Computationally-secure and composable remote state preparation

TL;DR

This paper presents a secure, composable protocol enabling a classical verifier to delegate the preparation of specific single-qubit quantum states to a quantum prover, enhancing quantum cryptographic protocols without requiring quantum communication from the verifier.

Contribution

It introduces a novel, secure, and composable remote state preparation protocol that reduces quantum communication needs in delegated quantum computation.

Findings

Protocol achieves computational security for state preparation

Enables verification of successful state preparation

Applicable to measurement-based quantum computation

Abstract

We introduce a protocol between a classical polynomial-time verifier and a quantum polynomial-time prover that allows the verifier to securely delegate to the prover the preparation of certain single-qubit quantum states. The protocol realizes the following functionality, with computational security: the verifier chooses one of the observables $Z$, $X$, $Y$, $(X+Y)/\sqrt{2}$, $(X-Y)/\sqrt{2}$; the prover receives a uniformly random eigenstate of the observable chosen by the verifier; the verifier receives a classical description of that state. The prover is unaware of which state he received and moreover, the verifier can check with high confidence whether the preparation was successful. The delegated preparation of single-qubit states is an elementary building block in many quantum cryptographic protocols. We expect our implementation of "random remote state preparation with verification", a functionality first defined in (Dunjko and Kashefi 2014), to be useful for removing the need for quantum communication in such protocols while keeping functionality. The main application that we detail is to a protocol for blind and verifiable delegated quantum computation (DQC) that builds on the work of (Fitzsimons and Kashefi 2018), who provided such a protocol with quantum communication. Recently, both blind an verifiable DQC were shown to be possible, under computational assumptions, with a classical polynomial-time client (Mahadev 2017, Mahadev 2018). Compared to the work of Mahadev, our protocol is more modular, applies to the measurement-based model of computation (instead of the Hamiltonian model) and is composable. Our proof of security builds on ideas introduced in (Brakerski et al. 2018).

Equations

$$\frac{1}{\sqrt{2}}\big{(}\ket{0}\ket{x_{0}}+\ket{1}\ket{x_{1}}\big{)}\;,$$

$$|{\psi }_{\theta }⟩=\frac{1}{\sqrt{2}}{\omega }^{d\cdot x_0}(|0⟩+{\omega }^{d\cdot (x_0+x_1)}|1⟩),$$

$$\forall\lambda\;,\qquad\mbox{\rm Tr}_{B_{\lambda}}\big{(}C_{\lambda}(\ket{0}\!\bra{0}_{A_{\lambda}}\otimes\ket{0}\!\bra{0}_{B_{\lambda}})\big{)}=\rho_{\lambda}\;.$$

$$\forall\lambda\;,\forall\rho\in\mathrm{D}(\mathcal{H}_{A_{\lambda}})\;,\qquad\mbox{\rm Tr}_{A_{\lambda}C_{\lambda}}\big{(}C_{\lambda}(\rho\otimes\ket{0}\!\bra{0}_{B_{\lambda}C_{\lambda}})\big{)}=\mathcal{F}_{\lambda}(\rho_{\lambda})\;.$$

$$\forall\lambda\geq\lambda_{0}\;,\qquad\frac{1}{2}\big{|}\mbox{\rm Tr}\big{(}D_{\lambda}^{\dagger}(\ket{0}\!\bra{0}\otimes\mathop{\rm Id}\nolimits)D_{\lambda}\rho_{\lambda}\big{)}-\mbox{\rm Tr}\big{(}D_{\lambda}^{\dagger}(\ket{0}\!\bra{0}\otimes\mathop{\rm Id}\nolimits)D_{\lambda}\sigma_{\lambda}\big{)}\big{|}\,\leq\,\delta(\lambda)\;.$$

$$\frac{1}{2}\big{|}\mbox{\rm Tr}\big{(}D_{\lambda}^{\dagger}(\ket{0}\!\bra{0}\otimes\mathop{\rm Id}\nolimits)D_{\lambda}\rho_{\lambda}\big{)}-\mbox{\rm Tr}\big{(}D_{\lambda}^{\dagger}(\ket{0}\!\bra{0}\otimes\mathop{\rm Id}\nolimits)D_{\lambda}\sigma_{\lambda}\big{)}\big{|}\,\leq\,\|\rho_{\lambda}-\sigma_{\lambda}\|_{1}$$

