Quantum security of hash functions and property-preservation of iterated hashing

TL;DR

This paper analyzes the security of cryptographic hash functions against quantum attacks, adapts security notions to the quantum setting, and examines whether iterated hash constructions preserve security properties in this context.

Contribution

It extends classical security notions of hash functions to the quantum setting and proves property preservation for certain iterated hash schemes like ROX.

Findings

Quantum adversaries do not gain advantage from superposition access.

Implications and separations of security properties are confirmed in the quantum setting.

ROX construction preserves security properties in the quantum random oracle model.

Abstract

This work contains two major parts: comprehensively studying the security notions of cryptographic hash functions against quantum attacks and the relationships between them; and revisiting whether Merkle-Damgard and related iterated hash constructions preserve the security properties of the compression function in the quantum setting. Specifically, we adapt the seven notions in Rogaway and Shrimpton (FSE'04) to the quantum setting and prove that the seemingly stronger attack model where an adversary accesses a challenger in quantum superposition does not make a difference. We confirm the implications and separations between the seven properties in the quantum setting, and in addition we construct explicit examples separating an inherently quantum notion called collapsing from several proposed properties. Finally, we pin down the properties that are preserved under several iterated hash schemes. In particular, we prove that the ROX construction in Andreeva et al. (Asiacrypt'07) preserves the seven properties in the quantum random oracle model.

Equations

$${\text{Adv}}_H^{\text{Coll}}(A)$$

$${\text{Adv}}_H^{\text{Pre}}(A)$$

$${\text{Adv}}_H^{\text{Sec}}(A)$$

$${\text{Adv}}_H^{\text{aPre}}(A,B)=$$

$$:k,S\leftarrow A(1^n);x^{\prime }\leftarrow M;y=H_k(x^{\prime });x\leftarrow B(1^n,S,y)]$$

$${\text{Adv}}_H^{\text{aSec}}(A,B)=$$

$$:k,S\leftarrow A(1^n);x^{\prime }\leftarrow M;x\leftarrow B(1^n,S,x^{\prime })]$$

$${\text{Adv}}_H^{\text{ePre}}(A,B)=$$

$${\text{Adv}}_H^{\text{eSec}}(A,B)=$$

$$:x^{\prime },S\leftarrow A(1^n);k\leftarrow \mathcal{K};x\leftarrow B(1^n,S,k)]$$

$${\text{Adv}}_H^{\text{CollSQ}}(A)=$$

$$:k\leftarrow \mathcal{K};X,X^{\prime }\leftarrow A(1^n,k);x,x^{\prime }\leftarrow \mathcal{M}(X,X^{\prime })]$$

$${\text{Adv}}_H^{\text{PreSQ}}(A)=$$

$$:k\leftarrow \mathcal{K};x^{\prime }\leftarrow M;y=H_k(x^{\prime });X\leftarrow A(1^n,k,y);x\leftarrow \mathcal{M}(X)]$$

$${\text{Adv}}_H^{\text{SecSQ}}(A)=$$

$$:k\leftarrow \mathcal{K};x^{\prime }\leftarrow M;X\leftarrow A(1^n,k,x^{\prime });x\leftarrow \mathcal{M}(X)]$$

$${\text{Adv}}_H^{\text{aPreSQ}}(A)=$$

$$:K,S\leftarrow A(1^n);x^{\prime }\leftarrow M;Y=U_{H(x^{\prime })}(K\otimes |0⟩)$$

$$X\leftarrow B(1^n,S,Y);k,x\leftarrow \mathcal{M}(K,X)]$$

$${\text{Adv}}_H^{\text{aSecSQ}}(A)=$$

$$:K,S\leftarrow A(1^n);x^{\prime }\leftarrow M;X\leftarrow B(1^n,S,x^{\prime });k,x\leftarrow \mathcal{M}(K,X)]$$

$${\text{Adv}}_H^{\text{ePreSQ}}(A)=$$

$$:Y,S\leftarrow A(1^n);k\leftarrow \mathcal{K};X\leftarrow B(1^n,S,k);x,y\leftarrow \mathcal{M}(X,Y)]$$

$${\text{Adv}}_H^{\text{eSecSQ}}(A)=$$

$$:X^{\prime },S\leftarrow A(1^n);k\leftarrow \mathcal{K};X\leftarrow B(1^n,S,k);x,x^{\prime }\leftarrow \mathcal{M}(X,X^{\prime })]$$

$${\text{pad}}_{\text{ROX}}:$$

$$x$$

$${\overline{\text{ROX}}}_k^{(H)}:$$

$$\Lambda$$

$$x_1\Vert \dots \Vert x_i$$

$$t=t^{\prime }-\text{poly}(n){\tau }_H;\epsilon ={\epsilon }^{\prime }+O(q^2/2^d)$$

$$t=t-\text{poly}(n){\tau }_H;{\epsilon }^{\prime }=\epsilon +O(q^2/2^d)$$

$$t=t^{\prime }-\text{poly}(n){\tau }_H;\epsilon =\text{poly}(n){\epsilon }^{\prime }/(1-1/2^n)(1-\text{poly}(n)/2^n)$$

$$H_k(x)=\{\begin{array}{ll}{0}^d& \text{if }k=0^n\\ F_k(x)& \text{o.w.}\end{array}$$

$$H_k(x)=\{\begin{array}{ll}{0}^d& \text{if }x=0^m\\ 1\Vert F_k(x)& \text{o.w.}\end{array}$$

$$X=\sum _{x\in H^{-1}(y)}{\alpha }_x|x⟩=|1⟩(\sum _{x\in F^{-1}(y^{\prime })}{\alpha }_x|x⟩)$$

$${\mathcal{M}}_n(\rho )=\sum _{x\in \{0,1{\}}^n}(|x⟩⟨x|\otimes \mathbb{I})\rho (|x⟩⟨x|\otimes \mathbb{I})$$

$$U_{H(x^{\prime })}:|K⟩|Y⟩\mapsto |K⟩|H_k(x^{\prime })\oplus Y⟩$$

$$U_{H(x^{\prime })}=({\mathbb{I}}^n\otimes V_0)\prod _{\ell =1}^q{\text{CNOT}}_{i_{\ell },j_{\ell }}({\mathbb{I}}^n\otimes V_{\ell })$$

$$x_1\Vert \dots \Vert x_{\ell }={\text{pad}}_{\text{ROX}}(x)$$

$$x=x_{\ell }\Vert {\overline{\text{ROX}}}_k^{(H)}(x_1\Vert \dots \Vert x_{\ell -1})\oplus {\text{RO}}_1(\hat{x},k,\ell )$$

Full text

Keywords:

Quantum random-oracle model, Post-quantum security definitions, Hash functions

1 Introduction

Cryptographic hash functions, which produce a short digest on an input message efficiently, are a ubiquitous building block in modern cryptography. They are indispensable in constructing key-establishment, authentication, encryption, digital signature, cryptocurrency, and more, which constitute the backbone of a secure cyberspace. A host of cryptographic hash functions have been designed [NIS15] which have been subject to extensive cryptanalysis. Most of the constructions follow the iterated hash paradigm, which iterates a compression function on a small domain.

