^{(\epsilon )}{\rho }_{AB}{\bar{\Pi }}_A^{(\epsilon )}{M}_{AB}^{†}{\Pi }_A^{(\epsilon )}\right]\ge {\epsilon }^2(1-\epsilon {)}^2{M}_{AB}{\rho }_{AB}{M}_{AB}^{†},$$

$$M_{AB}=\sum _{x\ne y}|x⟩{⟨y|}_A\otimes M_B^{(xy)}$$

$${\rho }_{AB}=\sum _{xy}|x⟩{⟨y|}_A\otimes {\rho }_B^{(xy)}.$$

$${\mathbb{E}}_{B_{\epsilon }}\left[{\Pi }_A^{(\epsilon )}{M}_{AB}{\bar{\Pi }}_A^{(\epsilon )}\rho {\bar{\Pi }}_A^{(\epsilon )}{M}_{AB}^{†}{\Pi }_A^{(\epsilon )}\right]$$

Full text

We propose a natural definition of unforgeability against quantum adversaries called blind unforgeability. This notion defines a function to be predictable if there exists an adversary who can use “partially blinded” oracle access to predict values in the blinded region. We support the proposal with a number of technical results. We begin by establishing that the notion coincides with EUF-CMA in the classical setting and go on to demonstrate that the notion is satisfied by a number of simple guiding examples, such as random functions and quantum-query-secure pseudorandom functions. We then show the suitability of blind unforgeability for supporting canonical constructions and reductions. We prove that the “hash-and-MAC” paradigm and the Lamport one-time digital signature scheme are indeed unforgeable according to the definition. To support our analysis, we additionally define and study a new variety of quantum-secure hash functions called Bernoulli-preserving.

Finally, we demonstrate that blind unforgeability is stronger than a previous definition of Boneh and Zhandry [EUROCRYPT ’13, CRYPTO ’13] in the sense that we can construct an explicit function family which is forgeable by an attack that is recognized by blind-unforgeability, yet satisfies the definition by Boneh and Zhandry.

Note: An earlier version of this article contained a theorem that the new security notion “blind-unforgeability” ($\mathsf{BU}$) we introduce implies the notion of “plus-one” unforgeability ($\mathsf{PO}$) that was hitherto the only proposed generalization of $\mathsf{EUF\mbox{-}CMA}$ to $>1$ quantum chosen-message queries. Unfortunately the proof contained an error. We thank Shih-Han Hung for discovering the error. We have now removed the claim and the question whether the implication holds is currently open. We would like to emphasize that the example presented in Section 8 disqualifies $\mathsf{PO}$ as a quantum-access generalization of $\mathsf{EUF\mbox{-}CMA}$, so currently there are two reasonable possible definitions of “quantum-access $\mathsf{EUF\mbox{-}CMA}$”: the notion of blind-unforgeability proposed in this article, and its conjunction with plus-one unforgeability.

1 Introduction

Large-scale quantum computers will break widely-deployed public-key cryptography, and may even threaten certain post-quantum candidates [21, 8, 9, 10, 5]. Even elementary symmetric-key constructions like Feistel ciphers and CBC-MACs become vulnerable in quantum attack models where the adversary is presumed to have quantum query access to some part of the cryptosystem [15, 16, 14, 20]. As an example, consider encryption in the setting where the adversary has access to the unitary operator $|x\rangle|y\rangle\mapsto|x\rangle|y\oplus f_{k}(x)\rangle$, where $f_{k}$ is the encryption or decryption function with secret key $k$. While it is debatable if this model reflects physical implementations of symmetric-key cryptography, it appears necessary in a number of generic settings, such as public-key encryption and hashing with public hash functions. It could also be relevant when private-key primitives are composed in larger protocols, e.g., by exposing circuits via obfuscation [19]. Setting down appropriate security definitions in this quantum attack model is the subject of several threads of recent research [7, 11].

In this article, we study authentication of classical information in the quantum-secure model. Here, the adversary is granted quantum query access to the signing algorithm of a message authentication code (MAC) or a digital signature scheme, and is tasked with producing valid forgeries. In the purely classical setting, we insist that the forgeries are fresh, i.e., distinct from previous queries to the oracle. When the function may be queried in superposition, however, it’s unclear how to meaningfully reflect this constraint that a forgery was previously “unqueried.” For example, it is clear that an adversary that simply queries with a uniform superposition and then measures a forgery—a feasible attack against any function—should not be considered successful. On the other hand, an adversary that uses the same query to discover some structural property (e.g., a superpolynomial-size period in the MAC) should be considered a break. Examples like these indicate the difficulty of the problem. How do we correctly “price” the queries? How do we decide if a forgery is fresh? Furthermore, how can this be done in a manner that is consistent with these guiding examples? In fact, this problem has a natural interpretation that goes well beyond cryptography: *What does it mean for a classical function to appear unpredictable to a quantum oracle algorithm?*111The related notion of “appearing random to quantum oracle algorithms” has a satisfying definition, which can be fulfilled efficiently [27].

1.1 Previous approaches

The first approach to this problem was suggested by Boneh and Zhandry [6]. They define a MAC to be unforgeable if, after making $q$ queries to the MAC, no adversary can produce $q+1$ valid input-output pairs except with negligible probability. We will refer to this notion as “$\mathsf{PO}$ security” ($\mathsf{PO}$ for “plus one,” and $k$-$\mathsf{PO}$ when the adversary is permitted a maximum of $k$ queries). Among a number of results, Boneh and Zhandry prove that this notion can be realized by a quantum-secure pseudorandom function ($\mathsf{qPRF}$).

Another approach, due to Garg, Yuen and Zhandry [12] ($\mathsf{GYZ}$), considers a function one-time unforgeable if only a trivial “query, measure in computational basis, output result” attack222Technically, the Stinespring dilation [23] of a computational basis measurement is the most general attack. is allowed. Unfortunately, it is not clear how to extend $\mathsf{GYZ}$ to two or more queries. Furthermore, the single query is allowed in a limited query model with an non-standard restriction.333Compared to the standard quantum oracle for a classical function, GYZ require the output register to be empty prior to the query. Zhandry recently showed a separation between $\mathsf{PO}$ and $\mathsf{GYZ}$ by means of the powerful tool of obfuscation [29].

It is interesting to note that similar problems arise in encryption schemes of quantum data and a convincing solution was recently found [3, 2]. However, it relies on the fact that for quantum messages, authentication implies secrecy. This enables “tricking” the adversary by replacing their queries with “trap” plaintexts to detect replays. As unforgeability and secrecy are orthogonal in the classical world, adversaries would easily recognize the spoofed oracle. This renders the approach of [3, 2] inapplicable in this case.

1.2 Unresolved issues

$\mathsf{PO}$ security, the only candidate definition of quantum-secure unforgeability in the general, multi-query setting, appears to be insufficient for several reasons. First, as observed in [12], it is a priori unclear if $\mathsf{PO}$ security rules out forging on a message region $A$ while making queries to a signing oracle supported on a disjoint message region $B$. Second, there may be unique features of quantum information, such as the destructiveness of quantum measurement, which $\mathsf{PO}$ does not capture. In particular, quantum algorithms must sometimes “consume” (i.e., fully measure) a state to extract some useful information, such as a symmetry in the oracle. There might be an adversary that makes one or more quantum queries but then must consume the post-query states completely in order to make a single, but convincing, forgery.

Surprisingly, prior to this work none of these plausible attack strategies have been exploited to give a separation between $\mathsf{PO}$ and “intuitive security.”

2 Summary of results

2.1 A new definition: Blind-unforgeability

To address the abovementioned issues, and in light of the concrete “counterexample” presented below as Construction 1, we develop a new definition of many-time unforgeability we call “blind-unforgeability” (or $\mathsf{BU}$). In this approach we examine the behavior of adversaries in the following experiment. The adversary is granted quantum oracle access to the MAC, “blinded” at a random region $B$. Specifically, we set $B$ to be a random $\epsilon$-fraction of the message space, and declare that the oracle function will output $\bot$ on all of $B$.

[TABLE]

Given a MAC $(\mathsf{Mac},\mathsf{Ver})$, an adversary $\mathcal{A}$, and $\mathcal{A}$-selected parameter $\epsilon$, the “blind forgery experiment” is:

Generate key $k$ and random blinding $B_{\epsilon}$; 2. 2.

Produce candidate forgery $(m,t)\leftarrow\mathcal{A}^{B_{\epsilon}\mathsf{Mac}_{k}}(1^{n})$. 3. 3.

Output $\mathsf{win}$ if $\mathsf{Ver}_{k}(m,t)=\mathsf{acc}$ and $m\in B_{\epsilon}$; otherwise output $\mathsf{rej}$.

Definition 1**.**

A MAC is blind-unforgeable ($\mathsf{BU}$) if for every adversary $(\mathcal{A},\epsilon)$, the probability of winning the blind forgery experiment is negligible.

In this work, $\mathsf{BU}$ will typically refer to the case where $\mathcal{A}$ is an efficient quantum algorithm (QPT) and the oracle is quantum, i.e., $|x\rangle|y\rangle\mapsto|x\rangle|y\oplus B_{\epsilon}\mathsf{Mac}_{k}(x)\rangle$. We will also consider $q$-$\mathsf{BU}$, the information-theoretic variant where the total number of queries is a priori fixed to $q$. We remark that the above definition is also easy to adapt to other settings, e.g., classical security against PPT adversaries, quantum or classical security for digital signatures, etc.

We remark that one could define a variant of the above where the adversary is allowed to describe the blinding distribution, rather than it being uniform. However, this is not a stronger notion. By a straightforward argument, an adversary wins in the chosen-blinding $\mathsf{BU}$ game if and only if it wins with a uniform $\epsilon$-blinding for inverse-polynomial $\epsilon$. Indeed, the adversary can just simulate its chosen blinding herself, and this still succeeds with inverse polynomial probability when interacting with a standard-blinded oracle (see Theorem 1 below).

2.2 Results about blind-unforgeability

To solidify our confidence in the new notion, we collect a series of results which we believe establish $\mathsf{BU}$ as a definition of unforgeability that captures the desired intuitive security requirement. In particular, we show that $\mathsf{BU}$ classifies a host of representative examples (in fact, all examples examined thus far) as either forgeable or unforgeable in a way that agrees with our cryptographic intuition. We show that $\mathsf{PO}$ certifies certain MACs as secure but are completely broken by a quantum-access attack in a strong and intuitive sense (Section 2.3 below). While we cannot currently prove that $\mathsf{BU}$ is strictly stronger than $\mathsf{PO}$ as a security notion, we can show that $\mathsf{BU}$ implies a weaker version of $\mathsf{PO}$ in Section 5.2.3.

Relations and characterizations.

One key technical ingredient that informs our intuition and characterization results about $\mathsf{BU}$ is a general simulation theorem, which tightly controls the deviation in the behavior of an algorithm when subjected to the $\mathsf{BU}$ experiment.

Theorem 1**.**

Let $\mathcal{A}$ be a quantum query algorithm making at most $T$ queries. Let $f:X\to Y$ be a function, $B_{\epsilon}$ a random $\epsilon$-blinding subset of $X$, and for each $B\subset X$, let $g_{B}$ be a function with support $B$. Then

[TABLE]

This result can be viewed as strong evidence that algorithms that produce “good forgeries” in any reasonable sense will not be disturbed too much by blinding, and will thus also win the $\mathsf{BU}$ experiment. We can formulate and prove this intuition explicitly for a wide class of adversaries, as follows. Given an oracle algorithm $\mathcal{A}$, we let $\mathsf{supp}(\mathcal{A})$ denote the union of the supports of all the queries of $\mathcal{A}$, taken over all choices of oracle function.

Theorem 2** (informal).**

Let $\mathcal{A}$ be QPT and $\mathsf{supp}(\mathcal{A})\cap R=\emptyset$ for some $R\neq\emptyset$. Let $\mathsf{Mac}$ be a MAC, and suppose $\mathcal{A}^{\mathsf{Mac}_{k}}(1^{n})$ outputs a valid pair $(m,\mathsf{Mac}_{k}(m))$ with $m\in R$ with noticeable probability. Then $\mathsf{Mac}$ is not $\mathsf{BU}$ secure.

Blind-unforgeable MACs.

Next, we show that several natural constructions satisfy $\mathsf{BU}$. We first show that a random function is blind-unforgeable.

Theorem 3**.**

Let $R:X\to Y$ be a random function such that $1/|Y|$ is negligible. Then $R$ is a blind-unforgeable MAC.

This together with results of Zhandry [27] and Boneh and Zhandry [6] leads to efficient $\mathsf{BU}$-secure constructions.

Corollary 1**.**

Quantum-secure pseudorandom functions ($\mathsf{qPRF}$) are $\mathsf{BU}$-secure MACs, and (4q+1)-wise independent functions are $q$-$\mathsf{BU}$-secure MACs.

We can then invoke a recent result about the quantum-security of domain-extension schemes such as NMAC and HMAC [22], and obtain variable-length $\mathsf{BU}$-secure MACs from any $\mathsf{qPRF}$.

In the setting of public verification, we show that the one-time Lamport signature scheme [17] is $\mathsf{BU}$-secure, provided that the underlying hash function family $\mathcal{R}:X\to Y$ is modeled as a random oracle.

Theorem 4**.**

Let $\mathcal{R}:X\to Y$ be a random function family. Then the Lamport scheme $L_{\mathcal{R}}$ is $\mathsf{BU}$ against adversaries which make one quantum query to $L_{\mathcal{R}}$ and poly-many quantum queries to $\mathcal{R}$.

Hash-and-MAC.

Consider the following natural variation on the blind-forgery experiment. To blind $F:X\to Y$, we first select a hash function $h:X\to Z$ and a blinding set $B_{\epsilon}\subseteq Z$; we then declare that $F$ will be blinded on $x\in X$ whenever $h(x)\in B_{\epsilon}$. We refer to this as “hash-blinding.” We call $h$ a Bernoulli-preserving hash if, for every oracle function $F$, no QPT can distinguish between an oracle that has been hash-blinded with $h$, and an oracle that has been blinded in the usual sense. Recall the notion of collapsing from [25].

Theorem 5**.**

Let $h:X\to Y$ be a hash function. If $h$ is Bernoulli-preserving hash, then it is also collapsing. Moreover, against adversaries with classical oracle access, $h$ is a Bernoulli-preserving hash if and only if it is collision-resistant.

We apply this new notion to show security of the Hash-and-MAC construction $\Pi^{h}=(\mathsf{Mac}^{h},\mathsf{Ver}^{h})$ with $\mathsf{Mac}^{h}_{k}(m):=\mathsf{Mac}_{k}(h(m))$.

Theorem 6**.**

Let $\Pi=(\mathsf{Mac}_{k},\mathsf{Ver}_{k})$ be a $\mathsf{BU}$-secure MAC with $\mathsf{Mac}_{k}:X\to Y$, and let $h:Z\to X$ a Bernoulli-preserving hash. Then $\Pi^{h}$ is a $\mathsf{BU}$-secure MAC.

We also show that the Bernoulli-preserving property can be satisfied by pseudorandom constructions, as well as a (public-key) hash based on lossy functions from $\mathsf{LWE}$ [18, 24].

2.3 A concrete “counterexample” for $\mathsf{PO}$

Supporting our motivation to devise a new unforgeability definition, we present a construction of a MAC which is forgeable (in a strong intuitive sense) and yet is classified by $\mathsf{PO}$ as secure.