$$\big{|}\mbox{\rm Tr}(D_{\lambda}^{\dagger}(\ket{0}\!\bra{0}\otimes\mathop{\rm Id}\nolimits)D_{\lambda}\rho_{\lambda})-\mbox{\rm Tr}(D_{\lambda}^{\dagger}(\ket{0}\!\bra{0}\otimes\mathop{\rm Id}\nolimits)D_{\lambda}\sigma_{\lambda})\big{|}\\ \leq\sum_{b}\big{|}\mbox{\rm Tr}((D_{\lambda}^{b})^{\dagger}(\ket{0}\!\bra{0}\otimes\mathop{\rm Id}\nolimits)D_{\lambda}^{b}\rho_{\lambda}^{b})-\mbox{\rm Tr}((D_{\lambda}^{b})^{\dagger}(\ket{0}\!\bra{0}\otimes\mathop{\rm Id}\nolimits)D_{\lambda}^{b}\sigma_{\lambda}^{b})\big{|}\;,$$

$${\mathcal{R}}_1{\approx }_{c,\epsilon }{\mathcal{R}}_2.$$

$$\big{\|}(R-V^{\dagger}SV)\otimes\mathop{\rm Id}\nolimits_{{\textsf{B}}}\ket{\psi}\big{\|}^{2}=O(\delta).$$

$$Z{\simeq }_{{\delta }^{\prime }}{\sigma }_Z\otimes \mathrm{Id},X{\simeq }_{{\delta }^{\prime }}{\sigma }_X\otimes \mathrm{Id},\text{and}{X}^{\prime }{\simeq }_{{\delta }^{\prime }}{\sigma }_X\otimes A_X+{\sigma }_Y\otimes A_Y.$$

$${\rho }_{\theta }+{\rho }_{\pi +\theta }=\mathrm{Id}.$$

$$\text{mbox}{\mathrm{Tr}}_A\circ {\mathcal{P}}_{AB}({\psi }_{ABR}){\approx }_{c,\delta }\mathcal{F}\circ \text{mbox}{\mathrm{Tr}}_A({\psi }_{ABR}),$$

$${\rho }_{A{R}_1}^{\psi }{\approx }_{c,\delta }{p}^{\psi }(\mathcal{U}\otimes {\mathrm{Id}}_{R_1})({\psi }_{A{R}_1})+(1-p^{\psi })|ERR⟩⟨ERR|\otimes {\psi }_{R_1},$$

$$\text{mbox}{\mathrm{Tr}}_A\circ Q_{A{B}^{\prime }}\circ {\mathcal{P}}_{AB}({\psi }_{ABR}){\approx }_{c,\delta }\text{mbox}{\mathrm{Tr}}_A\circ {\mathcal{P}}_{AB{B}^{\prime }}^{\prime },$$

$${\rho }_{A{R}_1{R}_{2}B}^{\psi }{\approx }_{c,\delta }(\mathcal{U}\otimes {\mathrm{Id}}_{R_1{R}_2}\otimes {\mathcal{F}}^{ok})({\psi }_{A{R}_1}\otimes {\psi }_{R_{2}B})+|ERR⟩⟨ERR|\otimes {\psi }_{R_1}\otimes ({\mathrm{Id}}_{R_2}\otimes {\mathcal{F}}^{err})({\psi }_{R_{2}B}).$$

$${\mathcal{F}}^{ok}=\text{mbox}{\mathrm{Tr}}_{B^{\prime }}\circ {\mathcal{P}}_{B^{\prime }}^{ok}\circ {\mathcal{F}}^{\prime },{\mathcal{F}}^{err}=\text{mbox}{\mathrm{Tr}}_{B^{\prime }}\circ {\mathcal{P}}_{B^{\prime }}^{err}\circ {\mathcal{F}}^{\prime },$$