The emerging technology of quantum computing brings devastating challenges to cryptography. In addition to breaking widely deployed public-key cryptography due to Shor’s efficient quantum algorithm for factoring and discrete logarithm, effective quantum attacks on symmetric primitives have been found in recent years that break of a variety of message authentication and authenticated encryption schemes [KLLNP16, SS17].

In this work, we revisit two fundamental threads of cryptographic hash functions in the presence of quantum attacks: modeling basic security properties and establishing their interrelations; and pinning down whether the iterated hash constructions preserve the security of the underlying compression functions.

A principal security property is collision resistance: It should be computationally infeasible to compute a collision $(x,x^{\prime})$ such that $H(x)=H(x^{\prime})$. Two other basic properties are preimage resistance (Pre) and second-preimage resistance (Sec). Rogaway and Shrimpton extend the three and arrive at a total of seven properties to cope with various scenarios [RS04]. More specifically, they consider a family of hash functions $H:\mathcal{K}\times\mathcal{M}\to\mathcal{D}$. Conventional Pre and Sec require that under a random key, it is infeasible to find a preimage of a random digest or to find a message that forms a collision with a given random input. They propose two variations named always and everywhere. For example, always preimage resistance (aPre) allows an attacker to pick a key $K$ at will, and $H_{K}$ needs to be preimage resistant in the usual sense. This reflects that real-world hash functions are standalone (i.e., unkeyed), so it is important to always enforce the property on all members in the hash family. In a complementary vein everywhere preimage resistance (ePre), for instance, asks about finding a preimage on any digest (i.e., adversarially chosen as opposed to a random one) being hard. They give a comprehensive characterization of the seven properties, including both implications and separations. For instance, they show that while Coll implies standard Pre, there exist Coll hash functions that are not aPre or ePre. This motivates our first question of this work:

How do we model these properties appropriately against quantum attacks, and what are the relationships between them?

Once the appropriate quantum security notions have been nailed down, we would like to construct hash functions achieving various desired properties. The dominating design framework is iterated hashing, which takes a compression function on a relatively small domain and runs it iteratively, with minor variations, to process longer messages. The Merkle-Damgård construction [Mer89, Dam89] (adopted by SHA-1,2 families) and the sponge construction [BDPA07] (adopted in SHA-3) are notable examples. As a modular approach to attaining security, researchers ask whether the iterated hash preserves the security of the compression function. It is known that Merkle-Damgård is collision resistant as long as the compression function is collision resistant. However it does not preserve preimage resistance: There is a preimage-resistant compression function, such that plugging it into Merkle-Damgård fails to result in preimage-resistance. Andreeva et al. [ANPS07] study several variants of Merkle-Damgård, such as XOR-linear [BR97] and Shoup’s [Sho00] hash schemes, and determine their security-preserving capabilities. In short, none of them are able to preserve all seven properties. They therefore propose a new iterated construction, ROX, built on XOR-linear hash, and prove that it preserves all seven properties in the random oracle model111The compression function is not given as a random oracle. Rather apart from the compression function, the construction has access to a public random function that is given as a black-box.. In contrast, we refer to other constructions as being in the plain model. We pose the second major question of this work:

Is ROX security preserving in the quantum setting?

A positive answer will dramatically simplify the design of secure hash functions to the design of a secure compression function of a small size. Answering this question, however, could be challenging and subtle. What we prove classically often fails to carry over against quantum attacks for some fundamental reasons (e.g., no-cloning of quantum states or probabilistic analysis that has no counterpart in the quantum formalism). There has been extensive work developing tools for analyzing quantum security [Wat09, Unr12, Son14, Zha12a]. In particular, Unruh proves that Merkle-Damgård preserves collapsing, and it can be observed that collision resistance is also preserved in the quantum setting. More specific to ROX, the random oracle model faces grave difficulties in the presence of quantum adversaries [BDF*+*11]. For example, classically one can easily simulate a random oracle by lazy sampling the responses upon every query on-the-fly. A quantum query, which can be in superposition of all possible inputs seems to force the function to be completely specified at the onset. Likewise, the powerful trick of programming a random oracle, i.e., changing the outputs on some input points as long as they have not been queried before, appears impossible if quantum queries are permitted. Recently, there is progress on restoring proof techniques including programming a quantum random oracle [ARU14, Unr14, ES15, HRS16].

Our contributions.

We investigate the two questions systematically in this work. The main results are summarized below.

We formalize the seven security notions in the quantum setting222Some standard notions have appeared in the literature before [HRS16].. Since all properties are described in simple interactive games, we face two options to modeling quantum attackers depending on whether the interface between the challenger and the adversary remains classical or can also be quantum. We call the latter “fully” or “strong” quantum attacks, reminiscent of an active line of work recently [BZ13, Unr14, AR17]. This stronger type of attack is more realistic in some cases than others. Our interesting finding is that which model we use makes no difference in this setting, by a simple observation of commutativity of some quantum operators. Namely, the security property (e.g. aPre) against a quantum adversary and classical communication with the challenger is equivalent to that where the access to the challenger can be quantum too.

We depict the landscape of the seven notions in the quantum setting as well as the collapsing property, by fully determining their relationships (Figure 2a). For most of the existing implications and separations in [RS04], we apply a general lifting tool in [Son14] to make analogous conclusions in the quantum setting. We construct new examples to separate collapsing from our quantum notions of aSecQ and eSecQ, and derive other relations by transitivity. Unruh’s separation example between collapsing and collision resistance [Unr16b] is the only one that is relative to an oracle.

We determine the security-preserving capabilities of various iterated hash constructions. We show that the results in [ANPS07] (other than ROX) can be “lifted” into a quantum setting. As to ROX, we adapt techniques of programming a quantum random oracle and show that ROX preserves all security properties we consider in this work.

Discussion.

As Andreeva et al. remarked in their work, ROX is proven secure in the random oracle model. Can we design an iterated hash that is all-preserving in the plain model? Recently there is another quantum notion extending collision resistance proposed in [AMRS18] termed Bernoulli-preserving. It implies collapsing and appears stronger. Do the iterated hash constructions preserve collapsing and Bernoulli-preserving of the compression function? Another interesting future direction is to investigate whether iterated hash can be amplifying, especially with the assistance of a random oracle such as in ROX. Finally, we consider variants of the Merkle-Damgård and Merkle Tree constructions. Less is known about the versatile sponge construction in terms of security-preserving of round functions. It has been shown very recently that the sponge is collapsing assuming the round functions are truly random [CBH*+*18].

2 Preliminaries

Notations.

Hash-function properties are formulated as games with a challenger $\mathcal{C}$ and an adversary $A$. $\mathcal{C}$ and $A$ perform one or more rounds of communication, after which $\mathcal{C}$ outputs a bit indicating whether $A$ “won”. Our proofs take the form of reductions, where winning the game allows us to create an adversary to win another game that is supposed to be hard. Following on [Son14], we formalize a reduction as a tuple $(\mathcal{G}^{\textrm{int}},\mathcal{T},\mathcal{G}^{\textrm{ext}})$ where $\mathcal{G}^{\textrm{ext}}$ is the game that is assumed to be hard, $\mathcal{G}^{\textrm{int}}$ is the game we would like to show to be secure, and $\mathcal{T}$ transforms an adversary $A$ for $\mathcal{G}^{\textrm{int}}$ into one for $\mathcal{G}^{\textrm{ext}}$. If $\mathcal{T}$ is efficient and maintains $A$’s success probability up to a negligible difference, showing the existence of a reduction is a proof by contradiction that $\mathcal{G}^{\textrm{int}}$ is hard.