Construction 1**.**

Given $k=(p,f,g,h)$ where $p\in\{0,1\}^{n}$ is a random period and $f,g,h:\{0,1\}^{n}\to\{0,1\}^{n}$ are random functions, define $M_{k}:\{0,1\}^{n+1}\to\{0,1\}^{2n}$ by

[TABLE]

Define $g_{p}(x):=g(x\bmod p)$ and consider an adversary that queries only on messages starting with $1$, as follows:

[TABLE]

discarding the first qubit and $Y_{2}$ then yields $\sum_{x}|x\rangle|g_{p}(x)\rangle$, as $\sum_{y}|y\oplus f(x)\rangle_{Y_{2}}=\sum_{y}|y\rangle_{Y_{2}}$. One can then recover $p$ via period-finding and output $(0\|p,0^{2n})$. We emphasize that the forgery was queried with zero amplitude. In practice, we can interpret it as, e.g., the attacker queries only on messages starting with “From: Alice” and then forges a message starting with “From: Bob”. Despite this, we can show that it is $\mathsf{PO}$-secure.

Theorem 7**.**

The family $M_{k}$ (for uniformly random $k=(p,f,g,h)$) is $\mathsf{PO}$-secure.

The $\mathsf{PO}$ security of $M$ relies on a dilemma the adversary faces at each query: either learn an output of $f$, or obtain a superposition of $(x,g(x))$-pairs for Fourier sampling. Our proof shows that, once the adversary commits to one of these two choices, the other option is irrevocably lost. Our result can thus be understood as a refinement of an observation of Aaronson: quantumly learning a property sometimes requires uncomputing some information [1]. Note that, while Aaronson could rely on standard (asymptotic) query complexity techniques, our problem is quite fragile: $\mathsf{PO}$ security describes a task which should be hard with $q$ queries, but is completely trivial given $q+1$ queries. Our proof makes use of a new quantum random oracle technique of Zhandry [28].

A straightforward application of Theorem 2 shows that Construction 1 is $\mathsf{BU}$-insecure. In particular, we have the following.

Corollary 2**.**

There exists a $\mathsf{PO}$-secure MAC which is $\mathsf{BU}$-insecure.

The relationship between $\mathsf{BU}$, $\mathsf{PO}$ and a few other notions are visualized in Figure 1.

2.4 Acknowledgements

The authors thanks Shih-Han Hung for discovering an error in an earlier version of this paper. CM thanks Ronald de Wolf for helpful discussions on query complexity. GA acknowledges support from the NSF under grant CCF-1763736, from the U.S. Army Research Office under Grant Number W911NF-20-1-0015, and from the U.S. Department of Energy under Award Number DE-SC0020312. CM was funded by a NWO VIDI grant (Project No. 639.022.519) and a NWO VENI grant (Project No. VI.Veni.192.159). FS acknowledges support from NSF grant CCF-2042414. AR acknowledges support from NSF grant CCF-1763773.

3 Preliminaries

Basic notation and conventions.

Given a finite set $X$, the notation $x\in_{R}X$ will mean that $x$ is a uniformly random element of $X$. Given a subset $B$ of a set $X$, let $\chi_{B}:X\to\{0,1\}$ denote the characteristic function of $B$, i.e., $\chi_{B}(x)=1$ if $x\in B$ and $\chi_{B}(x)=0$ otherwise. When we say that a classical function $F$ is efficiently computable, we mean that there exists a uniform family of deterministic classical circuits which computes $F$. We will consider three classes of algorithms: (i.) unrestricted algorithms, modeling computationally unbounded adversaries, (ii.) probabilistic poly-time algorithms (PPTs), modeling classical adversaries, and (iii.) quantum poly-time algorithms (QPTs), modeling quantum adversaries. We assume that the latter two are given as polynomial-time uniform families of circuits. For PPTs, these are probabilistic circuits. For QPTs, they are quantum circuits, which may contain both unitary gates and measurements. We will often assume (without loss of generality) that the measurements are postponed to the end of the circuit, and that they take place in the computational basis. Given an algorithm $\mathcal{A}$, we let $\mathcal{A}(x)$ denote the (in general, mixed) state output by $\mathcal{A}$ on input $x$. In particular, if $\mathcal{A}$ has classical output, then $\mathcal{A}(x)$ denotes a probability distribution. Unless otherwise stated, the probability is taken over all random coins and measurements of $\mathcal{A}$ and any randomness used to select the input $x$. If $\mathcal{A}$ is an oracle algorithm and $F$ a classical function, then $\mathcal{A}^{F}(x)$ is the mixed state output by $\mathcal{A}$ equipped with oracle $F$ and input $x$; the probability is now also taken over any randomness used to generate $F$.

We will distinguish between two ways of presenting a function $F:\{0,1\}^{n}\to\{0,1\}^{m}$ as an oracle. First, the usual “classical oracle access” simply means that each oracle call grants one classical invocation $x\mapsto F(x)$. This will always be the oracle model for PPTs. Second, “quantum oracle access” will mean that each oracle call grants an invocation of the $(n+m)$-qubit unitary gate $|x\rangle|y\rangle\mapsto|x\rangle|y\oplus F(x)\rangle\,.$ This will always be the oracle model for QPTs. Note that both QPTs and unrestricted algorithms could in principle receive either oracle type.

We will need the following lemma. We use the formulation from [7, Lemma 2.1], which is a special case of a more general “pinching lemma” of Hayashi [13].

Lemma 1**.**

Let $\mathcal{A}$ be a quantum algorithm and $x\in\{0,1\}^{*}$. Let $\mathcal{A}_{0}$ be another quantum algorithm obtained from $\mathcal{A}$ by pausing $\mathcal{A}$ at an arbitrary stage of execution, performing a partial measurement that obtains one of $k$ outcomes, and then resuming $\mathcal{A}$. Then $\Pr[\mathcal{A}_{0}(1^{n})=x]\geq\Pr[\mathcal{A}(1^{n})=x]/k$.

We denote the trace distance between states $\rho$ and $\sigma$ by $\delta(\rho,\sigma)$. Recall that this is simply half the trace norm of the difference, i.e., $\delta(\rho,\sigma)=({1}/{2})\|\rho-\sigma\|_{1}$. When $\rho$ and $\sigma$ are classical probability distributions, the trace distance is equal to the total variation distance.

3.1 Quantum-secure pseudorandomness

A quantum-secure pseudorandom function ($\mathsf{qPRF}$) is a family of classical, deterministic, efficiently-computable functions which appear random to QPT adversaries with quantum oracle access.

Definition 2**.**

An efficiently computable function family $f:K\times X\to Y$ is a quantum-secure pseudorandom function ($\mathsf{qPRF}$) if, for all QPTs $\mathcal{D}$,

[TABLE]

Here $\mathcal{F}_{X}^{Y}$ denotes the set of all functions from $X$ to $Y$. The standard “GGM+GL” construction of a $\mathsf{PRF}$ yields a $\mathsf{qPRF}$ when instantiated with a quantum-secure one-way function [27]. One can also construct a $\mathsf{qPRF}$ directly from the Learning with Errors assumption [27]. If we have an a priori bound on the number of allowed queries, then a computational assumption is not needed.

Theorem 8** (Lemma 6.4 in [6]).**

Let $q,c\geq 0$ be integers, and $f:K\times X\to Y$ a $(2q+c)$-wise independent family of functions. Let $\mathcal{D}$ be an algorithm making no more than $q$ quantum oracle queries and $c$ classical oracle queries. Then

[TABLE]

3.2 $\mathsf{PO}$-unforgeability

Boneh and Zhandry define unforgeability (against quantum queries) for classical MACs as follows [6]. They also show that random functions satisfy this notion.

Definition 3**.**

Let $\Pi=(\mathsf{KeyGen},\mathsf{Mac},\mathsf{Ver})$ be a MAC with message set $X$. Consider the following experiment with an algorithm $\mathcal{A}$:

Generate key:* $k\leftarrow\mathsf{KeyGen}(1^{n})$.* 2. 2.

Generate forgeries:* $\mathcal{A}$ receives quantum oracle for $\mathsf{Mac}_{k}$, makes $q$ queries, and outputs a string $s$;* 3. 3.

Outcome:* output win if $s$ contains $q+1$ distinct input-output pairs of $\mathsf{Mac}_{k}$, and fail otherwise.*

We say that $\Pi$ is $\mathsf{PO}$-secure if no adversary can succeed at the above experiment with better than negligible probability.

3.3 The Fourier Oracle

Our separation proof will make use of a new technique of Zhandry [28] for analyzing random oracles. We briefly describe this framework.

A random function $f$ from $n$ bits to $m$ bits can be viewed as the outcome of a quantum measurement. More precisely, let $\mathcal{H}_{F}=\bigotimes_{x\in\{0,1\}^{n}}\mathcal{H}_{F_{x}}$, where $\mathcal{H}_{F_{x}}\cong\mathbb{C}^{2^{m}}$. Then set $f(x)\leftarrow\mathcal{M}_{F_{x}}(\eta_{F})$, where

[TABLE]

and $\mathcal{M}_{F_{x}}$ denotes the measurement of the register $F_{x}$ in the computational basis. This measurement commutes with any $\mathrm{CNOT}_{A:B}$ gate with control qubit $A$ in $F_{x}$ and target qubit $B$ outside $F_{x}$. It follows that, for any quantum algorithm making queries to a random oracle, the output distribution is identical if the algorithm is instead run with the following oracle:

Setup: Prepare the state $\eta_{F}$. 2. 2.

Upon a query with query registers $X$ and $Y$, controlled on $X$ being in state $|x\rangle$, apply $(\mathrm{CNOT}^{\otimes m})_{F_{x}:Y}$. 3. 3.

After the algorithm has finished, measure $F$ to determine the success of the computation.

We denote the oracle unitary defined in step 2 above by $U^{\mathrm{O}}_{XYF}$. Having defined this oracle representation, we are free to apply any unitary $U_{H}$ to the oracle state, so long as we then also apply the conjugated query unitary

[TABLE]

in place of $U^{\mathrm{O}}_{XYF}$. We choose $U_{H}=H^{\otimes m2^{n}}$, which means that the oracle register starts in the all-zero state now. Applying Hadamard to both qubits reverses the direction of CNOT, i.e.,

[TABLE]

so the adversary-oracle-state after a first query with query state $|x\rangle_{X}|\phi_{y}\rangle_{Y}$ is

[TABLE]

where $\textsf{lex}(x)$ denotes the position of $x$ in the lexicographic ordering of $\{0,1\}^{n}$, and we defined the Fourier basis state $|\phi_{y}\rangle=H^{\otimes m}|y\rangle$. In the rest of this section, we freely change the order in which tensor products are written, and keep track of the tensor factors through the use of subscripts. This adjusted representation is called the Fourier oracle (FO), and we denote its oracle unitary by

[TABLE]

An essential fact about the FO is that each query can only change the number of non-zero entries in the FO’s register by at most one. To formalize this idea, we define the “number operator”

[TABLE]

The number operator can also be written in its spectral decomposition,

[TABLE]

Note that the initial joint state of a quantum query algorithm and the oracle (in the FO-oracle picture described above) is in the image of $P_{0}$. The following fact is essential for working with the Fourier Oracle; to avoid disrupting the flow of the article, the proof is given in Appendix A.1.

Lemma 2**.**

The number operator satisfies \bigl{\|}\left[N_{F},U_{XYF}^{FO}\right]\bigr{\|}_{\infty}=1. In particular, the joint state of a quantum query algorithm and the oracle after the $q$-th query is in the kernel of $P_{l}$ for all $l>q$.

4 The new notion: Blind-Unforgeability

4.1 Formal definition

For ease of exposition, we begin by introducing our new security notion in a form analogue to the standard notion of existential unforgeability under chosen-message attacks, $\mathsf{EUF\mbox{-}CMA}$. We will also later show how to extend our approach to obtain a corresponding analogue of strong unforgeability. We begin by defining a “blinding” operation. Let $f:X\rightarrow Y$ and $B\subseteq X$. We let

[TABLE]

We say that $f$ has been “blinded” by $B$. In this context, we will be particularly interested in the setting where elements of $X$ are placed in $B$ independently at random with a particular probability $\epsilon$; we let $B_{\epsilon}$ denote this random variable. (It will be easy to infer $X$ from context so we do not reflect it in the notation.)

Next, we define a security game in which an adversary is tasked with using a blinded MAC oracle to produce a valid input-output pair in the blinded set.

Definition 4**.**

Let $\Pi=(\mathsf{KeyGen},\mathsf{Mac},\mathsf{Ver})$ be a MAC with message set $X$. Let $\mathcal{A}$ be an algorithm, and $\epsilon:\mathbb{N}\to\mathbb{R}_{\geq 0}$ an efficiently computable function. The blind forgery experiment $\mathsf{BlindForge}_{\mathcal{A},\Pi}(n,\epsilon)$ proceeds as follows:

Generate key:* $k\leftarrow\mathsf{KeyGen}(1^{n})$.* 2. 2.

Generate blinding:* select $B_{\epsilon}\subseteq X$ by placing each $m$ into $B_{\epsilon}$ independently with probability $\epsilon(n)$.* 3. 3.

Produce forgery:* $(m,t)\leftarrow\mathcal{A}^{B_{\epsilon}\mathsf{Mac}_{k}}(1^{n})$.* 4. 4.

Outcome:* output $1$ if $\mathsf{Ver}_{k}(m,t)=\mathsf{acc}$ and $m\in B_{\epsilon}$; otherwise output [math].*

We say that a scheme is blind-unforgeable if, for any efficient adversary, the probability of winning the game is negligible. The probability is taken over the choice of key, the choice of blinding set, and any internal randomness of the adversary. We remark that specifying an adversary requires specifying (in a uniform fashion) both the algorithm $\mathcal{A}$ and the blinding fraction $\epsilon$.

Definition 5**.**

A MAC $\Pi$ is blind-unforgeable (BU) if for every polynomial-time uniform adversary $(\mathcal{A},\epsilon)$,

[TABLE]

We also define the “$q$-time” variant of the blinded forgery game, which is identical to Definition 4 except that the adversary is only allowed to make $q$ queries to $B_{\epsilon}\mathsf{Mac}_{k}$ in step (3). We call the resulting game $\mathsf{BlindForge}^{q}_{\mathcal{A},\Pi}(n,\epsilon)$, and give the corresponding definition of $q$-time security (now against computationally unbounded adversaries).

Definition 6**.**

A MAC $\Pi$ is $q$-time blind-unforgeable ($q$-BU) if for every $q$-query adversary $(\mathcal{A},\epsilon)$, we have

[TABLE]

The above definitions are agnostic regarding the computational power of the adversary and the type of oracle provided. For example, selecting PPT adversaries and classical oracles in Definition 5 yields a definition of classical unforgeability; we will later show that this is equivalent to standard $\mathsf{EUF\mbox{-}CMA}$. The main focus of our work will be on $\mathsf{BU}$ against QPTs with quantum oracle access, and $q$-$\mathsf{BU}$ against unrestricted adversaries with quantum oracle access.

4.2 Some technical details

We now remark on a few details in the usage of $\mathsf{BU}$. First, strictly speaking, the blinding sets in the security games above cannot be generated efficiently. However, a pseudorandom blinding set will suffice. Pseudorandom blinding sets can be generated straightforwardly using an appropriate pseudorandom function, such as a $\mathsf{PRF}$ against PPTs or a $\mathsf{qPRF}$ against QPT. A precise description of how to perform this pseudorandom blinding is given in the proof of Corollary 4. Note that simulating the blinding requires computing and uncomputing the random function, so we must make two quantum queries for each quantum query of the adversary. Moreover, verifying whether the forgery is in the blinding set at the end requires one additional classical query. This means that $(4q+1)$-wise independent functions are both necessary and sufficient for generating blinding sets for $q$-query adversaries (see [6, Lemma 6.4]). In any case, an adversary which behaves differently in the random-blinding game versus the pseudorandom-blinding game immediately yields a distinguisher against the corresponding pseudorandom function.