We are concerned primarily with quantum adversaries. These are adversaries that run in polynomial time on a quantum computer (qpt). We call the probability that this adversary succeeds its “advantage”, denoted by $\text{{Adv}}^{\text{{prop}}}_{H}(A)$, where $H$ is a hash function. By $\text{{Adv}}^{\text{{prop}}}_{H}$, we mean the maximum advantage over qpt adversaries. When discussing concrete security, we say that $H$ is $(t,\varepsilon)$-prop if for all adversaries $A$ running in time at most $t$, $\text{{Adv}}^{\text{{prop}}}_{H}{A}\leq\varepsilon$. When the interaction between $\mathcal{C}$ and an adversary has two rounds, we sometimes refer to an adversary as having two parts $(A,B)$. In this case, they share a state register $S$, which the challenger may not read or modify. By convention, we use capital letters to indicate quantum registers. Measuring a quantum register ($\mathcal{M}(\cdot)$) results in a classical value, which we denote with the corresponding lowercase letter.

We assume there exists a security parameter $n$ for each hash function that corresponds to the size of a key. A probability is negligible, denoted $\text{\it{negl}}(n)$, if it is less than $\frac{1}{\text{\it{poly}}(n)}$, where $\text{\it{poly}}(\cdot)$ is any polynomial function. By $\tau_{H}$, we mean the time required to compute $H$. We indicate sampling from a distribution or receiving a result from a probabilistic algorithm by $x\leftarrow S$. When $S$ is a set, this indicates uniform sampling, unless otherwise noted.

Quantum random oracles.

One goal of this paper is to translate results about the ROX construction from the classical (RO) to the quantum (QRO) random oracle model. In general, results proven in the classical RO model do not necessarily carry over to a quantum setting, and even when they do, the techniques often need to be modified.

Even efficiently simulating a random oracle—a simple task in a classical setting, since an algorithm can simply lazily answer $\text{\it{poly}}(n)$ queries—is not obviously possible in a quantum setting. A quantum query could be a superposition of exponentially many inputs, naively requiring an exponential number of samples from the oracle’s codomain to simulate. Zhandry showed that it is possible to efficiently simulate a random oracle using $2q$ samples, where $q$ is the number of queries made to the oracle (Corollary 1 of Theorem 3.1 from [Zha12b]). Whenever we refer to simulating a QRO, we refer to this technique.

Another property of classical random oracles is that they can be adaptively programmed. That is, even after a polynomial number of queries have been made, the algorithm simulating the oracle can change the output of the oracle at some input points, since it is unlikely that $A$ has seen the output at those points. However, a single quantum query in superposition can “see” the output at all points of the domain. We use a technique for programming a quantum random oracle from [ES15], which defines a “witness-search” game in which an adversary must guess a “witness” $\hat{w}$ with $P(\hat{w})=1$, given some predicate $P$ and public information $pk$ chosen by the challenger, given that the challenger knows a witness $w$. The probability that any qpt adversary detects adaptive programming at a point $x$ with $P(\hat{w})=1$ is at most his success probability in witness search.

Standard hash-function security.

Rogaway and Shrimpton [RS04] identify seven properties of hash functions. These consist of the standard collision resistance (Coll), preimage resistance (Pre), and second-preimage resistance (Sec), as well as two stronger variants of each of the latter two—“always” (aPre, aSec) and “everywhere” (ePre,eSec)—which give the adversary more power. The following defines standard collision, preimage, and second-preimage resistance:

[TABLE]

Note that the challenger chooses the key $k$, and in the latter two properties, challenger chooses the target that the preimage needs to match. A successful adversary needs to work with non-negligible probability regardless of what the challenger chooses. One way to create a stronger property would be to relax this requirement on either the key or the preimage target.

Allowing the adversary to choose the key results in the “always” variants of preimage and second-preimage resistance. Here, the adversary is given as a pair of algorithms $(A,B)$: $A$ is responsible for choosing the key, and $B$ is responsible for guessing the preimage.

[TABLE]

Alternatively, allowing the adversary to choose the target the preimage must match before knowing the key results in the “everywhere” variants of these properties:

[TABLE]

A standard quantum-only property is called “collapsing” [Unr16b, Unr16a] (CLAPS). Let $y\in\mathcal{D}$ be an element of the digest space of $H_{k}$. CLAPS captures the idea that it should be difficult for an adversary to produce a “useful” superposition of elements of the set $H_{k}^{-1}(y)\subseteq\mathcal{M}$. If a hash function is not collapsing, an adversary may be able to find some input-output pair with desirable properties even if it can succeed with only negligible advantage in the Coll game.

An adversary for CLAPS is a pair of qpt algorithms $(A,B)$. On input $k$, $A$ outputs quantum registers $S,X$ and a classical register $y$. We call the adversary “correct” if $\Pr[H_{k}(\mathcal{M}(X))=y]=1$, and we restrict our attention to correct adversaries. On input $S,X$, $B$ outputs a classical bit $b$ that represents a guess whether $X$ has been measured. The collapsing advantage $\text{{Adv}}^{\text{{CLAPS}}}_{H}(A,B)=|\Pr[b=1\,:\,\Game{1}]-\Pr[b=1\,:\,\Game{2}]|$, where $\Game{1,2}$ are as shown in Fig. 1.

3 Quantum security properties of hash functions

We adapt the above notions from [RS04] to a quantum setting by allowing the adversary to be qpt, rather than ppt, as in the original definitions. The hash function is public, so he can make superposition queries to it, but all interactions with the challenger are classical. With the exception of the $\text{\it{poly}}(n)$-qubit state register $S$, we assume that the adversary measures all of its wires before outputting them. We call these variants CollQ, PreQ, etc.

It would be natural to ask whether stronger properties result from allowing the interface between the adversary and the challenger to be quantum. In other words, the adversary does not measure its wires before outputting them. At the end, the challenger measures all registers to determine whether the adversary has succeeded. These properties, which we call “strongly quantum” (SQ), are defined as follows, where $K$, $Y$, and $X^{\prime}$ are quantum registers:

[TABLE]

In (11), $U_{H(x^{\prime})}$ is quantum gate that acts as $U_{H(x^{\prime})}\,:\,\ket{k}\ket{y}\mapsto\ket{k}\ket{y\oplus H_{k}(x^{\prime})}$. In other words, given a key register $K$ in superposition, it outputs a superposition of digests for $x^{\prime}$.

It is easy to see that CollSQ, PreSQ, and SecSQ(8, 9, and 10) are equivalent to their counterparts (1, 2, and 3) defined above: The challenger immediately measures the adversary’s output registers, so without loss of generality, we may assume that the adversary measures all output registers itself.