The blinding symbol. There is some flexibility in how one defines the blinding symbol $\bot$. In situations where the particular instantiation of the blinding symbol might matter, we will adopt the convention that the blinded version $Bf$ of $f:\{0,1\}^{n}\to\{0,1\}^{\ell}$ is defined by setting $Bf:\{0,1\}^{n}\to\{0,1\}^{\ell+1}$, where $Bf(m)=0^{\ell}||1$ if $m\in B$ and $Bf(m)=f(m)||0$ otherwise. One advantage of this convention (i.e., that $\bot=0^{\ell}||1$) is that we can compute on and/or measure the blinded bit (i.e., the $(\ell+1)$-st bit) without affecting the output register of the function. This will also turn out to be convenient for uncomputation.

Strong blind-unforgeability. The security notion $\mathsf{BU}$ given in Definition 5 is an analogue of simple unforgeability, i.e., $\mathsf{EUF\mbox{-}CMA}$, for the case of a quantum-accessible MAC/Signing oracle. It is, however, straightforward to define a corresponding analogue of strong unforgeability, i.e., $\mathsf{SUF\mbox{-}CMA}$, as well.

The notion of strong blind-unforgeability, $\mathsf{sBU}$, is obtained by a simple adjustment compared to $\mathsf{BU}$: we blind (message, tag) pairs rather than just messages. We briefly describe this for the case of MACs. Let $\Pi=(\mathsf{KeyGen},\mathsf{Mac},\mathsf{Ver})$ be a MAC with message set $M$, randomness set $R$ and tag set $T$, so that $\mathsf{Mac}_{k}:M\times R\to T$ and $\mathsf{Ver}_{k}:M\times T\to\{\mathsf{acc},\mathsf{rej}\}$ for every $k\leftarrow\mathsf{KeyGen}$. Given a parameter $\epsilon$ and an adversary $\mathcal{A}$, the strong blind forgery game proceeds as follows:

Generate key: $k\leftarrow\mathsf{KeyGen}$; generate blinding: select $B_{\epsilon}\subseteq M\times T$ by placing pairs $(m,t)$ in $B_{\epsilon}$ independently with probability $\epsilon$; 2. 2.

Produce forgery: produce $(m,t)$ by executing $\mathcal{A}(1^{n})$ with quantum oracle access to the function

[TABLE]

where $r$ is sampled uniformly for each oracle call. 3. 3.

Outcome: output $1$ if $\mathsf{Ver}_{k}(m,t)=\mathsf{acc}\wedge(m,t)\in B_{\epsilon}$; otherwise output [math].

Security is then defined as before: $\Pi$ is $\mathsf{sBU}$-secure if for all adversaries $\mathcal{A}$ (and their declared $\epsilon$), the success probability at winning the above game is negligible. Note that, for the case of canonical MACs, this definition coincides with Definition 5, just as $\mathsf{EUF\mbox{-}CMA}$ and $\mathsf{SUF\mbox{-}CMA}$ coincide in this case.

5 Intuitive security and the meaning of $\mathsf{BU}$

In this section, we gather a number of results which build confidence in $\mathsf{BU}$ as a satisfactory definition of unforgeability in our setting. We begin by showing that a wide range of “intuitively forgeable” MACs (indeed, all such examples we have examined) are correctly characterized by $\mathsf{BU}$ as insecure.

5.1 Intuitively forgeable schemes

As indicated earlier, $\mathsf{BU}$ security rules out any MAC schemes where an attacker can query a subset of the message space and forge outside that region. To make this claim precise, we first define the query support $\mathsf{supp}(\mathcal{A})$ of an oracle algorithm $\mathcal{A}$. Let $\mathcal{A}$ be a quantum query algorithm with oracle access to the quantum oracle $O$ for a classical function from $n$ to $m$ bits. Without loss of generality $\mathcal{A}$ proceeds by applying the sequence of unitaries $\mathcal{O}U_{q}\mathcal{O}U_{q-1}...U_{1}$ to the initial state $|0\rangle_{XYZ}$, followed by a POVM $\mathcal{E}$. Here, $X$ and $Y$ are the input and output registers of the function and $Z$ is the algorithm’s workspace. Let $|\psi_{i}\rangle$ be the intermediate state of of $\mathcal{A}$ after the application of $U_{i}$. Then $\mathsf{supp}(\mathcal{A})$ is defined to be the set of input strings $x$ such that there exists a function $f:\{0,1\}^{n}\to\{0,1\}^{m}$ such that $\langle x|_{X}|\psi_{i}\rangle\neq 0$ for at least one $i\in\{1,...,q\}$ when $\mathcal{O}=\mathcal{O}_{f}$.

Theorem 9**.**

Let $\mathcal{A}$ be a QPT such that $\mathsf{supp}(\mathcal{A})\cap R=\emptyset$ for some $R\neq\emptyset$. Let $\mathsf{Mac}$ be a MAC, and suppose $\mathcal{A}^{\mathsf{Mac}_{k}}(1^{n})$ outputs a valid pair $(m,\mathsf{Mac}_{k}(m))$ with $m\in R$ with non-negligible probability. Then $\mathsf{Mac}$ is not $\mathsf{BU}$-secure.

To prove Theorem 9, we will need the following theorem, which controls the change in the output state of an algorithm resulting from applying a blinding to its oracle. Given an oracle algorithm $\mathcal{A}$ and two oracles $F$ and $G$, the trace distance between the output of $\mathcal{A}$ with oracle $F$ and $\mathcal{A}$ with oracle $G$ is denoted by $\delta(\mathcal{A}^{F}(1^{n}),\mathcal{A}^{G}(1^{n}))$. Given two functions $F,P:\{0,1\}^{n}\to\{0,1\}^{m}$, we define the function $F\oplus P$ by $(F\oplus P)(x)=F(x)\oplus P(x)$.

Theorem 10**.**

Let $\mathcal{A}$ be a quantum query algorithm making at most $T$ queries, and $F:\{0,1\}^{n}\rightarrow\{0,1\}^{m}$ a function. Let $B\subseteq\{0,1\}^{n}$ be a subset chosen by independently including each element of $\{0,1\}^{n}$ with probability $\epsilon$, and $P:\{0,1\}^{n}\rightarrow\{0,1\}^{m}$ be any function with support $B$. Then

[TABLE]

The proof is a relatively straightforward hybrid argument in the spirit of the lower bound for Grover search [4]. We provide the complete proof in Appendix A.2. We are now ready to prove Theorem 9.

Proof of Theorem 9.

Let $\mathcal{A}$ be a quantum algorithm with $\mathsf{supp}(\mathcal{A})$ for any oracle. By our hypothesis,

[TABLE]

for some $c>0$ and sufficiently large $n$. Since $\mathsf{supp}(A)$ is a fixed set, we can think of sampling a random $B_{\varepsilon}$ as picking $B_{0}:=B_{\varepsilon}\cap\mathsf{supp}(A)$ and $B_{1}:=B_{\varepsilon}\cap\overline{\mathsf{supp}(A)}$ independently. Let “blind” denote the random experiment of $\mathcal{A}$ running on $\mathsf{Mac}_{k}$ blinded by a random $B_{\varepsilon}$: $k,B_{\varepsilon},(m,t)\leftarrow\mathcal{A}^{B_{\varepsilon}\mathsf{Mac}_{k}}(1^{n})$, which is equivalent to $k,B_{0},B_{1},(m,t)\leftarrow\mathcal{A}^{B_{0}\mathsf{Mac}_{k}}(1^{n})$. The probability that $\mathcal{A}$ wins the BU game is

[TABLE]

Here the second-to-last step follows from Theorem 10; in the last step, we chose $\varepsilon=(\tilde{p}/3T)^{2}$. We conclude that $\mathcal{A}$ breaks the $\mathsf{BU}$ security of the MAC. ∎

5.2 Relationship to other definitions

5.2.1 Classical $\mathsf{BU}$ is equivalent to $\mathsf{EUF\mbox{-}CMA}$

In the purely classical setting, our notion is equivalent to EUF-CMA. In the strong unforgeability case, this means $\mathsf{BU}$ with blinding on message-tag pairs, as described in Section 4.2.

Proposition 1**.**

A MAC is EUF-CMA if and only if it is blind-unforgeable against classical adversaries.

Proof.

Set $F_{k}=\mathsf{Mac}_{k}$. Consider an adversary $\mathcal{A}$ which violates EUF-CMA. Such an adversary, given $1^{n}$ and oracle access to $F_{k}$ (for $k\in_{R}\{0,1\}^{n}$), produces a forgery $(m,t)$ with non-negligible probability $s(n)$; in particular, $|m|\geq n$ and $m$ is not among the messages queried by $\mathcal{A}$. This same adversary (when coupled with an appropriate $\epsilon$) breaks the system under the blind-forgery definition. Specifically, let $p(n)$ be the running time of $\mathcal{A}$, in which case $\mathcal{A}$ clearly makes no more than $p(n)$ queries, and define $\epsilon(n)={1}/{p(n)}$. Consider now a particular $k\in\{0,1\}^{n}$ and a particular sequence $r$ of random coins for $\mathcal{A}^{F_{k}}(1^{n})$. If this run of $\mathcal{A}$ results in a forgery $(m,t)$, observe that with probability at least $(1-\epsilon)^{p(n)}\approx e^{-1}$ in the choice of $B_{\epsilon}$, we have $F_{k}(q)=B_{\epsilon}F_{k}(q)$ for every query $q$ made by $\mathcal{A}$. On the other hand, $B_{\epsilon}(m)=\bot$ with (independent) probability $\epsilon$. It follows $\phi(n,\epsilon_{n})$ is at least $\epsilon s(n)/e=\Omega(s(n)/p(n))$.

On the the other hand, suppose that $(\mathcal{A},\epsilon)$ is an adversary that breaks blind-unforgeability. Consider now the EUF-CMA adversary $\mathcal{A^{\prime}}^{F_{k}}(1^{n})$ which simulates the adversary $\mathcal{A}^{(\cdot)}(1^{n})$ by answering oracle queries according to a locally-simulated version of $B_{\epsilon}F_{k}$; specifically, the adversary $\mathcal{A^{\prime}}$ proceeds by drawing a subset $B_{\epsilon(n)}\subseteq\{0,1\}^{*}$ as described above and answering queries made by $\mathcal{A}$ according to $B_{\epsilon}F$. Two remarks are in order:

• •

When $x\in B_{\epsilon}$, this query is answered without an oracle call to $F(x)$.

• •

$\mathcal{A}^{\prime}$ can construct the set $B_{\epsilon}$ “on the fly,” by determining, when a particular query $q$ is made by $\mathcal{A}$, whether $q\in B_{\epsilon}$ and “remembering” this information in case the query is asked again (“lazy sampling”).

With probability $\phi(n,\epsilon(n))$ $\mathcal{A}$ produces a forgery on a point which was not queried by $\mathcal{A^{\prime}}$, as desired. It follows that $\mathcal{A}$ produces a (conventional) forgery with non-negligible probability when given $F_{k}$ for $k\in_{R}\{0,1\}^{n}$. ∎

5.2.2 $\mathsf{BU}$ implies $\mathsf{GYZ}$

In this section, we sketch how our new security notion, $\mathsf{BU}$, implies the one-time security notion put forward by Garg, Yuen and Zhandry [12]. We do this for unitary adversaries without loss of generality. We expect that the ideas carry over to the fully general case. For the special case we consider here, $\mathsf{GYZ}$ unforgeability can be defined as follows.

Definition 7** ($\mathsf{GYZ}$ unforgeability).**

Let $\Pi=(\mathsf{KeyGen},\mathsf{Mac},\mathsf{Ver})$ be a MAC. $\Pi$ is called $\varepsilon$-$\mathsf{GYZ}$-unforgeable, if for attack unitary $V_{MTB}$, there exists a simulator sub-unitary $W_{MTB}$444A matrix $V$ is sub-unitary if $V^{\dagger}V\leq\mathds{1}$. such that $\langle i|_{C}W|j\rangle_{C}=0$ for $i\neq j$ and for all initial states $|\psi\rangle_{MB}$

[TABLE]

where $U_{\mathsf{Mac},r,k}|m\rangle_{M}|y\rangle_{T}=|m\rangle_{M}|y\oplus\mathsf{Mac}_{r;k}(m)\rangle_{T}$ and

[TABLE]

is the projector onto the subspace of valid message-tag-pairs.

We are now ready to state the desired theorem. Here, $\delta$-1-$\mathsf{BU}$ denotes the one-time version of $\mathsf{BU}$ that allows for maximal adversarial advantage $\delta$, and similarly for $\delta^{\prime}$-$\mathsf{GYZ}$. The theorem is easiest proven using the measured version of $\mathsf{BU}$, $\mathsf{mBU}$.

Theorem 11**.**

Let $\Pi=(\mathsf{KeyGen},\mathsf{Mac},\mathsf{Ver})$ be unconditionally555Here, “unconditionally” means without any assumption on the computational complexity of the adversary. $\delta$-1-$\mathsf{mBU}$-secure. Then it is $16\delta$-$\mathsf{GYZ}$-unforgeable.

$\mathsf{mBU}$ implies $\mathsf{BU}$, so we immediately obtain the following

Corollary 3**.**

Let $\Pi=(\mathsf{KeyGen},\mathsf{Mac},\mathsf{Ver})$ be $\delta$-1-$\mathsf{BU}$-secure. Then it is $16\delta$-$\mathsf{GYZ}$-unforgeable.

For the proof of Theorem 11, we need the following lemma stating that an algorithm’s success probability does not degrade too much if some operation that never leaves a computational basis state unchanged is sandwiched between a blinding projector and its complement.

Lemma 3**.**

Let $\Pi^{(\varepsilon)}_{A}$ be the projector onto the subspace spanned by the computational basis states corresponding to strings in the blinding set $B_{\varepsilon}$ sampled as for the definition of $\mathsf{BU}$. Let further $M_{AB}$ be a matrix such that $\langle x|_{A}M|x\rangle_{A}=0$ for all $x$. Then for all $\rho\geq 0$

[TABLE]

where $\bar{\Pi}^{(\varepsilon)}_{A}=\mathds{1}-\Pi^{(\varepsilon)}_{A}$.

Proof.

Let

[TABLE]

and

[TABLE]

We calculate

[TABLE]

In the last three lines,

[TABLE]

is the computational basis pinching channel, we used the condition $\langle i|_{A}M|i\rangle_{B}=0$ so we can add these terms for free, and the second, third and fourth term arise because of the increase of the probability $\Pr\left[y,z\in B_{\varepsilon},x,t\notin B_{\varepsilon}\right]$ if $y=z$, $x=t$, or both. But the second, third and fourth term are positive semidefinite, so the claimed operator inequality follows. ∎

Proof of Theorem 11.

Let

[TABLE]

be an attack unitary that breaks $\delta^{\prime}$-$\mathsf{GYZ}$, and define the simulator sub-unitary

[TABLE]

to be the diagonal part of $V$. By assumption there exists a state $|\psi\rangle_{MB}$ such that

[TABLE]

Now we use the initial state $|\psi\rangle_{MB}|0\rangle_{T}$ and the unitary $V$ as attacker $\mathcal{A}$ for 1-$\mathsf{mBU}$: $\mathcal{A}$ queries the $\mathsf{mBU}$-type oracle for $\mathsf{Mac}_{k}$ on $|\psi\rangle_{MB}|0\rangle_{T}$, applies $V$, measures $MT$ and outputs the result. The success probability $p_{\mathrm{succ}}$ of this adversary can be lower bounded by the probability that the first measurement turns up “not blinded” and the adversary is successful. So for a fixed key $k$ and randomness $r$, and defining $\rho=|\phi\rangle\langle\phi|$ with $|\phi\rangle=\left(U_{\mathsf{Mac},r,k}\right)_{MT}|\psi\rangle_{MB}|0\rangle_{T}$ we get

[TABLE]

Here we have used the fact that $\Pi^{(\varepsilon)}_{M}W_{MTB}\bar{\Pi}^{(\varepsilon)}_{M}=0$ for all blinding sets in the second line, and Lemma 3 in the second-to-last line. Taking the expectation over $k$ and $r$ and using Equation (16), we arrive at

[TABLE]

Choosing $\epsilon=1/2$ we obtain

[TABLE]

∎

5.2.3 $\mathsf{BU}$ implies quadratic $\mathsf{PO}$

It is interesting to ask if $\mathsf{BU}$-security implies $\mathsf{PO}$-security, as the $\mathsf{PO}$ definition certainly captures a natural family of attacks that one would like to rule out. We are unable to settle this question completely, but provide some weaker connection. Specifically, we show that if a function is BU-secure, then it is $\mathsf{PO}$-secure with a weaker definition of $\mathsf{PO}$-security that forbids an adversary from producing $ck^{2}$ forgeries from $k$ queries with high probability.