As it happens, the other SQ properties (11–14) are equivalent to the above versions (4–7) as well. Intuitively, this is because, although $A$ can put a superposition of values on its output register, the challenger never gives this register to $B$. If the challenger did so, it would be unable to check whether the adversary had won, since it would no longer have a copy of that register. Hence, the quantum “interface” with the challenger gives the adversary no additional power in this case.

A more formal proof requires us to show the equivalence of two quantum circuits. We give the full proof for $\text{{aPreQ}}\equiv\text{{aPreSQ}}$ in Appendix 0.B. The proofs for aSecQ, ePreQ, and eSecQ are similar, but slightly more straightforward, in that they do not require Lemma 8.

4 Relations of quantum security properties

In this section, we examine the relationships among the properties in Sect. 3. Fig. 2 illustrates these graphically. The relationships among the properties with classical analogs carry over from the classical setting, based on the framework from [Son14]. The following is a sufficient criterion for “lifting” a reduction from a classical to a quantum setting:

Lemma 1 (Corrollary 4.6 from [Son14])

Let $\mathcal{R}=(\mathcal{G}^{\textrm{ext}},\mathcal{T},\mathcal{G}^{\textrm{int}})$ be a black-box reduction that holds for ppt machines, and suppose the following:

$\mathcal{G}^{\textrm{int}}(A)$* and $\mathcal{G}^{\textrm{ext}}(A)$ are defined for qpt $A$;* 2. 2.

$|\text{{Adv}}^{\mathcal{G}^{\textrm{int}}}_{(}A)-\text{{Adv}}^{\mathcal{G}^{\textrm{ext}}}(\mathcal{T}(A))|\leq\text{\it{negl}}(n)$* for all qpt $A$;* 3. 3.

when $\mathcal{T}$ runs $A$, it runs it “in a straight line until completion,” i.e., as an honest challenger would; and 4. 4.

for all $A,A^{\prime}$ with $\text{{Adv}}^{\mathcal{G}^{\textrm{int}}}(A)=\text{{Adv}}^{\mathcal{G}^{\textrm{ext}}}(A^{\prime})$, $\text{{Adv}}^{\mathcal{G}^{\textrm{ext}}}(\mathcal{T}(A))=\text{{Adv}}^{\mathcal{G}^{\textrm{ext}}}(\mathcal{T}(A^{\prime}))$.

Then $\mathcal{R}$ holds for qpt machines as well.

All the classical implication proofs from [RS04] ($\Rightarrow$ from Fig. 2b) satisfy the hypotheses in Lemma 1, and thus that these proofs can be lifted into a quantum setting. For example, the standard proof that $\text{{Coll}}\rightarrow\text{{eSec}}$ involves creating a reduction $(\mathcal{G}^{\textrm{ext}}=\text{{Coll}},\mathcal{T},\mathcal{G}^{\textrm{int}}=\text{{eSec}})$ where $\mathcal{T}$ is defined as follows:

$\mathcal{T}\,:\,A\mapsto A^{\prime}$

Sample $x\leftarrow\mathcal{M}$ and send it to the challenger.

Receive $k$ from $\mathcal{C}$.

Run $A(1^{n},k,x)$ to get $x^{\prime}$ and send $(x,x^{\prime})$ to the challenger.

Note that $\mathcal{T}$ could be applied to a quantum $A$ for eSecQ as easily as a classical one for eSec, and the result, $\mathcal{T}(A)$ finds a collision in the CollQ game. This is guaranteed due to the classical “interface” in the definitions from Sect. 3. Moreover, it runs $A$ as normal. So hypotheses 1 and 3 from Lemma 1 hold. Hypothesis 2 holds as well, since the success probabilities of $A$ and $\mathcal{T}(A)$ are the same Hypothesis 4 captures the idea that the success probability of $\mathcal{T}(A)$ depends only on the success probability of $A$, not some specific facet of its internal behavior. This is easily seen to be the case here.

The classical separations from [RS04] ($\nRightarrow$ from Fig. 2b) can also be lifted in a similar fashion. For example, the proof that Coll does not imply aSec runs as follows: Suppose that $H$ is Coll. We define a new function $H^{\prime}$ such that if $k\not=0$, $H^{\prime}_{k}(x)=H_{k}(x)$, but $H_{0}(x)=0$. There is a trivial attack for aSec on $H^{\prime}$: The adversary simply chooses $k=0$ and outputs any $x^{\prime}\not=x$ as a second preimage. Finally, we show that $H^{\prime}$ is still collision resistant using a simple reduction. The first half of this proof (the attack) is clearly as possible on a quantum computer as it is on a classical one. In fact, the structure of the properties from Sect. 3 (excluding CLAPS)—where the adversary is given classical input and must produce classical output—guarantees this. Moreover, as with the implication proofs, the reductions in the separation proofs satisfy the hypotheses in Lemma 1. So we conclude that these separations hold in a quantum setting as well.

We additionally examine the relationships between collapsing and each of the standard properties. Unruh shows in [Unr16b] that collapsing implies collision resistance, and this proof applies to CollQ as well. This leads to the transitive implications from CLAPS in Fig. 2b. We find that CLAPS does not imply aPreQ, aSecQ, or ePreQ. The proofs of these separations are given in Appendix 0.A.

5 Quantum security preservations of iterated hash constructions

In this section, we consider whether several standard iterated hash constructions, including one in the random oracle model (ROX), preserve the quantum-safe properties from Sect. 3. The constructions we consider are the same as those considered in [ANPS07], and we find that they preserve (and fail to preserve) the quantum analogs of the same properties that [ANPS07] show they do classically. In the case of the standard constructions, we omit explicit proofs, instead using the lifting framework we introduced in Sect. 4. The proofs for ROX, meanwhile, are more subtle, since they must be adapted to the quantum random oracle model. We give explicit proofs in the most interesting of these cases.

Andreeva et al. discuss eleven standard iterated hash constructions, proving exhaustively (with a few exceptions) which of the seven classical properties from [RS04] they preserve. These proofs are amenable to being “lifted” to a quantum setting by reasoning similar to that in Sect. 4: Each implication proof uses a reduction that satisfies the hypotheses of Lemma 1. Each separation combines an attack, which is still possible in a quantum setting given the nature of the games we consider, and a reduction, which also satisfies the hypotheses.

In contrast, we cannot use Lemma 1 to lift the proofs for the random-oracle model construction ROX. In particular, the reductions used cannot claim to run $A$ identically to an honest challenger, since they must simulate a pair of random oracles. This violates Hypothesis 3 of the lemma. Although the same results hold, the proofs must be explicitly adapted, which we do below.

5.1 ROX preserves all quantum properties

Definition 1 (ROX)

$\textsf{ROX}^{(H)}_{k}=\overline{\textsf{ROX}}^{(H)}_{k}\circ\textsf{pad}_{\text{ROX}}$

[TABLE]

where $\Lambda$ is the empty string; $\nu(i)$ is the largest integer such that $2^{\nu(i)}$ divides i; $\bar{x}$ is the first $n$ bits of $x$; $\text{{IV}}\in\{0,1\}^{d}$ is a fixed string; and

• •

$H\,:\,\{0,1\}^{n}\times\{0,1\}^{m}\to\{0,1\}^{d}$, where $b=m-d>0$ is the block size, and $d\geq 2b$;

• •

$\text{{RO}}_{1}\,:\,\{0,1\}^{2n+\log L}\to\{0,1\}^{d}$ and $\text{{RO}}_{2}\,:\,\{0,1\}^{n+2\log L}\to\{0,1\}^{2n}$ are random oracles, where $L$ is the maximum input size in blocks; and

• •

$\text{{trunc}}_{b}$ truncates its input to a multiple of $b$ bits;

We denote the block length of $x$ as $\ell(x)=\left\lceil(|x|+2n)/b\right\rceil$, the number of padding blocks as $1\leq q_{2}(x)\leq\left\lceil\frac{b+2n-1}{2n}\right\rceil$, and the total oracle queries as $q(x)=\ell(x)+q_{2}(x)$.

Andreeva et al. [ANPS07] describe an iterated hash called ROX (Definition 1) that preserves all of the classical properties discussed in [RS04]. In addition to a compression function, ROX relies on two random oracles ($\text{{RO}}_{1,2}$), although it does not rely on this fact for all proofs. Specifically, ROX preserves aPre, Pre, aSec, and Sec in the random oracle (RO) model, and Coll, ePre, and eSec in the standard model.

We show that ROX also preserves the quantum analogs of these properties. Andreeva et al.’s standard-model proofs carry over nearly unchanged for CollQ, ePreQ, and eSecQ carry over nearly unchanged, so we omit those proofs. We show that ROX preserves aPreQ, PreQ, aSecQ, and SecQ, replacing the classical RO model with the QRO model.

We begin by stating the existence of some constructions using ROX that will be useful in our proofs. The full constructions are given in Appendix 0.C.

Lemma 2 (Extracting collisions on $H_{k}$ from collisions on

$\textsf{ROX}^{(H)}_{k}$)

Given $\hat{x},\hat{x}^{\prime}\in\text{\it{dom}}(\textsf{ROX}^{(H)}_{k})$ with $\hat{x}\not=\hat{x}^{\prime}$ and $\textsf{ROX}^{(H)}_{k}(\hat{x})=\textsf{ROX}^{(H)}_{k}(\hat{x}^{\prime})$, we can extract $x,x^{\prime}\in\text{\it{dom}}(H_{k})$ with $x\not=x^{\prime}$ and $H_{k}(x)=H_{k}(x^{\prime})$ except with probability $\frac{1}{2^{n}}$ using $\ell(\hat{x})+\ell(\hat{x}^{\prime})$ applications of $H$ and $q(\hat{x})+q(\hat{x}^{\prime})$ oracle queries.

Lemma 3 (Embedding inputs for $H_{k}$ into inputs for $\textsf{ROX}^{(H)}$)

Given an input $x$ for $H_{k}$ and an index $i$, we can create an input $\hat{x}$ for $\textsf{ROX}^{(H)}_{k}$ such that the input to the $i$th application of $H_{k}$ is $x$ using $i$ calls to $H$ and at most $\left\lceil\frac{b+2n-1}{2n}\right\rceil+i$ oracle queries. Moreover, an adversary $A$ making $q$ queries notices the change with probability at most $O(q^{2}/2^{n})$.

Lemma 4 (Extracting a preimage under $H$ from a preimage under $\textsf{ROX}^{(H)}$)

Given a key $k$ and a message $\hat{x}\in\{0,1\}^{*}$ with $\textsf{ROX}^{(H)}_{k}(\hat{x})=y$, we can generate a message $x\in\mathcal{M}$ with $H_{k}(x)=y$ using $\ell(x)-1$ calls to $H$ and $q(x)$ oracle queries.

We are now ready to prove that ROX preserves the properties from Sect. 3 in the QRO model. To conserve space, we only summarize our proofs here, providing the full proofs in Appendix 0.D.

Theorem 5.1 (ROX preserves aPreQ)

If $H$ is $(t^{\prime},\varepsilon^{\prime})$-aPreQ, then $\textsf{ROX}^{(H)}$ is $(t,\varepsilon)$-aPreQ with

[TABLE]

Proof summary.

We use a preimage target $y$ for $H$ as a preimage target for $\textsf{ROX}^{(H)}$. In the classical proof, $y$ is correctly distributed because an adversary would have to guess correctly some random points to query $\text{{RO}}_{1,2}$. This argument fails in the quantum setting. We instead use QRO programming to show that $y$ appears correctly distributed to a quantum adversary.

Theorem 5.2 (ROX preserves PreQ)

If $H$ is $(t^{\prime},\varepsilon^{\prime})$-PreQ then $\textsf{ROX}^{(H)}$ is $(t,\varepsilon)$-PreQ, where

[TABLE]

Proof summary.

An adversary for PreQ on $\textsf{ROX}^{(H)}$ can be run using a preimage target $y$ for $H$, since $y$ will appear to be correctly distributed. The argument is the same as that in the proof of Theorem 5.1, so we omit it here for brevity.

Theorem 5.3 (ROX preserves aSecQ)

If $H$ is $(t^{\prime},\varepsilon^{\prime})$-aSecQ then $\textsf{ROX}^{(H)}$ is $(t,\varepsilon)$-aSecQ with

[TABLE]

Proof summary

We embed a second-preimage target for $H$ into a second-preimage target for $\textsf{ROX}^{(H)}$ by adaptively programming $\text{{RO}}_{1,2}$. We argue that reprogramming the random oracles in this way is imperceptible to the adversary.

Theorem 5.4 (ROX preserves SecQ)

If $H$ is $(t^{\prime}\varepsilon^{\prime})$-SecQ then $\textsf{ROX}^{(H)}$ is $(t,\varepsilon)$-SecQ, where

[TABLE]

Proof summary.

Similarly to Theorem 5.3, here we embed a second-preimage target for $H$ into one for $\textsf{ROX}^{(H)}$ by programming $\text{{RO}}_{1,2}$. Since we do not need to program adaptively, however, the programming is straightforward. The proof is similar to that of Theorem 5.3, so we omit it here for brevity.

Appendix 0.A CLAPS separation proofs

Here we show that CLAPS does not imply aPreQ, aSecQ, or ePreQ, completing the diagram in Fig. 2.

0.A.1 $\text{{CLAPS}}\nrightarrow\text{{aPreQ}}$

Theorem 0.A.1

If a collapsing function family exists, then there is a function family $H$ that is $(t,\varepsilon)$-CLAPS with negligible $\varepsilon$, but with $\text{{Adv}}^{\text{{aPreQ}}}_{H}=1$.

Proof summary:

Since the key $k$ in the collapsing game is chosen uniformly at random, a collapsing function can have a constant number of “bad” keys that, for example, result in a constant function $H_{k}$. Finding a preimage for such a function is obviously trivial. Given a collapsing function $F$, we exhibit a function $H$ that is collapsing, but for which $\text{{Adv}}^{\text{{aPreQ}}}_{H}=1$.