For this purpose, consider a function $M:X\rightarrow Y$ and a $\mathsf{PO}$-type adversary $\mathcal{A}$ which, given oracle access to $M$, makes some $k$ queries and produces $ck^{2}$ forgeries (with probability 1); here $c\geq 1$ is a constant we set later in the discussion. We consider the behavior of this adversary $\mathcal{A}^{B_{\epsilon}M}$ supplied with an oracle $B_{\epsilon}M$ blinded at a random set $B_{\epsilon}$. We will show that for an appropriate value of $c$ and $\epsilon$, this adversary produces a family of forgeries which includes at least one blinded forgery with constant probability. Finally selecting one of these forgeries at random produces an adversary that breaks the BU security definition.

Returning to the $\mathsf{PO}$-adversary $\mathcal{A}$, we say that a particular blinding set $B$ is $\gamma$-evasive if

[TABLE]

(Note that this event is determined by running $\mathcal{A}$ with the unblinded oracle $M$.) Observing that

[TABLE]

We note that (by Markov’s inequality),

[TABLE]

Similarly, we say that a particular blinding set $B$ is $\gamma$-divergent if

[TABLE]

where $D_{M}$ is the distribution of outputs of $\mathcal{A}^{M}$ and $D_{BM}$ is the distribution of outputs of $\mathcal{A}^{BM}$ when $M$ is blinded on set $B$. In light of Theorem 1,

[TABLE]

and it follows by Markov’s inequality that

[TABLE]

Fixing $\gamma\leq 1/2-\delta$ for $\delta>0$, note that if $B$ is neither $\gamma$-evasive nor $\gamma$-divergent then

[TABLE]

(associated with the distribution $D_{M}$), and hence

[TABLE]

Finally, note that the probability that $B$ is $(1/2-\delta)$-evasive or $(1/2-\delta)$-divergent is no more than

[TABLE]

Then it is clear that one can choose the constants $\delta$ and $c$, and the blinding probability $\epsilon=\Theta(1/k^{2})$, so that this quantity is a constant bounded away from one. (For example, set $\delta=1/6$. Then, with $\epsilon=1/(144k^{2})$ the second term of $(\dagger)$ above is no more than $1/6$; setting $c=288$ guarantees the first term is likewise no more than $e^{-2}<1/6$ and the entire expression is a constant less than one. One can achieve better constants with more care, but the quadratic dependence on $\epsilon$ in Theorem 1 dictates the quadratic gap between $k$ and the number of forgeries achieved by this simple method of proof.)

Finally, we create a BU adversary for $M$ by running the $\mathsf{PO}$ adversary, blinded as above with $\epsilon=\Theta(1/k^{2})$, and selecting one of the $ck^{2}$ output values at random.

6 Blind-unforgeable schemes

6.1 Random schemes

We now show that suitable random and pseudorandom function families satisfy our notion of unforgeability.

Theorem 12**.**

Let $R:X\rightarrow Y$ be a uniformly random function such that $1/{|Y|}$ is negligible in $n$. Then $R$ is a blind-forgery secure MAC.

Proof.

For simplicity, we assume that the function is length-preserving; the proof generalizes easily. Let $\mathcal{A}$ be an efficient quantum adversary. The oracle $B_{\epsilon}R$ supplied to $\mathcal{A}$ during the blind-forgery game is determined entirely by $B_{\epsilon}$ and the restriction of $R$ to the complement of $B_{\epsilon}$. On the other hand, the forgery event

[TABLE]

depends additionally on values of $R$ at points in $B_{\epsilon}$. To reflect this decomposition, given $R$ and $B_{\epsilon}$ define $R_{\epsilon}:B_{\epsilon}\rightarrow Y$ to be the restriction of $R$ to the set $B_{\epsilon}$ and note that—conditioned on $B_{\epsilon}R$ and $B_{\epsilon}$—the random variable $R_{\epsilon}$ is drawn uniformly from the space of all (length-preserving) functions from $B_{\epsilon}$ into $Y$. Note, also, that for every $n$ the purported forgery $(m,t)\leftarrow\mathcal{A}^{B_{\epsilon}R}(1^{n})$ is a (classical) random variable depending only on $B_{\epsilon}R$. In particular, conditioned on $B_{\epsilon}$, $(m,t)$ is independent of $R_{\epsilon}$. It follows that, conditioned on $m\in B_{\epsilon}$, that $t=R_{\epsilon}(m)$ with probability no more than $1/2^{n}$ and hence $\phi(n,\epsilon)\leq 2^{-n}$, as desired. ∎

Next, we show that a $\mathsf{qPRF}$ is a blind-unforgeable MAC.

Corollary 4**.**

Let $m$ and $t$ be $\poly(n)$, and $F:\{0,1\}^{n}\times\{0,1\}^{m}\rightarrow\{0,1\}^{t}$ a $\mathsf{qPRF}$. Then $F$ is a blind-forgery-secure fixed-length MAC (with length $m(n)$).

Proof.

For a contradiction, let $\mathcal{A}$ be a QPT which wins the blind forgery game for a certain blinding factor $\varepsilon(n)$, with running time $q(n)$ success probability $\delta(n)$. We will use $\mathcal{A}$ to build a quantum oracle distinguisher $\mathcal{D}$ between the $\mathsf{qPRF}$ $F$ and the perfectly random function family $\mathcal{F}_{m}^{t}$ with the same domain and range.

First, let $k=q(n)$ and let $\mathcal{H}$ be a family of $(4k+1)$-wise independent functions with domain $\{0,1\}^{m}$ and range $\{0,1,\dots,1/\varepsilon(n)\}$. The distinguisher $\mathcal{D}$ first samples $h\in_{R}\mathcal{H}$. Set $B_{h}:=h^{-1}(0)$. Given its oracle $\mathcal{O}_{f}$, $\mathcal{D}$ can implement the function $B_{h}f$ (quantumly) as follows:

[TABLE]

Here we used the CCNOT (Toffoli) gate from step 2 to 3 (with one control bit reversed), and uncomputed both $h$ and $f$ in the last step. After sampling $h$, the distinguisher $\mathcal{D}$ will execute $\mathcal{A}$ with the oracle $B_{h}f$. If $\mathcal{A}$ successfully forges a tag for a message in $B_{h}$, $\mathcal{A}^{\prime}$ outputs “pseudorandom”; otherwise “random.”

Note that the function $B_{h}f$ is perfectly $\epsilon$-blinded if $h$ is a perfectly random function. Note also that the entire security experiment with $\mathcal{A}$ (including the final check to determine if the output forgery is blind) makes at most $2k$ quantum queries and $1$ classical query to $h$, and is thus (by Theorem 8) identically distributed to the perfect-blinding case.

Finally, by Theorem 12, the probability that $\mathcal{D}$ outputs “pseudorandom” when $f\in_{R}\mathcal{F}_{m}^{t}$ is negligible. By our initial assumption about $\mathcal{A}$, the probability that $\mathcal{D}$ outputs “pseudorandom” becomes $\delta(n)$ when $f\in_{R}F$. It follows that $\mathcal{D}$ distinguishes $F$ from perfectly random. ∎

Next, we give a information-theoretically secure $q$-time MACs (Definition 6).

Theorem 13**.**

Let $\mathcal{H}$ be a $(4q+1)$-wise independent function family with range $Y$, such that $1/|Y|$ is a negligible function. Then $\mathcal{H}$ is a $q$-time BU-secure MAC.

Proof.

Let $(\mathcal{A},\epsilon)$ be an adversary for the $q$-time game $\mathsf{BlindForge}^{q}_{\mathcal{A},h}(n,\epsilon(n))$, where $h$ is drawn from $\mathcal{H}$. We will use $\mathcal{A}$ to construct a distinguisher $\mathcal{D}$ between $\mathcal{H}$ and a random oracle. Given access to an oracle $\mathcal{O}$, $\mathcal{D}$ first runs $\mathcal{A}$ with the blinded oracle $B\mathcal{O}$, where the blinding operation is performed as in the proof of Corollary 4 (i.e., via a $(4q+1)$-wise independent function with domain size $1/\epsilon(n)$). When $\mathcal{A}$ is completed, it outputs $(m,\sigma)$. Next, $\mathcal{D}$ queries $\mathcal{O}$ on the message $m$ and outputs 1 if and only if $\mathcal{O}(m)=\sigma$ and $m\in B$. Let $\gamma_{\mathcal{O}}$ be the probability of the output being 1.

We consider two cases: (i.) $\mathcal{O}$ is drawn as a random oracle $R$, and (ii.) $\mathcal{O}$ is drawn from the family $\mathcal{H}$. By Theorem 8, since $\mathcal{D}$ makes only $2q$ quantum queries and one classical query to $\mathcal{O}$, its output is identical in the two cases. Observe that $\gamma_{R}$ (respectively, $\gamma_{\mathcal{H}}$) is exactly the success probability of $\mathcal{A}$ in the blind-forgery game with random oracle $R$ (respectively, $\cal H$). We know from Theorem 12 that $\gamma_{R}$ is negligible; it follows that $\gamma_{\mathcal{H}}$ is as well. ∎

Several domain-extension schemes, including NMAC (a.k.a. encrypted cascade), HMAC, and AMAC, can transform a fixed-length $\mathsf{qPRF}$ to a $\mathsf{qPRF}$ that takes variable-length inputs [22] . As a corollary, starting from a $\mathsf{qPRF}$, we also obtain a number of quantum blind-unforgeable variable-length MACs.

6.2 Lamport one-time signatures

The Lamport signature scheme [17] is a EUF-1-CMA-secure signature scheme, specified as follows.

Construction 2** (Lamport signature scheme, [17]).**

For the Lamport signature scheme using a hash function family $h:\{0,1\}^{n}\times\{0,1\}^{n}\to\{0,1\}^{n}$, the algorithms $\mathsf{KeyGen},\mathsf{Sign}$ and $\mathsf{Ver}$ are specified as follows. $\mathsf{KeyGen}$, on input $1^{n}$, outputs a pair $(\pk,\sk)$ with

[TABLE]

The signing algorithm is defined by $\mathsf{Sign}_{\sk}(x)=(s_{i}^{x_{i}})_{i\in\{1,...,n\}}$ where $x_{i}$, $i=1,...,n$ are the bits of $x$. The verification procedure checks the signature’s consistency with the public key, i.e., $\mathsf{Ver}_{\pk}(x,s)=0$ if $p_{i}^{x_{i}}=h_{k}(s_{i})$ and $\mathsf{Ver}_{\pk}(x,s)=0$ otherwise.

We now show that the Lamport scheme is 1-$\mathsf{BU}$ secure in the quantum random oracle model.

Theorem 14**.**

Construction 2* is 1-$\mathsf{BU}$ secure if $h$ is modeled as a quantum-accessible random oracle.*

Proof.

We implement the random oracle $h$ as a superposition oracle with register $F$. In the 1-$\mathsf{BlindForge}$ experiment we execute the sampling part of the key generation by preparing a superposition as well. More precisely, we can just prepare $2n$ $n$-qubit registers $S_{i}^{j}$ in a uniform superposition, with the intention of measuring them to sample $s_{i}^{j}$ in mind. We are talking about a classical one-time signature scheme, and all computation that uses the secret key is done by an honest party, and is therefore classical. It follows that the measurement that samples $s_{i}^{j}$ commutes with all other operations which are implemented as quantum-controlled operations controlled on the secret key registers, i.e., we can postpone it to the very end of the 1-$\mathsf{BlindForge}$ experiment, just like the measurement that samples an actual random oracle using a superposition oracle. The joint state $|\psi_{0}\rangle$ with oracle register F and secret key register $S\!K=(S_{i}^{j})_{i\in\{1,...,n\},j=0,1}$ is now in a uniform superposition, i.e.,

[TABLE]

To subsequently generate the public key, the superposition oracle for $h$ is queried on each of the $S_{i}^{j}$ with an empty outrput register $P_{i}^{j}$, producing the state $|\psi_{1}\rangle_{S\!KP\!KF}$ equal to

[TABLE]

where $|f_{\sk,\pk}\rangle_{F}$ is the superposition oracle state where $F_{s_{i}^{j}}$ is in state $|p_{i}^{j}\rangle$ and all other registers are still in state $|\phi_{0}\rangle$. Then the registers $P_{i}^{j}$ are measured to produce an actual, classical, public key that can be handed to the adversary. Note that there is no hash function key $k$ now, as it has been replaced by the random oracle. Treating the public key as classical information from now on and removing the registers $P\!K$, the state takes the form

[TABLE]

Now the interactive phase of the 1-$\mathsf{BlindForge}$ experiment can begin, and we provide both the random oracle $h$ and the signing oracle (that can be called exactly once) as superposition oracles using the joint oracle state $|\psi_{2}(\pk)\rangle$ above. The random oracle answers queries as described in Section 3.3. The signing oracle, when queried with registers $XZ$ with $Z=Z_{1}...Z_{n}$, applies $\mathrm{CNOT}^{\otimes n}_{S_{i}^{x_{i}}:Z_{i}}$, $i=1,...,n$ controlled on $X$ being in the state $x\notin B_{\varepsilon}$.

Now suppose $\mathcal{A}$, after making at most one query to $\mathsf{Sign}$ and an arbitrary polynomial number of queries to $h$, outputs a candidate message signature pair $(x^{0},z^{0})$ with $z^{0}=z^{0}_{1}\|\cdots\|z^{0}_{n}$. If $x^{0}\notin B_{\varepsilon}$, $\mathcal{A}$ has lost. Suppose therefore that $x^{0}\in B_{\varepsilon}$. We will now make a measurement on the oracle register to find an index $i$ such that $S_{i}^{x^{0}_{i}}$ has not been queried. To this end we first need to decorrelate $S\!K$ and $F$. This is easily done, as the success test only needs computational basis measurement results from the register $S\!K$, allowing us to perform any controlled operation on $F$ controlled on $S\!K$. Therefore we can apply the operation $\bigoplus p_{i}^{j}$ followed by $H^{\otimes n}$ to the register $F_{s_{i}^{j}}$ controlled on $S_{i}^{j}$ being in state $|s_{i}^{j}\rangle$, for all $i=1,...,n$ and $j=0,1$. For an adversary that does not make any queries to $h$, this has the effect that all $F$-registers are in state $|\phi_{0}\rangle$ again now.

We can equivalently perform this restoring procedure before the adversary starts interaction, and answer the adversary’s $h$-queries as follows. Controlled on the adversary’s input being equal to one of the parts $s_{i}^{j}$ of the secret key, answer with the corresponding public key, otherwise use the superposition oracle for $h$.

For any fixed secret key register $S_{i}^{j}$, the unitary that is applied upon an $h$-query can hence be written as

[TABLE]

where $U_{\bot}$ acts trivially on $S_{i}^{j}$ and the second equality follows because the unitaries $U_{\bot}$ and $U_{x}$ are controlled unitaries with $X$ and $S_{i}^{j}$ part of the control register. Using the above equation we derive a bound on the operator norm of the commutator of this unitary and the projector onto $|\phi_{0}\rangle$,

[TABLE]

where the second equality follows again because $U_{\bot}$ and $U_{x}$ are controlled unitaries with $X$ and $S_{i}^{j}$ part of the control register.