Proof

Suppose $F:\{0,1\}^{n}\times\{0,1\}^{m}\to\{0,1\}^{d}$ is $(t,\varepsilon)$-CLAPS, and define $H$ as follows:

[TABLE]

Lemma 5

$H$* is $(t,\varepsilon^{\prime})$-CLAPS, where $\varepsilon^{\prime}=\varepsilon-\frac{1}{2^{n}}$.*

The obvious adversary suffices to break aPreQ on $H$: $A$ picks $k=0^{n}$, and $B$ outputs any $x$. Since we assume $\varepsilon$ to be negligible, $\varepsilon^{\prime}$ is negligible as well, and the theorem is immediate from Lemma 5.

Proof (Proof of Lemma 5)

Let $(A,B)$ be a correct qpt adversary with $\text{{Adv}}^{\text{{CLAPS}}}_{H}(A,B)=\varepsilon^{\prime}$. We construct a correct qpt adversary $(A^{\prime},B^{\prime})$ for $F$ as follows:

Constructing $(A^{\prime},B^{\prime})$ from $(A,B)$

$A^{\prime}(1^{n},k)$:

If $k=0^{n}$, FAIL. Otherwise…

Run $A(1^{n},k)$ to get $S,X,y$ with $\Pr[H_{k}(\mathcal{M}(X))=y]=1$.

Send the challenger $S,X,y$.

$B^{\prime}(1^{n},S,X)$:

Run $B(1^{n},S,X)$ to get $b$.

Send $b$ to the challenger.

We claim that $(A^{\prime},B^{\prime})$ is correct: If $A^{\prime}$ does not fail, then $k\not=0^{n}$, and by the premise that $(A,B)$ is correct, $\Pr[F_{k}(\mathcal{M}(X))=y]=\Pr[H_{k}(\mathcal{M}(X))=y|k\not=0]=1$.

Suppose $A^{\prime}$ doesn’t fail, and the challenger for $(A^{\prime},B^{\prime})$ is running $\Game_{1}$. Then $B$ receives $S,\mathcal{M}(X)$, and $(A,B)$ sees $\Game_{1}$. On the other hand, if the challenger for $(A^{\prime},B^{\prime})$ is running $\Game_{2}$, $X$ is unmeasured, and $(A,B)$ sees $\Game_{2}$.

Since the probability that $A^{\prime}$ fails is $\Pr[k=0^{n}]=\frac{1}{2^{n}}$, $\text{{Adv}}^{\text{{CLAPS}}}_{F}(A^{\prime},B^{\prime})\geq\varepsilon^{\prime}-\frac{1}{2^{n}}$. Therefore $\text{{Adv}}^{\text{{CLAPS}}}_{H}\leq\text{{Adv}}^{\text{{CLAPS}}}_{F}+\frac{1}{2^{n}}=\text{\it{negl}}(n)$.

0.A.2 $\text{{CLAPS}}\nrightarrow\text{{aSecQ}}$

Theorem 0.A.2

If a collapsing function family exists, then there is a function family $H$ that is $(t,\varepsilon)$-CLAPS with negligible $\varepsilon$, but with $\text{{Adv}}^{aSec}_{H}=1$.

Proof summary:

This proof uses the same $H$ as the proof of Theorem 0.A.1. Given a collapsing function $F$, this $H$ is also collapsing, but has a single “bad” key $\hat{k}$ s.t. $H_{\hat{k}}(x)=0^{d}$, $\forall x\in\{0,1\}^{m}$. If an adversary can control the key and chooses $\hat{k}$, then whichever $x$ the challenger picks, any other element of $\text{\it{dom}}(H_{k})$ is a second preimage. Since the proof is identical to Theorem 0.A.1, we omit it for brevity.

0.A.3 $\text{{CLAPS}}\nrightarrow\text{{ePreQ}}$

Theorem 0.A.3

If a collapsing function family exists, then there is a function family $H$ that is $(t,\varepsilon)$-CLAPS with negligible $\varepsilon$, but $\text{{Adv}}^{ePre}_{H}=1$.

Proof summary:

If the image $\hat{y}$ of some element $x$ in the domain of $H$ is fixed, regardless of the key $k$, then an adversary can find a preimage of an element $y$ of his choice easily: All he must do is choose $y=\hat{y}$, and whatever $k$ the adversary picks, $x$ is a preimage. But if $x$ is the only preimage of $y$, this property does not help in creating superpositions of preimages to use in the collapsing game. So $H$ may still be collapsing.

Proof

Suppose $F:\{0,1\}^{n}\times\{0,1\}^{m}\to\{0,1\}^{d-1}$ is $(t,\varepsilon)$-CLAPS. We define a new function $H:\{0,1\}^{n}\times\{0,1\}^{m}\to\{0,1\}^{d}$ as follows:

[TABLE]

Lemma 6

$H$* is $(t,\varepsilon)$-CLAPS.*

The obvious adversary suffices to break ePreQ on $H$: $A$ picks $y=0^{d}$ and $B$ outputs $0^{m}$. Thus, the theorem is immediate from Lemma 6.

Proof (Proof of Lemma 6)

Let $(A,B)$ be a correct qpt adversary with $\text{{Adv}}^{CLAPS}_{H}(A,B)=\varepsilon^{\prime}$. We construct a qpt adversary $(A^{\prime},B^{\prime})$ for $F$ as follows:

Constructing $(A^{\prime},B^{\prime})$ from $(A,B)$

$A^{\prime}(1^{n},k)$:

Run $A(1^{n},k)$ to get $S,X,y$ with $\Pr[H_{k}(\mathcal{M}(X))=y]=1$.

Measure $\mathcal{M}_{F}(X)$ to get $y^{\prime}$.

Send $S,X,y^{\prime}$ to the challenger.

$B^{\prime}(1^{n},S,X)$:

Run $B(S,X,y)$ to get $b$.

Send $b$ to the challenger.

$(A^{\prime},B^{\prime})$ is correct by construction. We claim that $\text{{Adv}}^{CLAPS}_{F}(A^{\prime},B^{\prime})\geq\epsilon$. Consider the following cases:

Suppose $y=0^{d}$. Then by the premise that $(A,B)$ is correct, $X=\ket{0^{m}}$, since $0^{m}$ is the only preimage of $0^{d}$. In this case $\Game_{1}=\Game_{2}$, since $X=\mathcal{M}(X)$, so $|\Pr[b=1\,:\,\Game_{1}]-\Pr[b=1\,:\,\Game_{2}]|=0$ for both $(A,B)$ and $(A^{\prime},B^{\prime})$. 2. 2.

Suppose $y\not=0^{d}$, and the challenger for $(A,B)$ is running $\Game_{1}$. Then $B$ receives $\mathcal{M}(X)$, so $B$ sees $\Game_{2}$. 3. 3.

Suppose $y\not=0^{d}$, and the challenger for $(A,B)$ is running $\Game_{2}$. By the premise that $(A,B)$ is correct, when $A$ produces $X$,

[TABLE]

So the measurement at step 2 of $A^{\prime}$ does not collapse $X$. Hence, $B$ sees $\Game_{2}$.

Therefore $\text{{Adv}}^{CLAPS}_{F}(A^{\prime},B^{\prime})=\varepsilon^{\prime}$.

Appendix 0.B $\text{{aPreQ}}\equiv\text{{aPreSQ}}$

Theorem 0.B.1

Equations 4 and 11 are equivalent. I.e., $\text{{Adv}}^{\text{{aPreQ}}}_{H}=\text{{Adv}}^{\text{{aPreSQ}}}_{H}$

Proof (Proof of Theorem 0.B.1)

Let each part $A$, $B$ of the adversary be a unitary operator and let $n=\left\lceil\lg|\mathcal{K}|\right\rceil$ be the size of a key, $m=\left\lceil\lg|\mathcal{M}|\right\rceil$ be the size of a message, and $d=\left\lceil\lg|\mathcal{D}|\right\rceil$ be the size of a digest. We illustrate the circuits for three games in Figure 3.

Lemma 7

Game 1 is equivalent to Game 2.

Lemma 8

Game 2 is equivalent to Game 3.

We claim that the theorem follows from Lemmas 7 and 8. Note that Game 1 is exactly the aPreSQ game, as defined in Equation 11. In Game 3, the output of $A$ and $B$, with the exception of the state register $S$, are measured immediately, so without loss of generality, we may assume that their output is classical. Thus Game 3 is equivalent to the aPreQ game (Equation 4).

In the following two proofs, let $\mathcal{M}_{n}$ denote measuring the first $n$ qubits in the standard basis and leaving the rest untouched. In other words,

[TABLE]

Proof (Proof of Lemma 7)

It suffices to show that for any unitary $B$ and all $x\in\{0,1\}^{n}$, $(\ket{x}\bra{x}\otimes\mathbb{I})$ commutes with $(\mathbb{I}_{n}\otimes B)$. This is immediate, since $(\mathbb{I}_{n}\otimes B)(\ket{x}\bra{x}\otimes\mathbb{I})=\ket{x}\bra{x}\otimes B$.

Proof (Proof of Lemma 8)

We must show that $U_{H(x^{\prime})}$ commutes with $\mathcal{M}_{n}$. Since

[TABLE]

is a unitary operator that leaves the $K$ register untouched, it can be viewed as using the $K$ register solely as control bits for CNOT gates, interspersed with unitaries on the $Y$ register. Let $\text{{CNOT}}_{i,j}$ denote a CNOT gate with control $i$ and target $j$, and $V$ denote an arbitrary unitary that acts on the $Y$ register. Then for $0\leq i_{\ell}\leq n$ and $n+1\leq j_{\ell}\leq n+d$ for all $0\leq\ell\leq q]$,

[TABLE]

Given the definition of $\mathcal{M}_{n}$ in Equation 24, we must show all the factors in Equation 25 commute with $\ket{x}\bra{x}\otimes\mathbb{I}_{d}$. Clearly this is the case for $\mathbb{I}^{n}\otimes V_{\ell}$, by the same reasoning as in the proof of Lemma 7. Similarly, it is well known that measurement of the control qubit commutes with CNOT.

Appendix 0.C ROX constructions

0.C.1 Extracting compression-function collisions

(Lemma 2)

Proof (Proof of Lemma 2)

We claim that the following procedure extracts a compression-function with overwhelming probability:

Extract-Collision(${k,\hat{x},\hat{x}^{\prime}}$)

Let ${b}_{1}\|\dots\|{b}_{\ell}=\textsf{pad}_{\text{ROX}}(\hat{x})$ and ${b^{\prime}}_{1}\|\dots\|{b^{\prime}}_{\ell^{\prime}}=\textsf{pad}_{\text{ROX}}(\hat{x}^{\prime})$.

Let $x_{i}=b_{i}\|\overline{\textsf{ROX}}^{(H)}_{k}({b}_{1}\|\dots\|{b}_{i-1})$ and $x^{\prime}_{i}=b^{\prime}_{i}\|\overline{\textsf{ROX}}^{(H)}_{k}({b^{\prime}}_{1}\|\dots\|{b^{\prime}}_{i-1})$.

For $i=0$ to $\min(\ell,\ell^{\prime})$ …

If $x_{\ell-i}\not=x^{\prime}_{\ell^{\prime}-i}$, output $(x=x_{\ell-i},x^{\prime}=x^{\prime}_{\ell^{\prime}-i},i^{*}=\ell-i)$.

Let $\bar{x},\bar{x}^{\prime}$ and be the first $n$ bits of $\hat{x},\hat{x}^{\prime}$, and $\lambda,\lambda^{\prime}$ be their respective lengths. We must show that there always exists a colliding pair $(x,x^{\prime})$. We consider two cases:

• •

Case i. Suppose $\bar{x}\not=\bar{x}^{\prime}$ or $\lambda\not=\lambda^{\prime}$. Then since $x_{\ell}$ and $x_{\ell^{\prime}}^{\prime}$ each contains at least one full output from $\text{{RO}}_{2}$, $x_{\ell}\not=x_{\ell^{\prime}}^{\prime}$ except with probability $\delta=\frac{1}{2^{n}}$. In this case the inputs to the last application of $H_{k}$ form a collision for $H_{k}$.

• •

Case ii. Otherwise, $\bar{x}=\bar{x}^{\prime}$ and $\lambda=\lambda^{\prime}$. In this case, the padding applied to $\hat{x}$ and $\hat{x}^{\prime}$ will be identical. But the mask schedule taken from $\text{{RO}}_{1}$ will be identical as well. So since $\hat{x}\not=\hat{x}^{\prime}$, there must be block pair, $(b_{i^{*}},b^{\prime}_{i^{\prime*}})$ on which they differ. Since the masks and padding match, these form a collision for $H_{k}$.

0.C.2 Embedding messages (Lemma 3)

Proof (Proof of Lemma 3)

Let $h\|g=x$, where $|h|=b$ and $|g|=d$, and define the following procedure:

Embed-Message(${x,i}$)

Generate a random message $\hat{x}$ of length $\lambda\geq bi$.

If $i=1$, let $\bar{x}$ be the first $n$ bits of $x$, adding bits from $\hat{x}$, starting with the $(m+1)$st, if $x$ isn’t long enough. Otherwise, let $\bar{x}$ be the first $n$ bits of $\hat{x}$.

Let $h_{1}\|\dots\|h_{\ell}=\textsf{pad}_{\text{ROX}}(\hat{x})$ with $|h_{j}|=b$.

Evaluate $\mu_{i}=\overline{\textsf{ROX}}^{(H)}_{k}(x_{1}\|\dots\|x_{i-1})$.

Program $\text{{RO}}_{1}(\bar{x},k,\nu(i))$ with $g\oplus\mu_{i}$.

Program the $q^{\prime}\leq q_{2}(\hat{x})$ outputs of $\text{{RO}}_{2}$ contained in $h_{i}$ with $x$.

Let $\hat{x}^{\prime}$ be the first $\lambda$ bits of $h_{1}\|\dots\|h_{i-1}\|h\|h_{i+1}\|\dots\|h_{\ell}$.

Output $\hat{x}^{\prime}$.

In steps 5 and 6, the above procedure requires us to program a random oracle. To do so, we invoke witness search from [ES15], where a witness is some image of $\text{{RO}}_{1,2}$ corresponding to an input that starts with $\bar{x}$. Since $\bar{x}$ is chosen at random, and since the codomains of $\text{{RO}}_{1,2}$ are much larger than their domains, the random search problem in [HRS16] can be reduced to this, with $2^{n}$ marked items in a set of $2^{b-n}\geq 2^{n}$, so the success probability is $O(q^{2}/2^{n})$.