It follows that a query to $h$ does not decrease the number of registers $S_{i}^{j}$ that are in state $|\phi_{0}\rangle$, except with negligible amplitude.

As we assume that $x^{0}$ is blinded, we have that for any message $x\notin B_{\varepsilon}$, there exists an $i\in\{1,...,n\}$ such that $x_{i}\neq x^{0}_{i}$. But $\mathcal{A}$ interacts with a blinded signing oracle, i.e., controlled on his input being not blinded, it is forwarded to the signing oracle, otherwise $\bot$ is XORed into his output register. Therefore only non-blinded queries have been forwarded to the actual signing oracle, so the final state is a superposition of states in which the register $S\!K$ has at least $n$ subregisters $S_{i}^{j}$ are in state $|\phi_{0}\rangle$, and at least one of them is such that $x^{0}_{i}=j$. We can therefore apply an $n$-outcome measurement to the oracle register to obtain an index $i_{0}$ such that $S_{i_{0}}^{x^{0}_{i_{0}}}$ is in state $|\phi_{0}\rangle$. By Lemma 1, this implies that $\mathcal{A}$’s forgery is independent of $s_{i_{0}}$, so $\mathcal{A}$’s probability of succeeding in $\mathsf{BlindForge}$ is negligible. ∎

A simple proof of the $\mathsf{PO}$-security of a random function can be given using a similar idea, see Theorem 20 in the appendix.

6.3 Hash-and-MAC

To authenticate messages of arbitrary length with a fixed-length MAC, it is common practice to first compress a long message by a collision-resistant hash functon and then apply the MAC. This is known as Hash-and-MAC. However, when it comes to $\mathsf{BU}$-security, collision-resistance may not be sufficient. We therefore propose a new notion, Bernoulli-preserving hash, generalizing collision-resistance in the quantum setting, and show that it is sufficient for Hash-and-MAC with $\mathsf{BU}$ security. Recall that, given a subset $B$ of a set $X$, $\chi_{B}:X\to\{0,1\}$ denotes the characteristic function of $B$.

Definition 8** (Bernoulli-preserving hash).**

Let $\mathcal{H}:X\to Y$ be an efficiently computable function family. Define the following distributions on subsets of $X$:

$\mathcal{B}_{\epsilon}$* : generate $B_{\epsilon}\subseteq X$ by placing $x\in B_{\epsilon}$ independently with probability $\epsilon$. Output $B_{\epsilon}$.* 2. 2.

$\mathcal{B}_{\epsilon}^{\mathcal{H}}$* : generate $C_{\epsilon}\subseteq Y$ by placing $y\in C_{\epsilon}$ independently with probability $\epsilon$. Sample $h\in\mathcal{H}$ and define $B_{\epsilon}^{h}:=\{x\in X:h(x)\in C_{\epsilon}\}$. Output $B_{\epsilon}^{h}$.*

We say that $\mathcal{H}$ is a Bernoulli-preserving hash if for all adversaries $(\mathcal{A},\epsilon)$,

[TABLE]

The motivation for the name Bernoulli-preserving hash is simply that selecting $\mathcal{B}_{\epsilon}$ can be viewed as a Bernoulli process taking place on the set $X$, while $\mathcal{B}_{\epsilon}^{h}$ can be viewed as the pullback (along $h$) of a Bernoulli process taking place on $Y$.

We show that the standard, so-called “Hash-and-MAC” construction will work w.r.t. to $\mathsf{BU}$ security, if we instantiate the hash funtion with a Bernoulli-preserving hash. Recall that, given a MAC $\Pi=(\mathsf{Mac}_{k},\mathsf{Ver}_{k})$ with message set $X$ and a function $h:Z\to X$, there is a MAC $\Pi^{h}:=(\mathsf{Mac}_{k}^{h},\mathsf{Ver}_{k}^{h})$ with message set $Z$ defined by $\mathsf{Mac}_{k}^{h}=\mathsf{Mac}_{k}\circ h$ and $\mathsf{Ver}_{k}^{h}(m,t)=\mathsf{Ver}_{k}(h(m),t)$.

Theorem 15** (Hash-and-MAC with Bernoulli-preserving hash).**

Let $\Pi=(\mathsf{Mac}_{k},\mathsf{Ver}_{k})$ be a $\mathsf{BU}$-secure MAC with $\mathsf{Mac}_{k}:X\to Y$, and let $h:Z\to X$ a Bernoulli-preserving hash. Then $\Pi^{h}$ is a $\mathsf{BU}$-secure MAC.

Proof.

Let $\mathcal{A}$ be an adversary against $\Pi^{h}$. We build an adversary $\mathcal{A}_{0}$ against $\Pi$ which (given oracle $f:X\to Y$) runs $\mathcal{A}$ and answers its queries with $f\circ h$, i.e., $|m\rangle|t\rangle\mapsto|m\rangle|t\oplus f(h(m))\rangle$. This can be implemented by first computing $h$ into an extra register, then invoking the oracle, and then uncomputing $h$. When $\mathcal{A}$ produces its final output $(m,t)$, $\mathcal{A}_{0}$ outputs $(h(m),t)$ and terminates. We claim that

[TABLE]

Since the right-hand-side of the difference above is negligible by $\mathsf{BU}$-security of $\Pi$, establishing the claim will finish the proof.

We prove the claim by showing that the difference can be viewed as the success probability of a distinguisher $\mathcal{D}$ against the Bernoulli-preserving property of $h$. The distinguisher $\mathcal{D}$ receives an oracle for $\chi_{B}$ (where $B\subseteq Z$ is sampled according to either $\mathcal{B}_{\epsilon}$ or $\mathcal{B}^{h}_{\epsilon}$) and proceeds as follows:

generate a key $k$ for $\Pi$; 2. 2.

run $\mathcal{A}$, answering its oracle queries with

[TABLE]

where we invoked the oracle in the first step and CCNOT in the second; 3. 3.

when $\mathcal{A}$ outputs $(m,t)$, compute $b=\mathsf{Ver}^{h}_{k}(m,t)=\mathsf{Ver}_{k}(h(m),t)$. Query the oracle to compute $b^{\prime}=\chi_{B}(m)$, and output $b\wedge b^{\prime}$.

It now remains to check that (i.) if $B$ was sampled according to $\mathcal{B}_{\epsilon}$ (i.e., uniform blinding), then $\mathcal{D}$ is simulating the game $\mathsf{BlindForge}_{\mathcal{A},\Pi^{h}}(n,\epsilon)$, and (ii.) If $B$ was sampled according to $\mathcal{B}_{\epsilon}^{h}$ (i.e., hash-blinding), then $\mathcal{D}$ is simulating the game $\mathsf{BlindForge}_{\mathcal{A}_{0},\Pi}(n,\epsilon)$. Fact (i.) follows directly from the definition666Note that we have again used the convention that the blinding symbol $\bot$ is the string $0\dots 01$; in our case, the final bit corresponds to the register containing $\chi_{B}(m)$. If one chooses a different convention, it may be necessary to adjust $\mathcal{D}$ to uncompute that register with an extra call to the oracle. of the $\mathsf{BlindForge}$ game. To see fact (ii.), observe that the $\mathsf{BlindForge}$ game against $\mathcal{A}_{0}$ samples a uniform blinding set $C_{\epsilon}\subseteq X$ and executes algorithm $\mathcal{A}$ with oracle

[TABLE]

precisely as in the execution of $\mathcal{A}$ by $\mathcal{D}$. ∎

In the next section, we provide a number of additional results about Bernoulli-preserving hash functions.

7 Properties of Bernoulli-preserving hash functions

We explore the notion of Bernoulli-preserving hash functions. These results can be summarized as follows.

• •

If $H$ is a random oracle or a $\mathsf{qPRF}$, then it is a Bernoulli-preserving hash.

• •

If $H$ is $4q$-wise independent, then it is a Bernoulli-preserving hash against $q$-query adversaries.

• •

Under the $\mathsf{LWE}$ assumption, there is a (public-key) family of Bernoulli-preserving hash functions.

• •

If we only allow classical oracle access, then the Bernoulli-preserving property is equivalent to standard collision-resistance.

• •

Bernoulli-preserving hash functions are collapsing (another quantum generalization of collision-resistance proposed in [25]).

First, we show that random and pseudorandom functions are Bernoulli-preserving, and that this property is equivalent to collision-resistance against classical queries.

Lemma 4**.**

Let $H:X\to Y$ be a function such that $1/|Y|$ is negligible. Then:

If $H$ is a random oracle or a $\mathsf{qPRF}$, then it is a Bernoulli-preserving hash. 2. 2.

If $H$ is $4q$-wise independent, then it is a Bernoulli-preserving hash against $q$-query adversaries.

Proof.

The claim for random oracles is obvious: by statistical collision-resistance, uniform blinding is statistically indistinguishable from hash-blinding. The remaining claims follow from the observation that one can simulate one quantum query to $\chi_{B_{\epsilon}^{h}}$ using two quantum queries to $h$ (see, e.g., the proof of Corollary 4). ∎

Theorem 16**.**

A function $h:\{0,1\}^{*}\to\{0,1\}^{n}$ is Bernoulli-preserving against classical-query adversaries if and only if it is collision-resistant.

Proof.

First, the Bernoulli-preserving hash property implies collision-resistance: testing whether two colliding inputs are either (i.) both not blinded or both blinded, or (ii.) exactly one of them is blinded, yields always outcome (i.) when dealing with a hash-blinded oracle and a uniformly random outcome for a blinded oracle and $\varepsilon=1/2$. On the other hand, consider an adversary $\mathcal{A}$ that has inverse polynomial distinguishing advantage between blinding and hash-blinding, and let $x_{1},...,x_{q}$ be it’s queries. Assume for contradiction that with overwhelming probability $h(x_{i})\neq h(x_{j})$ for all $x_{i}\neq x_{j}$. Then with that same overwhelming probability the blinded and hash blinded oracles are both blinded independently with probability $\varepsilon$ on each $x_{i}$ and are hence statistically indistinguishable, a contradiction. It follows that with non-negligible probability there exist two queries $x_{i}\neq x_{j}$ such that $h(x_{i})=h(x_{j})$, i.e., $\mathcal{A}$ has found a collision. ∎

7.1 A Bernoulli-preserving hash from LWE

We have observed that any $\mathsf{qPRF}$ is a Bernoulli-preserving hash function, which can be constructed from various quantum-safe computational assumpiton (e.g., LWE). Nonetheless, $\mathsf{qPRF}$ typically does not give short digest, which would result in long tags, and it requires a secret key.777In practice, it is probably more convenient (and more reliable) to instantiate a $\mathsf{qPRF}$ from block ciphers, which may not be ideal for message authentication.

Here we point out an alternative construction of a public Bernoulli-preserving hash function based on the quantum security of LWE. In fact, we show that the collapsing hash function by Unruh [24] is also Bernoulli-preserving hash. This constructions relies on a lossy function family $F:X\to Y$ and a universal hash function $G=\{g_{k}:Y\to Z\}_{k\in\mathcal{K}}$. A lossy function family admits two types of keys: a lossy key $s\leftarrow\mathcal{D}_{\mathrm{los}}$ and an injective key $s\leftarrow\mathcal{D}_{inj}$, which are computationally indistinguishable. $F_{s}:X\to Y$ under a lossy key $s$ is compressing, i.e., $|\operatorname{im}(F_{s})|\ll|Y|$; whereas under an injective key $s$, $F_{s}$ is injective. We refer a formal definition to [24, Definition 2], and an explicit construction based on LWE to [18]. We will also use exist efficient constructions for universal hash families [26]. Then one constructs a hash funciton family $H=\{h_{s,k}\}$ by $h_{s,k}:=g_{k}\circ F_{s}$ with public parameters generated by $s\leftarrow\mathcal{D}_{\mathrm{los}},k\leftarrow\mathcal{K}$.

The proof of Bernoulli-preserving for this hash function is similar to Unruh’s proof that $H$ is collapsing. We begin with a lemma.

Lemma 5**.**

Any injective function $f$ is Bernoulli-preserving hash. Given any Bernoulli-preserving hash $f:X\to Y$ and $g:Y\to Z$ that is Bernoulli-preserving hash on $\operatorname{im}(f)$, then $h=g\circ f$ is also Bernoulli-preserving hash.

Proof.

The first part follows by observing that a $\varepsilon$-random subset in the codomain corresponds exactly to a $\varepsilon$-random subset in the domain under inverse of the function. Let $\mathcal{O}\approx\mathcal{O}^{\prime}$ denote that two oracles $\mathcal{O}$ and $\mathcal{O}$ are indistinguishable by any quantum poly-time algorithm. For the second part, we need to show that $\chi_{C:C\leftarrow_{\varepsilon}X}\approx\chi_{C:C=h^{-1}(C_{Z}),C_{Z}\leftarrow_{\varepsilon}Z}$, where $\leftarrow_{\varepsilon}$ indicates sampling a random subset of fraction $\varepsilon$. Since $f$ is Bernoulli-preserving hash, we have that

[TABLE]

The second equivalence holds by observing that for any $C_{Y}\subseteq Y$, $f^{-1}(C_{Y})=f^{-1}(C_{Y}\cap\operatorname{im}(f))$. Then because $g$ is Bernoulli-preserving on $\operatorname{im}(f)$,

[TABLE]

Therefore, we conclude that

[TABLE]

Theorem 17**.**

$H$* is Bernoulli-preserving hash if LWE holds against any efficient quantum distinguisher.*

Proof.

We proceed in three steps (with the help of Lemma 5 above):

Since $F_{s}$ is injective under an injective key, it is clearly Bernoulli-preserving hash. As a result, $F_{s},s\leftarrow\mathcal{D}_{\mathrm{los}}$ must be Bernoulli-preserving hash too, because a lossy key is indistinguishable from an injective key by definition. 2. 2)

Then $g_{k}$ is chosen properly so that it is injective when restricted to $\operatorname{im}(F_{s})$ of lossy key $s$. Therefore $g_{k}$ is Bernoulli-preserving hash too. 3. 3)

Finally, $H_{k,s}$ is Bernoulli-preserving hash by the composition of Bernoulli-preserving hash functions $g_{k}$ and $F_{s}$.

∎

7.2 Relationship to collapsing

Here we relate Bernoulli-preserving hash to the collapsing property, which is another quantum generalization of classical collision-resistance. We first describe the collapsing property (slightly adapting Unruh’s original definition [25]) as follows. Let $h:X\to Y$ be a hash function, and let $\mathcal{S}_{X}$ and $\mathcal{S}_{XY}$ be the set of quantum states (i.e., density operators) on registers corresponding to the sets $X$ and $X\times Y$, respectively. We define two channels from $\mathcal{S}_{X}$ to $\mathcal{S}_{XY}$. First, $\mathcal{O}_{h}$ receives $X$, prepares $|0\rangle$ on $Y$, applies $|x\rangle|y\rangle\mapsto|x\rangle|y\oplus h(x)\rangle$, and then measures $Y$ fully in the computational basis. Second, $\mathcal{O}^{\prime}_{h}$ first applies $\mathcal{O}_{h}$ and then also measures $X$ fully in the computational basis.

[TABLE]

If the input is a pure state on $X$, then the output is either a superposition over a fiber $h^{-1}(s)\times\{s\}$ of $h$ (for $\mathcal{O}_{h}$) or a classical pair $(x,h(x))$ (for $\mathcal{O}_{h}^{\prime}$) .

Definition 9** (Collapsing).**

A hash function $h$ is collapsing if for any single-query QPT $\mathcal{A}$, it holds that \bigl{|}\Pr[\mathcal{A}^{\mathcal{O}_{h}}(1^{n})=1]-\Pr[\mathcal{A}^{\mathcal{O}_{h}^{\prime}}(1^{n})=1]\bigr{|}\leq\negl\,.

To prove that Bernoulli-preserving hash implies collapsing, we need a technical fact. Recall that any subset $S\subseteq\{0,1\}^{n}$ is associated with a two-outcome projective measurement $\{\Pi_{S},\mathds{1}-\Pi_{S}\}$ on $n$ qubits defined by $\Pi_{S}=\sum_{x\in S}|x\rangle\langle x|$. We will write $\Xi_{S}$ for the channel (on $n$ qubits) which applies this measurement.

Lemma 6**.**

*Let $S_{1},S_{2},\dots,S_{cn}$ be subsets of $\{0,1\}^{n}$, each of size $2^{n-1}$, chosen independently and uniformly at random. Let $\Xi_{S_{j}}$ denote the two-outcome measurement defined by $S_{j}$, and denote their composition $\tilde{\Xi}:=\Xi_{S_{cn}}\circ\Xi_{S_{cn-1}}\circ\cdots\circ\Xi_{S_{1}}$. Let $\Xi$ denote the full measurement in the computational basis. Then

\Pr\bigl{[}\tilde{\Xi}=\Xi\bigr{]}\geq 1-2^{-\varepsilon n}\,, whenever $c\geq 2+\varepsilon$ with $\varepsilon>0$,*

Proof.

We give a combinatorial proof. Consider an arbitrary mixed state of density matrix $\rho=(\rho_{x,y})_{x,y\in\{0,1\}^{n}}$, the full measurement $\Xi$ on $\rho$ gives

[TABLE]

Given a set $S\subseteq\{0,1\}^{n}$, the projective measurement $\Xi_{S}$ on $\rho$ operates as

[TABLE]

Namely, $\Xi_{S}$ will zero-out the entries $\rho_{x,y}$ in $\rho$, where $(x\in S,y\notin S)$ or $(x\notin S,y\in S)$. It is easy to verify that the same effect occurs when $\Xi$ and $\Xi_{S}$ are applied to a subsystem of a bipartite state.

Now, for any $c=2+\varepsilon$ with $\varepsilon>0$, consider sampling $S_{1},S_{2},\ldots,S_{cn}$ independently at random, each of size $2^{n-1}$, and define a few random events:

[TABLE]

Observe that if BAD does not occur, it implies that for any $x\neq y$, the off-diagonal entry $\rho_{x,y}$ is eliminated by one of $\Xi_{S_{i}}$, and as a result $\tilde{\Xi}=\Xi_{S_{cn}}\circ\ldots\circ\Xi_{S_{1}}$ will be identical to $\Xi$.

Fix a pair $(x,y)$ with $x\neq y$, clearly $\Pr[E^{i}_{x,y}]=1/2$. Since each $S_{i}$ is chosen independently,

[TABLE]

By the union bound,

[TABLE]

Therefore we conclude that

[TABLE]

We remark that to efficiently implement each $\Xi_{S}$ with a random subset $S$, we can sample $h_{i}:[M]\to[N]$ from a pairwise-independent hash family (sampling an independent $h_{i}$ for each $i$), and then define $x\in S$ iff $h(x)\leq N/2$. For any input state $\sum_{x,z}\alpha_{x,z}|x,z\rangle$, we can compute

[TABLE]

and then measure $|b(x)\rangle$. Pairwise independence is sufficient by Theorem 8 because only one quantum query is made.

Theorem 18**.**

If $h:X\to Y$ is Bernoulli-preserving, then it is collapsing.

Proof.

Let $\mathcal{A}$ be an adversary with inverse-polynomial distinguishing power in the collapsing game. Choose $n$ such that $X=\{0,1\}^{n}$. We define $k=cn$ hybrid oracles $H_{0},H_{1},\dots,H_{k}$, where hybrid $H_{j}$ is a channel from $\mathcal{S}_{X}$ to $\mathcal{S}_{XY}$ which acts as follows: (1.) adjoin $|0\rangle_{Y}$ and apply the unitary $|x\rangle_{X}|y\rangle_{Y}\mapsto|x\rangle_{X}|y\oplus h(x)\rangle_{Y}$; (2.) measure the $Y$ register in the computational basis; (3.) repeat $j$ times: (i.) select a uniformly random subset $S\subseteq X$ of size $2^{n-1}$; (ii.) apply the two-outcome measurement $\Xi_{S}$ to the $X$ register; (4.) output registers $X$ and $Y$.

Clearly, $H_{0}$ is identical to the $\mathcal{O}_{h}$ channel in the collapsing game. By Lemma 6, $H_{k}$ is indistinguishable from the $\mathcal{O}_{h}^{\prime}$. By our initial assumption and the triangle inequality, there exists a $j$ such that

[TABLE]

We now build a distinguisher $\mathcal{D}$ against the Bernoulli-preserving property (with $\epsilon=1/2$) of $h$. It proceeds as follows: (1.) run $\mathcal{A}(1^{n})$ and place its query state in register $X$; (2.) simulate oracle $H_{j}$ on $XY$ (use 2-wise independent hash to select sets $S$); (3.) prepare an extra qubit in the $|0\rangle$ state in register $W$, and invoke the oracle for $\chi_{B}$ on registers $X$ and $W$; (4.) measure and discard register $W$; (5.) return $XY$ to $\mathcal{A}$, and output what it outputs.

We now analyze $\mathcal{D}$. After the first two steps of $H_{j}$ (compute $h$, measure output register) the state of $\mathcal{A}$ (running as a subroutine of $\mathcal{D}$) is given by

[TABLE]

Here $Z$ is a side information register private to $\mathcal{A}$. Applying the $j$ measurements (third step of $H_{j}$) results in a state of the form $\sum_{z}\sum_{x\in M}\beta_{xz}|x\rangle|s\rangle|z\rangle\,,$ where $M$ is a subset of $h^{-1}(s)$. Applying the oracle for $\chi_{B}$ into an extra register now yields

[TABLE]

Now consider the two cases of the Bernoulli-preserving game.

First, in the “hash-blinded” case, $B=h^{-1}(C)$ for some set $C\subseteq Y$. This implies that $\chi_{B}(x)=\chi_{C}(h(x))=\chi_{C}(s)$ for all $x\in M$. It follows that $W$ simply contains the classical bit $\chi_{C}(s)$; computing this bit, measuring it, and discarding it will thus have no effect. The state returned to $\mathcal{A}$ will then be identical to the output of the oracle $H_{j}$. Second, in the “uniform blinding” case, $B$ is a random subset of $X$ of size $2^{n-1}$, selected uniformly and independently of everything else in the algorithm thus far. Computing the characteristic function of $B$ into an extra qubit and then measuring and discarding that qubit implements the channel $\Xi_{B}$, i.e., the measurement $\{\Pi_{B},\mathds{1}-\Pi_{B}\}$. It follows that the state returned to $\mathcal{A}$ will be identical to the output of oracle $H_{j+1}$.

By (30), it now follows that $\mathcal{D}$ is a successful distinguisher in the Bernoulli-preserving hash game for $h$. Hence $h$ is not a Bernoulli-preserving hash. ∎

8 The problem with $\mathsf{PO}$-unforgeability

Our search for a new definition of unforgeability for quantum-secure authentication is partly motivated by concerns about the $\mathsf{PO}$ security notion [6]. In this section, we make these concerns concrete by pointing out a significant security concern not addressed by this definition. Specifically, we demonstrate a MAC which is readily broken with an efficient attack, and yet is $\mathsf{PO}$ secure. The attack queries the MAC with a superposition over a particular subset $S$ of the message space, and then forges a valid tag for a message lying outside $S$.

One of the intuitive issues with $\mathsf{PO}$ is that it might rule out adversaries that have to measure, and thereby destroy, one or more post-query states to produce an interesting forgery. Constructing such an example seems not difficult at first. For instance, let us look at one-time $\mathsf{PO}$, and construct a MAC from a $\mathsf{qPRF}$ $f$ by sampling a key $k$ for $f$ and a superpolynomially-large prime $p$, and setting

[TABLE]

This MAC is forgeable: a quantum adversary can use a single query to perform period-finding on the MAC, and then forge at $0^{n}$. Intuitively, it seems plausible that the MAC is $1$-$\mathsf{PO}$ secure as period-finding uses a full measurement. This is incorrect for a somewhat subtle reason: identifying the hidden symmetry does not necessarily consume the post-query state completely, so an adversary can learn the period and a random input-output-pair of the MAC simultaneously. As shown in Lemma 8 in Appendix B.1, this is a special case of a fairly general situation, which makes establishing a proper $\mathsf{PO}$ “counterexample” difficult.

8.1 A counterexample to $\mathsf{PO}$

Another intuitive problem with $\mathsf{PO}$ is that using the contents of a register can necessitate uncomputing the contents of another one. We exploit this insufficiency in the counterexample below. Consider the following MAC construction.

Construction 3**.**

Given $k=(p,f,g,h)$ where $p\in\{0,1\}^{n}$ is a random period and $f,g,h:\{0,1\}^{n}\to\{0,1\}^{n}$ are random functions, define $M_{k}:\{0,1\}^{n+1}\to\{0,1\}^{2n}$ by

[TABLE]

Consider an adversary that queries as follows

[TABLE]

and then discards the first qubit and the $Y_{2}$ register; this yields $\sum_{x}|x\rangle|g_{p}(x)\rangle$. The adversary can extract $p$ via period-finding from polynomially-many such states, and then output $(0\|p,0^{2n})$. This attack only queries the MAC on messages starting with $1$ (e.g., “from Alice”), and then forges at a message which starts with [math] (e.g., “from Bob.”) We emphasize that the forgery was never queried, not even with negligible amplitude. It is thus intuitively clear that this MAC does not provide secure authentication. And yet, despite this obvious and intuitive vulnerability, this MAC is in fact $\mathsf{PO}$-secure.

Theorem 19**.**

The MAC from Construction 3 is $\mathsf{PO}$-secure.

We briefly summarize the proof idea before presenting the details. The superposition oracle technique outlined in Section 3.3 achieves something that naively seems impossible due to the quantum no-cloning theorem: it records on which inputs the adversary has made non-trivial queries.888For the standard unitary oracle for a classical function, a query has no effect when the output register is initialized in the uniform superposition of all strings. The information recorded in this way cannot, in general be utilized in its entirety—after all, the premise of the superposition oracle is that the measurement $\mathcal{M}_{F}$ that samples the random function is delayed until after the algorithm has finished, but it still has to be performed. Any measurement $\mathcal{M}^{\prime}$ that does not commute with $\mathcal{M}_{F}$ and is performed before $\mathcal{M}_{F}$, can disturb the outcome of $\mathcal{M}_{F}$. If however, $\mathcal{M}^{\prime}$ only has polynomially many possible outcomes, that disturbance is at most inverse polynomial according to Lemma 1.

Here, we sample the random function $f$ using a superposition oracle, and we chose to use a measurement $\mathcal{M}^{\prime}$ to determine the number of nontrivial queries that the adversary has made to $f$, which is polynomial by assumption. Random functions are $\mathsf{PO}$-secure [6], so the only way to break $\mathsf{PO}$ security is to output $(0\|p,0^{2n})$ and $q$ other input-output-pairs. Querying messages that start with [math] clearly only yields a negligible advantage in guessing $p$ by the Grover lower bound, so we consider an adversary querying only on strings starting with $1$. We distinguish two cases, either the adversary makes exactly $q$ non-trivial queries to $f$, or less than that. In the latter case, the success probability is negligible by the $\mathsf{PO}$-security of $f$ and $h$. In the former case, we have to analyze the probability that the adversary guesses $p$ correctly. $f$ is not needed for that, so the superposition oracle register can be used to measure the set of $q$ queries that the adversary made. Using an inductive argument reminiscent of the hybrid method [4] we show that this set is almost independent of $p$, and hence the period is equal to the difference of two of the queried inputs only with negligible probability. But if that is not the case, the periodic version of $g$ is indistinguishable from a random function for that adversary which is independent of $p$.

Proof.

Let $\mathcal{A}$ be an adversary that makes $q$ quantum queries and outputs $q+1$ distinct candidate forgeries (where $q$ is selected by $\mathcal{A}$ at runtime). We let this adversary interact with a mixed oracle, where $g,h$ and $p$ are treated as random variables, and $f$ is represented as a Fourier Oracle as in Section 3.3. We denote the relevant quantum registers as follows. First, the quantum oracle for $\mathsf{Mac}_{k}$ is a unitary operator on four registers: (i.) the $(n+1)$-qubit input register $X$, (ii.) the $n$-qubit output register $Y_{1}$ into which $g_{p}:x\mapsto g(x\mod p)$ is computed, and (iii.) the $n$-qubit output register $Y_{2}$ which, if the input $x$ starts with a $1$, interacts with the Fourier Oracle, which has (iv.) an $(n\cdot 2^{n})$-qubit register denoted by $F$, with the subregister corresponding to input $x\in\{0,1\}^{n}$ denoted by $F_{x}$. We set $Y=Y_{1}Y_{2}$. Finally, the workspace of $\mathcal{A}$ is a $\poly$-qubit register denoted by $E$.

By the $\mathsf{PO}$-unforgeability of random functions, any $\mathsf{PO}$-adversary needs to output $(0\|p,0^{2n})$ when successful, except with negligible probability. Indeed, suppose an adversary $\mathcal{A}$ output $q+1$ input-output pairs of $M_{k}$, none of which is equal $(0\|p,0^{2n})$ with noticeable probability. Then we can use that adversary to construct a $\mathsf{PO}$-adversary against $\tilde{M}_{k}$ defined as

[TABLE]

by simulating an $M_{k}$-oracle for $\mathcal{A}$ using the oracle for $\tilde{M}_{k}$. To learn $p$, an adversary that makes a polynomial number of queries needs to use messages starting with 1, as the lower bound for unstructured search [4] implies that querying messages starting with [math] only provides negligible advantage for learning $p$. We will thus prove in the following that an adversary whose queries are entirely supported on the space of messages starting with $1$ cannot succeed. The proof for a general adversary is similar, if more laborious. We thus omit $h$ from the description in the following, focusing on the task of outputting $q$ input-output pairs of $f$ and the period $p$.

Let $|\psi\rangle_{XYEF}$ denote the final state of $\mathcal{A}$ and the Fourier Oracle, after the $q+1$ candidate forgeries have been measured, but prior to any other measurements. Recall that each “number projector” $P_{l}$ from Section 3.3 projects $F$ to the subspace spanned by basis states with exactly $l$ non-zero entries. We apply to $|\psi\rangle$ the two-outcome measurement defined by $P_{<q}=\sum_{l=0}^{q-1}P_{l}$ and its complementary projector $P_{\geq q}=\mathds{1}-P_{<q}$, effectively measuring whether $F$ contains fewer than $q$ non-zero entries (i.e., registers $F_{x}$ containing a state other than $0^{n}$); note that it cannot contain more than $q$ by Lemma 2. By Lemma 1, applying this measurement decreases the success probability of $\mathcal{A}$ at any particular task by a factor $1/2$. We handle the two possible outcomes ($<q$ and $q$) separately.