0.C.3 Extracting compression-function preimages

(Lemma 4)

Proof (Proof of Lemma 4)

We claim that the following procedure extracts a collision-function preimage with overwhelming probability:

Extract-Preimage(${k,\hat{x}}$)

Evaluate $\textsf{ROX}^{(H)}_{k}(x)$ up to the last application of $H_{k}$. Namely let

$\displaystyle{x}_{1}\|\dots\|{x}_{\ell}=\textsf{pad}_{\text{ROX}}(x)$

$\displaystyle x=x_{\ell}\|\overline{\textsf{ROX}}^{(H)}_{k}({x}_{1}\|\dots\|{x}_{\ell-1})\oplus\text{{RO}}_{1}(\hat{x},k,\ell)$

Output $x$.

By construction, $H_{k}(x)=y$ as desired. The only calls to $H$ and $\text{{RO}}_{1},\text{{RO}}_{2}$ are in the partial computation of $\textsf{ROX}^{(H)}(x)$. Since we omit one call to $H$, the procedure calls it $\ell(x)-1$ times.

Appendix 0.D ROX property-preservation proofs

0.D.1 ROX preserves aPreQ

Proof (Proof of Theorem 5.1)

Let $(A,B)$ be a $(t,\varepsilon)$ quantum adversary for aPreQ on $\textsf{ROX}^{(H)}$, making $q=\text{\it{poly}}(n)$ oracle queries. We construct an adversary $(A^{\prime},B^{\prime})$ for $H$ using an additional $\text{\it{poly}}(n)$ oracle queries:

Constructing $(A^{\prime},B^{\prime})$ from $(A,B)$

$A^{\prime}(1^{n})$:

Run $k,S\leftarrow A^{\text{{RO}}_{1,2}}(1^{n})$, simulating quantum oracles $\text{{RO}}_{1,2}$.

Output $k,S$.

$B^{\prime}(1^{n},S,y)$:

Run $x\leftarrow B^{\text{{RO}}_{1,2}}(1^{n},S,y)$.

Run Extract-Preimage(${k,x}$) to obtain a preimage $x^{\prime}$ for $y$ under $H_{k}$.

Output $x^{\prime}$.

By Lemma 4, if $\textsf{ROX}^{(H_{k})}(x)=y$, then $H_{k}(x^{\prime})=y$, and $A^{\prime}$ wins the aPreQ-game. Note that $y=H_{k}(g^{\prime}\|h^{\prime})$ for $g^{\prime}\|h^{\prime}$ chosen at random, while $A$ would expect a $\hat{y}$ to be $H_{k}(g\|h)$, where $g$ contains at least $2b$ bits of $\text{{RO}}_{2}(\bar{x},\cdot)$, and $h=d\oplus\text{{RO}}_{1}(\bar{x},\cdot)$ for some $d$. The view of $(A,B)$ in the simulated run in $(A^{\prime},B^{\prime})$ is thus identical to the real aPreQ-game, unless $(A,B)$ can distinguish $y$ and $\hat{y}$ using at most $q$ queries. We show that $A$ can distinguish them with probability at most $q^{2}/{2^{n}}$. Hence $\text{{Adv}}^{\text{{aPreQ}}}_{H}(A^{\prime},B^{\prime})\geq\varepsilon-q^{2}/2^{n}$.

We argue that if some challenger that knew $x$ were to reprogram $\text{{RO}}_{1,2}$ on inputs corresponding to $x$, no algorithm would be able to discover this except with negligible probability. In the Witness-Search game from [ES15], let $P(w)$ output 1 if and only if $\text{{RO}}_{2}(w,|x|,j)=g$ and $\overline{\textsf{ROX}}^{(H)}_{k}(x_{1}\|\dots\|x_{\ell})\oplus\text{{RO}}_{1}(w,k,i)=h$ for some $1\leq~{}i,j\leq|x|$. Next, let $w=\bar{x}$ and $pk=(k,|x|)$. This amounts to finding a preimage with a suffix from a set in a random function. Hence $\text{{Adv}}^{WS}_{\text{{Samp}}}(A)\leq O(q^{2}/{2^{d}})$ by reducing a random search problem developed in [HRS16] to it. Thus we can safely reprogram $\text{{RO}}_{1,2}$ at points corresponding to $P$ being true, and $h,g$ are indistinguishable from the random values supplied by $B^{\prime}$.

0.D.2 ROX preserves aSecQ

Proof (Proof of Theorem 5.3)

Let $(A,B)$ be a $(t,\varepsilon)$ adversary for aSecQ on $\textsf{ROX}^{(H)}$ making $q=\text{\it{poly}}(n)$ oracle queries. We construct an adversary $(A^{\prime},B^{\prime})$ for $H$, using an additional $\left\lceil\frac{b+2n-1}{2n}\right\rceil+\text{\it{poly}}(n)$ oracle queries:

Constructing $(A^{\prime},B^{\prime})$ from $(A,B)$

$A^{\prime}(1^{n})$:

Run $k,S\leftarrow A^{\text{{RO}}_{1,2}}(1^{n})$, simulating quantum oracles $RO_{1,2}$.

Output $k,S$.

$B^{\prime}(1^{n},S,x)$:

Choose an index $i\leq\text{\it{poly}}(n)$.

Run Embed-Message(${x,i}$) to get $\hat{x}\in\text{\it{dom}}(\textsf{ROX}^{(H)}_{k})$ with $x$ embedded as the input to the $i$th application of $H_{k}$.

Run $B^{\text{{RO}}_{1,2}}(1^{n},S,\hat{x}^{\prime})$, to get $\hat{x}^{\prime}$.

Run Extract-Collision(${k,\hat{x},\hat{x}^{\prime}}$) to get $(x,x^{\prime},i^{*})$.

If $i^{*}\not=i$, FAIL. Output $x^{\prime}$.

By Lemma 3, Embed-Message adds an additional $i=\text{\it{poly}}(n)$ applications of $H$ and an additional $\left\lceil\frac{b+2n-1}{2n}\right\rceil+i$ oracle queries and alters the success probability of $A$ by at most $O(q/2^{n})=\text{\it{poly}}(n)/2^{n}$, where $q=\text{\it{poly}}(n)$ is the number of queries $A$ makes. By Lemma 2, Extract-Collision adds $\ell(\hat{x})+\ell(\hat{x}^{\prime})=\text{\it{poly}}(n)$ applications of $H$ and $q(\hat{x})+q(\hat{x}^{\prime})=\text{\it{poly}}(n)$ oracle queries and fails w.p. $\frac{1}{2^{n}}$. Assuming both succeed, $i=i^{*}$ w.p. $\frac{1}{\text{\it{poly}}(n)}$. Hence $\text{{Adv}}^{\text{{aSecQ}}}_{H}(A^{\prime},B^{\prime})\geq\varepsilon(1-q/2^{n})(1-1/2^{n})/\text{\it{poly}}(n)$.