Case $<q$: Let $|\psi^{<q}\rangle_{XYEF}:=P_{<q}|\psi\rangle_{XYEF}$ be the post-measurement state. Note that $P_{l}|\psi^{<q}\rangle=0$ for all $l\geq q$, i.e., each basis component of $|\psi^{<q}\rangle$ has fewer than $q$ non-zero entries in $F$. On the other hand, the output of $\mathcal{A}$ contains at least $q$ candidate input-output pairs $(x_{i},y_{i})$ of $f$ (since $(0\|p,0^{2n})$ is the only input-output pair of $\mathsf{Mac}_{k}$ that does not also contain an input-output pair of a random function). We apply the $q$-outcome measurement to $F$ which asks: “among the registers $\{F_{x_{i}}\}_{i=1}^{q}$, which is the first one to contain $0^{n}$?” This measurement is defined by projectors

[TABLE]

Adding this measurement to $\mathcal{A}$ ensures that $F_{x_{j}}$ is in the state $0^{n}$ for some $j$, at the cost of multiplying $\mathcal{A}$’s success probability by $1/q$ (by Lemma 1). Recalling that, in the Fourier Oracle picture, $f(x_{j})$ is the result of QFT-ing and then fully measuring $F_{x_{j}}$, we see that $f(x_{j})$ is now uniformly random and independent of $y_{j}$. The original $\mathcal{A}$ (i.e., without the measurement $\{\Pi_{j}\}_{j}$) thus succeeded with probability at most $q\cdot 2^{-n}$. 999This argument amounts to an alternative proof that random functions are $\mathsf{PO}$-secure.

Case $q$: We will denote the post-measurement state in this case by $|\psi^{q}_{g_{p}}\rangle:=P_{q}|\psi\rangle$, emphasizing that the state was produced by interacting with the oracle $g_{p}$. By the $\mathsf{PO}$-security of $f$ (Theorem 20) it suffices to show that the correct period $p$ is output by $\mathcal{A}$ (by measuring, say, some designated subregister of $E$ of the state $|\psi^{q}_{g_{p}}\rangle$) with at most negligible probability. Since testing success at outputting $p$ does not involve the register $F$, we are free to apply any quantum channel to the $F$ register of $|\psi^{q}_{g_{p}}\rangle$. We choose to measure which $q$ subregisters of $F$ are in a non-zero state. This projective measurement is defined by projectors

[TABLE]

where $K\subset\{0,1\}^{n}$ with $|K|=q$. Note that $P_{\text{rest}}=\mathds{1}-P_{q}$, so the outcome “rest” never occurs for $|\psi^{q}_{g_{p}}\rangle$. In the following we denote by $\mathbf{K}$ the random variable obtained from this measurement. We also set some other random variables in boldface to better distinguish them from particular values they can take.

Now consider the preparation of the state $|\psi^{q}\rangle$ (by $\mathcal{A}$ and the Fourier Oracle) with an arbitrary choice of oracle function $h:\{0,1\}^{n}\to\{0,1\}^{n}$ in place of $g_{p}$. We will denote this state by $|\psi_{h}^{q}\rangle$. We now show that, conditioned on a particular measurement outcome $K$, we can arbitrarily relabel the values of $h$ outside $K$, without affecting the output state of the algorithm.

Lemma 7**.**

Let $K\subset\{0,1\}^{n}$ with $|K|=q$ and $h,h^{\prime}:\{0,1\}^{n}\to\{0,1\}^{n}$ a pair of functions satisfying $h(x)=h^{\prime}(x)$ for all $x\in K$. Then $P_{K}|\psi_{h}^{q}\rangle=P_{K}|\psi_{h^{\prime}}^{q}\rangle$.

Proof.

Let $W^{(j)}_{XYEF}:=V^{(j)}_{XYE}U^{(h)}_{XY_{1}}U^{\mathrm{FO}}_{XY_{2}F}$, where $V^{(j)}$ is $\mathcal{A}$’s $j$-th internal unitary, $U^{(h)}$ is the standard oracle unitary for $h$, and $U^{\mathrm{FO}}$ is the Fourier Oracle unitary as described in Section 3.3. The intermediate states are

[TABLE]

and the final state is $|\psi_{h}\rangle:=|\varphi_{h,q}\rangle$. By Lemma 2, $P_{l}|\varphi_{k,h}\rangle=0$ for all $l>k$, so

[TABLE]

For the $l$ term in the sum above, the unitary applies $q-k$ queries to $P_{l}|\varphi_{k,h}\rangle$; by Lemma 2 this term is thus zero unless $l=k$. We can therefore insert a $P_{k}$ after the $k$-th query for free when projecting with $P_{q}$ in the end. Explicitly,

[TABLE]

We first show that we can apply

[TABLE]

after every query of $\mathcal{A}$.

We are interested in the state $P_{K}|\psi\rangle_{XYEF}=P_{K}P_{q}|\psi\rangle_{XYEF}$. We can make a similar argument as above to show that we can project with $\tilde{P}_{K}$ after every query as well. As the FO-unitary is the only one that acts on $F$, and because $\tilde{P}_{K}|0\rangle^{\otimes n2^{n}}=|0\rangle^{\otimes n2^{n}}$, we can even apply the projector $\tilde{P}_{K}$ before and after each query. We write $N=N_{K}+N_{K^{c}}$, where

[TABLE]

i.e., $N_{K}$ and $N_{K^{c}}$ measure the number of non-zero entries inside and outside $K$, respectively. Lemma 2 applies to $N_{K}$ and $N_{K^{c}}$ separately, and $P_{K}N_{K}|\psi\rangle_{XYEF}=N_{K}P_{K}|\psi\rangle_{XYEF}=qP_{K}|\psi\rangle_{XYEF}$. Therefore we have, defining

[TABLE]

and using the same argument as above, that

[TABLE]

and hence

[TABLE]

implying $N_{K^{c}}|\psi^{k}\rangle=0$. But the projector onto the zero-eigenspace of $N_{K^{c}}$ is $\tilde{P}_{K}$, so $\tilde{P}_{K}|\psi^{k}\rangle=|\psi^{k}\rangle$.

With an even simpler argument we can insert a projector $P^{\neq 0}_{Y_{2}}=\left(\mathds{1}-|0\rangle\langle 0|\right)_{Y_{2}}$ before every query. This is because $U^{\mathrm{FO}}|0\rangle_{Y_{2}}|\gamma\rangle_{XF}=|0\rangle_{Y_{2}}|\gamma\rangle_{XF}$, and therefore the number operator eignenvalue does not increase.

To show that $U^{(h)}\tilde{P}_{K}U^{\mathrm{FO}}\left(P^{\neq 0}_{Y_{2}}\otimes(\tilde{P}_{K})_{F}\right)$ is independent of the values outside $K$, we observe that for all $x\notin K$, $y\in\{0,1\}^{n}\setminus\{0^{n}\}$ and for all states $|\gamma\rangle_{Y_{1}EF}$, we have

[TABLE]

where we have used that for all $x\notin K$ it holds that $|0\rangle\langle 0|_{F_{x}}\tilde{P}_{K}=\tilde{P}_{K}$. This implies that our artificial oracle $U^{(g,p)}\tilde{P}_{K}U^{\mathrm{FO}}\left(P^{\neq 0}_{Y_{2}}\otimes(\tilde{P}_{K})_{F}\right)$ (together with a renormalization) only gives $\mathcal{A}$ access to $g(x\mod p)$ for inputs $x\in K$.

This concludes the proof of Lemma 7. ∎

We now continue with the “case $q$” proof of the theorem. We bound $\mathcal{A}$’s success probability separately for each outcome $K$. Indeed, it suffices to show that for all $K\subset\{0,1\}^{n}$, $|K|=q$ the probability that the output contains a pair $(0\|p,0^{2n})$ is negligible if $\mathcal{A}$ continues with

[TABLE]

in place of $|\psi\rangle$.

We show that the periodic oracle can be replaced by a non-periodic one, except with negligible probability. More precisely, if $p^{\prime}$ is $\mathcal{A}$’s output, there exists an event $E$ such that $\Pr[E]=1-\negl$ and $\Pr[p^{\prime}=p_{0}|E,p=p_{0}]=\Pr[p^{\prime}=p_{0}|E,p=0]$ for all $p_{0}\in\{0,1\}^{n}$. In the following, let us denote the oracle for the MAC of Construction 1 with functions $f$ and $g$ and period $p$ by $\mathcal{O}_{f,g_{p}}$. We define

[TABLE]

For $K\subset\{0,1\}^{n}$ and $p\in\{0,1\}^{n}$, if $p\notin\mathcal{P}^{\text{bad}}_{K}$, let $T_{K,p}\subset\{0,1\}^{n}$ be a transversal for $p$ (i.e., a maximal set such that for $x,y\in T_{K,p}$ it holds that $x\neq y\mod p$) such that $T_{K,p}\cap K=K$. Using this transversal, we can define for each $K$ a random periodic function $g^{(K)}_{p}$ that is identically distributed with $g_{p}$, as follows.

• •

If $p\in\mathcal{P}^{\text{bad}}_{K}$, we set $g_{p}^{(K)}(x)=g(x\mod p)$.

• •

If $p\notin\mathcal{P}^{\text{bad}}_{K}$, we set $g^{(K)}_{p}(x)=g(y)$ for $y\in T_{K,p}$ such that $x=y\mod p$.

For a unitary algorithm $\tilde{}\mathcal{A}$ that makes $\ell$ queries to an oracle $\mathcal{O}_{f,g_{p}}$, we define the following procedures:

Procedure 0

Sample $f$, $g$ and $p$. 2. 2.

Run $\tilde{}\mathcal{A}$ with oracle $\mathcal{O}_{f,g_{p}}$ resulting in a final adversary-oracle state $|\hat{\psi}\rangle$. Apply the measurement $\{P_{\geq\ell},P_{<\ell}\}$ to $F$. If outcome is $<\ell$, output “fail.” 3. 3.

Measure $K$. If $p\in\mathcal{P}^{\text{bad}}_{K}$, output “bad.” Otherwise, let $|\psi\rangle$ be the post-measurement state of adversary and oracle, i.e., $|\psi\rangle=P_{K}P_{\geq\ell}|\hat{\psi}\rangle=P_{K}|\hat{\psi}\rangle$. 4. 4.

Output $(K,p,|\psi\rangle)$.

Procedure $\mathbf{0}_{\mathbf{K}}$

Same as Procedure 0, except with oracle $\mathcal{O}_{f,g^{(K)}_{p}}$ instead of $\mathcal{O}_{f,g_{p}}$.

Procedure 1

Sample $f$ and $g$. 2. 2.

Run $\mathcal{A}$ with an oracle $\mathcal{O}_{f,g_{0}}$ resulting in a final adversary-oracle state $|\hat{\psi}\rangle$. Apply the measurement $\{P_{\geq\ell},P_{<\ell}\}$ to $F$. If outcome is $<\ell$, output “fail.” 3. 3.

Measure $K$ and sample $p$. If $p\in\mathcal{P}^{\text{bad}}_{K}$, output “bad.” Otherwise, let $|\psi\rangle$ be the post-measurement state of adversary and oracle, i.e., $|\psi\rangle=P_{K}P_{\geq\ell}|\hat{\psi}\rangle=P_{K}|\hat{\psi}\rangle$. 4. 4.

Output $(K,p,|\psi\rangle)$.

We first observe that for all $K$, the outputs of procedures [math] and $0_{K}$ are identically distributed because $g_{p}$ and $g_{p,K}$ are. Note that for any fixed $K$, $P_{K}P_{q}=P_{K}$; this, together with Lemma 7, implies that

[TABLE]

It follows that, still for a fixed $K$,

[TABLE]

This implies also that in any of the three procedures, conditioned on the event that the output is neither “fail” nor “bad” and on a fixed first output $K$, $p$ is uniformly distributed on $\{0,1\}^{n}\setminus\mathcal{P}_{\mathrm{bad}}$. In other words,

[TABLE]

Let us denote the event that a procedure outputs a triple $(K,p,|\psi\rangle)$ by “good.”

In what follows, we fix a particular period $p$, an outcome of the period-sampling step (step 1 in Procedures [math] and $0_{K}$ and step 3 in Procedure $1$). Given a number $\ell$ of queries we identify three subspaces of $\mathcal{H}_{F}$ corresponding to the three outcomes “good,” “bad” and “fail” of the procedures above:

[TABLE]

We emphasize that the decomposition defined by these subspaces depends on the aforementioned period $p$. We let $P_{i}^{\ell}$ for $i\in\{\mathrm{good},\mathrm{bad},\mathrm{fail}\}$ denote the projectors onto these subsets.

By the above reasoning we know that for any algorithm that makes $\ell$ queries to an oracle $\mathcal{O}$ and has final state $|\psi_{\mathcal{O}}^{\ell}\rangle_{AF}$, it holds that $P^{\ell}_{\mathrm{good}}|\psi_{\mathcal{O}_{f,g_{p}}}^{\ell}\rangle_{AF}=P^{\ell}_{\mathrm{good}}|\psi_{\mathcal{O}_{f,g_{0}}}^{\ell}\rangle_{AF}$. It is easy to see that when another query is made, i.e., the $\ell+1$st query of some algorithm, some transitions from $S^{\ell}_{i}$ to $S^{\ell+1,p}_{j}$ are impossible. We only need one impossibility, namely that according to Lemma 2, $P_{i}^{\ell+1}U^{\mathrm{FO}}P_{\mathrm{fail}}^{\ell}=0$ for all $i\neq\mathrm{fail}$. In words, once an adversary has fallen behind his $q$-query plan of making one non-trivial query to $f$ in every query, he can never catch up. Also note that for $\ell=0$, $S^{\ell}_{\mathrm{fail}}=S^{\ell}_{\mathrm{bad}}=0$. It is now easy to show by induction that for a $q$-query adversary $\mathcal{A}$ with final adversary-oracle state $|\phi\rangle$ it holds that

[TABLE]

where $|\phi_{\ell}\rangle$ is the adversary oracle state before the $\ell$th query. The induction step is proven as follows. Assume the above formula is true for $q$. Then we have for a $(q+1)$-query adversary $\mathcal{A}$ with final adversary-oracle state $|\phi\rangle$

[TABLE]

Here we have used the unitary invariance of the Euclidean together with the observation that the state $|\phi\rangle$ is obtained from the state $|\psi_{q+1}\rangle$ right after the $(q+1)$-st query of $\mathcal{A}$ by a unitary acting on the adversary’s space only and which therefore commutes with $P^{q}_{\mathrm{bad}}$ in the first, the triangle inequality in the second line, the observation that $P_{i}^{\ell+1}U^{\mathrm{FO}}P_{\mathrm{fail}}^{\ell}=0$ in the third line, and the fact that $\|P\|_{\infty}\leq 1$ for any projector $P$ in the fourth line. In the fifth line we use the same argument as in the first line, just for $|\phi_{q+1}\rangle$ and $|\psi_{q}\rangle$. This proves Equation (49).

It remains to bound

[TABLE]

To this end, suppose that we measure the $X$-register of $|\phi_{\ell}\rangle$ in the computational basis with outcome $\mathbf{X}_{\ell}$, as well as $\mathbf{K}^{(\ell-1)}$ the set of nonzero registers in $F$. According to Equations (44) and (45), we have that $\mathbf{X}_{\ell}$ and $\mathbf{p}$ are independent and $\mathbf{p}$ is uniformly distributed on $\{0,1\}^{n}\setminus\mathcal{P}^{\mathrm{bad}}_{K}$ conditioned on $\mathbf{p}\notin\mathcal{P}^{\mathrm{bad}}_{K}$ and $\mathbf{K}=K$ for a fixed $(\ell-1)$-element set $K$. It follows that

[TABLE]

Here the last inequality holds for some $0<c<c^{\prime}$ and large enough $n$, and we have used in the third line that there exists a constant $c^{\prime}>0$ such that the number of divisors of an integer $M$ is bounded by $2^{c\frac{\log M}{\log\log M}}$ which also implies

[TABLE]

for all $K\subset\{0,1\}^{n}$, $|K|=\ell$. We would now like to relate the above probability to

[TABLE]

To this end we analyze how the operator $P^{\ell}_{\mathrm{bad}}U^{\mathrm{F}O}P^{\ell-1}_{\mathrm{good}}$ behaves on states of the form $|x\rangle_{X}\otimes|\phi_{y}\rangle\otimes|\zeta\rangle_{EF}$ such that $\left(P_{K}\right)_{F}|\zeta\rangle_{EF}=|\zeta\rangle_{EF}$ for some fixed $K\not\ni x$ and $p\in\{0,1\}^{n}$ such that $p\not\in\mathcal{P}^{\text{bad}}_{K}$ . We calculate

[TABLE]

In the first equation we have use the assumptions that $\left(P_{K}\right)_{F}|\zeta\rangle_{EF}=|\zeta\rangle_{EF}$ and $p\not\in\mathcal{P}^{\text{bad}}_{K}$; the rest of the calculation is analogous to Equation (40). This implies that

[TABLE]

and therefore

[TABLE]

We therefore calculate for a fixed $p$,

[TABLE]

Using Equation (58) we can bound

[TABLE]

Here we have used Equation (58) in the first inequality. The probability in the first line is taken over a run of the adversary with a fixed period and random $g$ and $f$, and in the other lines the period is picked uniformly at random from $\{0,1\}^{n}$ as for a properly generated key in Construction 1. The last two equations together imply

[TABLE]

Plugging this into Equation (49) yields

[TABLE]

using the Cauchy-Schwartz inequality in the second line. This finally implies that the adversary’s guess $p^{\prime}$ is equal to $p$ and the measurement $<q$ vs. $\geq q$ returns $\geq q$ with probability at most

[TABLE]

Here we have used Equation (69) and the uniformity of $\mathbf{p}$ conditioned on $\mathbf{p}\notin\mathcal{P}^{\text{bad}}_{\mathbf{K}}$ and $\mathbf{K}=K$ in the last line. ∎

Remark.

It’s not hard to see that the MAC from Construction 3 is not $\mathsf{GYZ}$-secure. Indeed, observe that the forging adversary described above queries on messages starting with [math] only, and then forges successfully on a message starting with $1$. If the scheme was $\mathsf{GYZ}$ secure, then in the accepting case, the portion of this adversary between the query and the final output would have a simulator which leaves the computational basis invariant. Such a simulator cannot change the first bit of the message from [math] to $1$, a contradiction.

By Theorem 9, this $\mathsf{PO}$-secure MAC is also not $\mathsf{BU}$-secure.

Corollary 5**.**

The MAC from Construction 3 is $\mathsf{BU}$-insecure.

Appendix A Technical proofs

A.1 The Fourier Oracle number operator

We now restate and prove Lemma 2. See 2

Proof.

Let $|\psi\rangle_{XYEF}$ be an arbitrary query state, where $X$ and $Y$ are the query input and output registers, $E$ is the algorithm’s internal register and $F$ is the FO register. We expand the state in the computational basis of $X$,

[TABLE]

Now observe that

[TABLE]

with $\widetilde{\mathrm{CNOT}}_{A:B}=H_{A}\mathrm{CNOT}_{A:B}H_{A}$, and therefore

[TABLE]

It follows that

[TABLE]

where we have used the definition of the operator norm and the normalization of $|\psi\rangle_{XYEF}$ in the last line. For a unitary $U$ and a projector $P$, it is easy to see that $\|[U,P]\|_{\infty}\leq 1$, as $[U,P]=PU(\mathds{1}-P)-(\mathds{1}-P)UP$ is a sum of two operators that have orthogonal support and singular values smaller or equal to $1$. We therefore get $\left\|\left[N_{F},U_{XYF}\right]|\psi\rangle_{XYEF}\right\|_{2}\leq 1,$ and as the state $|\psi\rangle$ was arbitrary, this implies \bigl{\|}\left[N_{F},U_{XYF}\right]\bigr{\|}_{\infty}\leq 1. The example from equation (2) shows that the above is actually an equality. The observation that $P_{l}\eta_{F}=0$ for all $l>0$ and an induction argument proves the second statement of the lemma. ∎

A.2 A simulation theorem: The effect of random blinding

We now restate Theorem 10 and provide a full proof. See 10

Proof.

For a function $Q:\{0,1\}^{n}\rightarrow\{0,1\}^{m}$, we let $\mathcal{O}_{Q}$ denote the unitary map $|x\rangle|y\rangle\mapsto|x\rangle|y\oplus Q(x)\rangle$. Recall that $\mathcal{A}$ is specified by a fixed initial state $|\phi_{0}\rangle$ in some finite-dimensional Hilbert space, a sequence of $T$ unitary “computation” operators $C_{1},\ldots,C_{k}$, and a POVM $\{P_{i}:i\in I\}$. The distribution (on $I$) resulting from the algorithm applied to the oracle $\mathcal{O}_{Q}$ is given by applying the POVM to the state $|\phi^{Q}\rangle:=C_{T}\mathcal{O}_{Q}C_{T-1}\cdots\mathcal{O}_{Q}C_{0}|\phi_{0}\rangle\,.$ Recall that if the trace distance between two such states satisfies \delta\bigl{(}|\phi^{Q_{1}}\rangle,|\phi^{Q_{2}}\rangle\bigr{)}:=\sqrt{1-|\langle\phi^{Q_{1}}|\phi^{Q_{2}}\rangle|^{2}}\leq\epsilon then the distance in total variation between the distributions produced by any POVM on these two states is no more than $\epsilon$. In our case, we are interested in controlling $\operatorname*{\mathbb{E}}_{B}[\delta(\phi^{F},\phi^{P\oplus F})].$ Define $F^{\prime}=F\oplus P$. In preparation for a standard hybrid argument, define

[TABLE]

so that all oracle invocations in $(\dagger)$ are answered according to $\mathcal{O}_{F^{\prime}}$ and all those in $({\ddagger})$ are answered according to $\mathcal{O}_{F}$. Since $\delta$ is a metric on pure states, we have

[TABLE]

Note that $\delta$ is invariant under (simultaneous) unitary action, and hence for any $F$, $B$, and $P$,

[TABLE]

For pure states $|\psi\rangle$ and $|\psi^{\prime}\rangle$, $\delta(|\psi\rangle,|\psi^{\prime}\rangle)\leq\||\psi\rangle-|\psi^{\prime}\rangle\|$. Note that $|\psi\rangle=\Pi_{B}|\psi\rangle+(I-\Pi_{B})|\psi\rangle$, and $O_{P}$ operates identically on $(I-\Pi_{B})|\psi\rangle$. Therefore

[TABLE]

Let $\pi$ be a uniformly random element of the symmetric group on $\{0,1\}^{n}$ and $U_{\pi}$ be the unitary operator associated with the permutation $\pi$. We have that

[TABLE]

Thus we conclude that $\operatorname*{\mathbb{E}}_{B}[\delta(\phi^{F},\phi^{P\oplus F})]\leq 2T\sqrt{\varepsilon}$. ∎

Appendix B SUPPLEMENTARY MATERIAL

B.1 Non-adaptive quantum queries and “double spending”

The following lemma shows that if there exists a non-adaptive quantum algorithm $\mathcal{A}$ making $q$ queries to a function $f:\{0,1\}^{n}\to\{0,1\}^{m}$ that learns a certain property $p(f)$, then with inverse polynomial probability, there exists another non-adaptive $q$-query algorithm that learns $p(f)$ and $q$ input-output-pairs with inverse polynomial probability. For this to hold, we need to assume that $\mathcal{A}$ makes its queries using a blank output register (i.e., initialized in the $|0\rangle$ state). This is the case, e.g., in period-finding and Simon’s algorithm.

In the following, denote the set of $n$-bit-to-$m$-bit functions by $\mathcal{F}(n,m)$.

Lemma 8** (Double spending lemma).**

Let $F\subseteq\mathcal{F}(n,m)$ be a set of functions, $P$ a set, $p:F\to P$ a function, and $D$ a probability distribution on $F$. Suppose there exists a quantum query algorithm $\mathcal{A}$ which makes $q$ non-adaptive quantum queries to $\mathcal{O}_{f}$ with blank output register for $f\leftarrow D$ and outputs $p(f)$ with $1/\poly$ probability. Then there also exists an algorithm $\mathcal{A}^{\prime}$ which makes $q$ non-adaptive quantum queries to $\mathcal{O}_{f}$ for $f\leftarrow D$ and outputs both $p(f)$ and $q$ input-output pairs of $f$ with $1/\poly$ probability.

Proof.

Let $\mathcal{X}=\{0,1\}^{n}$, $\mathcal{Y}=\{0,1\}^{m}$ and $\mathcal{H}_{Z}=\mathbb{C}\mathcal{Z}$ for $Z=X,Y$. Set $\mathcal{A}^{\mathcal{O}}(1^{n})=\mathcal{E}\left(\mathcal{O}^{\otimes q}|\psi\rangle_{X^{q}}\otimes|0\rangle_{Y^{q}}\right)$ where $|\psi\rangle$ is some input state and $\mathcal{E}=\{E_{p}\}_{p\in P}$ is a POVM on $\mathcal{H}_{X}^{\otimes q}\otimes\mathcal{H}_{Y}^{\otimes q}$ with outcomes labelled by the possible properties of $f$. Let $|\psi_{1}\rangle=\mathcal{O}^{\otimes q}|\psi\rangle_{X^{q}}\otimes|0\rangle_{Y^{q}}$. $\mathcal{A}$ outputs $p(f)$ with inverse polynomial probability, say with probability $p_{\mathrm{succ}}=\langle\psi_{1}|E_{p(f)}|\psi_{1}\rangle$. It follows that the post-measurement state conditioned on the outcome $p(f)$,

[TABLE]

has inverse polynomial overlap with $|\psi_{1}\rangle$,

[TABLE]

This implies immediately that measuring $|\psi_{2}^{p(f)}\rangle$ in the computational basis will yield $q$ input output pairs of $f$ with inverse polynomial success probability. ∎

We remark that the distribution of input-output pairs is at most $1-1/\poly$ far from the distribution one would get by simply measuring immediately after the query of $\mathcal{A}$. This means that, in the case of period-finding and Simon’s algorithm (where the queries are uniform), the input-output pairs will be distinct with non-negligible probability.

B.2 Alternative proof that random functions are $\mathsf{PO}$-secure

Using Lemma 2, we can give a simple proof of the fact that a random function is $\mathsf{PO}$-secure. Because of its simplicity, and because much of it can be reused to prove a separation between $\mathsf{PO}$ and $\mathsf{BU}$, we provide this proof below.

Theorem 20** ([6]).**

An algorithm making $q$ quantum queries to a random oracle $f:\{0,1\}^{n}\to\{0,1\}^{m}$ produces $q+1$ input-output pairs of $f$ with probability at most

[TABLE]

Note that the probability bound is within a factor of $2$ of the one obtained in [6], and matches it for $q+1=2^{k}$, $k\in\mathbb{N}$.

Proof.

Let $\mathcal{A}$ be an adversary that, when provided with the quantum random oracle $f$, outputs $q+1$ candidate input-output pairs. Formally, let $\rho_{(X,Y)^{q+1}F}$ be the joint cq-state of the adversary and the FO, where the classical registers $(X,Y)^{q+1}$ contain $\mathcal{A}$’s output and $F$ is the FO’s register. If we wanted to determine the success of $\mathcal{A}$ at this point, we would apply the Fourier transform to $F$, and then measure $F$ and check if the outcome for $F_{x_{i}}$ is $y_{i}$ for each $(x_{i},y_{i})$ output by $\mathcal{A}$.

Note that $P_{l}\rho=0$ for all $l>q$ by Lemma 2, i.e., there are at most $q$ entries of $F$ that are nonzero. This implies that the entry corresponding to at least one of the inputs that $\mathcal{A}$ has output is, in fact, equal to $0^{m}$. However, this is only true in superposition: different branches of the superposition may have different entries in the state $|0^{m}\rangle$. We will deal with this issue by thinking about a new algorithm $\mathcal{B}$, which will simulate the entire execution of $\mathcal{A}$ (including the oracle) and then perform a small number of additional measurements prior to the success check. The additional measurements will find a pair $(x_{i_{0}},y_{i_{0}})$ in $(X,Y)^{q+1}$ such that $F_{x_{i_{0}}}$ is actually in the state $|0^{m}\rangle$ (in every branch of the superposition). The probability that $y_{i_{0}}=f(x_{i_{0}})$ (in the execution of $\mathcal{B}$) will then be $2^{-m}$. We will then apply Lemma 1 to show that the success probability of $\mathcal{A}$ is not much better.

We now describe $\mathcal{B}$ in detail. Initially, $\mathcal{B}$ simulates both $\mathcal{A}$ and the oracle. After $\mathcal{A}$ has finished, but before the success check is performed, $\mathcal{B}$ (which is in the state $\rho$) applies binary search to the $q+1$ inputs that $\mathcal{A}$ has output. The goal is to find an input $x_{i_{0}}$ such that $F_{x_{i_{0}}}$ is in state $|0^{m}\rangle$. We do this using binary measurements that ask “are any of the registers $F_{x_{i_{1}}},...,F_{x_{i_{k}}}$ in the state $|0^{m}\rangle$?” We split up the set $S_{0}=\{x_{1},...,x_{q+1}\}$ into two subsets $S_{0}^{\textsf{L}}=\{x_{1},...,x_{\lfloor(q+1)/2\rfloor}\}$ and $S_{0}^{\textsf{R}}=\{x_{\lfloor(q+1)/2\rfloor+1},...,x_{q+1}\}$, and measure whether $F_{x}$ is in a state different from $|0^{n}\rangle$ for all $x\in S_{0}^{\textsf{L}}$. This is done using the binary measurement given by

[TABLE]

and its complementary projector $P_{0}=\mathds{1}-P_{1}$. If the outcome is no, we set $S_{1}=S_{0}^{\textsf{L}}$, if it is yes then we set $S_{1}=S_{0}^{\textsf{R}}$. This makes sure that we continue with a set that contains an input such that the corresponding FO register is in state $|0^{n}\rangle$. Now we repeat the described steps using $S_{1}$ in place of $S_{0}$ and continue recursively until we encounter a set $S_{l}$ with only one element, say $w$. Continuing with the success check, we now know that $F_{w}$ is in the state $|0^{m}\rangle$, which implies that $f(w)$ is uniformly random and independent of $\mathcal{A}$’s output. Indeed, a register that is in a pure state is automatically in product with the rest of the universe, and $f(w)$ is determined by applying $H^{\otimes m}$, which transforms $|0^{m}\rangle$ into $|\phi_{0}\rangle$, and measuring, which yields a uniformly random outcome. Therefore $\mathcal{A}$’s success probability is at most $2^{-m}$. The total number of binary measurements for the binary search procedure is upper-bounded by $\lceil\log(q+1)\rceil$, so an application of Lemma 1 finishes the proof. ∎

B.3 A useful lemma on Bernoulli-preserving hash

Recall that blinding a function $f:\{0,1\}^{n}\to\{0,1\}^{t}$ on a set $B\subseteq\{0,1\}^{n}$ results in the blinded function $Bf$ defined by $Bf(x)=\bot=(0^{t},1)$ for $x\in B$ and $Bf(x)=(f(x),0)$ for $x\notin B$. The following lemma, which is implicit in the proof of Hash-and-MAC construction, could be useful in security reductions involving Bernoulli-preserving hash.

Lemma 9**.**

Let $h:\{0,1\}^{n}\to\{0,1\}^{m}$ be a Bernoulli-preserving hash and $f:\{0,1\}^{n}\to\{0,1\}^{t}$ an efficiently computable function. Then for all oracle QPTs $(\mathcal{A},\epsilon)$, we have

[TABLE]

Proof.

It suffices to observe that one can simulate the oracle for $Bf$ using two calls to an oracle for $\chi_{B}$ and two executions of $f$, as follows.

[TABLE]

In the second step, we applied the CCNOT (Toffoli) gate to the second register, with the fourth and fifth register as the controls and a CNOT to the third register with the fourth register as a control. With this observation, it is straightforward to turn any distinguisher for $B_{\epsilon}f$ vs. $B_{\epsilon}^{h}f$ into one for $\chi_{B_{\epsilon}}$ vs. $\chi_{B_{\epsilon}^{h}}$. ∎