$${\rho }_{A{R}_1{R}_{2}B}^{\psi }={\varphi }_{ARB}^{ok}+|ERR⟩⟨ERR|\otimes {\varphi }_{RB}^{err}.$$

$$\frac{1}{4}\sum_{u\in\{1,3,5,7\}}\frac{1}{2}\sum_{i\in\{0,2\}}\mbox{\rm Tr}\big{(}X_{i}^{u_{i}}\phi_{u}\big{)}\;.$$

$$\frac{1}{4}\sum_{u\in\{1,3,5,7\}}\mbox{\rm Tr}\big{(}\{X_{0},X_{2}\}^{2}\phi_{u}\big{)}\,=\,O({\delta})\;.$$

$$\frac{1}{\sqrt{2}}\big{(}e^{\frac{2i\pi}{8}d\cdot J(x_{0})}\ket{0}\ket{x_{0}}+e^{\frac{2i\pi}{8}d\cdot J(x_{1})}\ket{1}\big{)}\;,$$

$$\frac{1}{\sqrt{2}}\big{(}\ket{0}\ket{x_{0}}+\ket{1}\ket{x_{1}}\big{)}\;,$$

$$\frac{1}{\sqrt{2}}\big{(}e^{\frac{2i\pi}{8}d\cdot J(x_{0})}\ket{0}\ket{x_{0}}+e^{\frac{2i\pi}{8}d\cdot J(x_{1})}\ket{1}\big{)}\;,$$

$$\sum _b|b⟩⟨b|\otimes |b⟩⟨b|\otimes |\text{textsc}aux⟩⟨\text{textsc}aux|.$$

$$\sum _{\theta \in \{0,1,2,3\},v\in \{0,1\}}|\theta ⟩⟨\theta |\otimes |v⟩⟨v|\otimes |{+}_{\theta \frac{\pi }{4}+v\pi }⟩⟨{+}_{\theta \frac{\pi }{4}+v\pi }|\otimes |\text{textsc}aux⟩⟨\text{textsc}aux|.$$

$${\varphi }_y=({\mathrm{Id}}_{\text{D}}\otimes {⟨y|}_{\text{Y}})\varphi ({\mathrm{Id}}_{\text{D}}\otimes {|y⟩}_{\text{Y}})\in \mathrm{Pos}({\mathcal{H}}_{\text{D}}).$$

$$\phi_{y,\theta,v}\,=\,\sum_{d:\,(\hat{\theta}(d),\hat{v}(d))=(\theta,v)}\big{(}\mathop{\rm Id}\nolimits_{\textsf{Y}}\otimes M_{y}^{d}\big{)}\,\phi_{y}\,\big{(}\mathop{\rm Id}\nolimits_{\textsf{Y}}\otimes M_{y}^{d}\big{)}\;.$$

$$|{\varphi }_y^{\prime }⟩=\sum _{b\in \{0,1\}}|b,x_b⟩|{\varphi }_{y,b}⟩,$$

$$|{\varphi }_y^{\prime }⟩=|\hat{b},x_{\hat{b}}⟩|{\varphi }_{y,\hat{b}}⟩,$$

$$\sum_{d,b}\mbox{\rm Tr}\big{(}(M^{d}\Pi^{b}-Z^{b}M^{d})^{\dagger}(M^{d}\Pi^{b}-Z^{b}M^{d})\phi\big{)}\,\leq\,2\,\varepsilon+\operatorname{negl}(\lambda)\;.$$

$$\sum_{b,d}\mbox{\rm Tr}\big{(}Z^{b}M^{d}\Pi^{b}\phi\Pi^{b}M^{d}\big{)}\,\geq\,1-\,\varepsilon-\operatorname{negl}(\lambda)\;,$$

Full text

The delegated preparation of single-qubit states is an elementary building block in many quantum cryptographic protocols. We expect our implementation of “random remote state preparation with verification” ($\textsc{RSP}_{V}$), a functionality first defined in (Dunjko and Kashefi 2014), to be useful for removing the need for quantum communication in such protocols while keeping functionality.

The main application that we detail is to a protocol for blind and verifiable delegated quantum computation (DQC) that builds on the work of (Fitzsimons and Kashefi 2018), who provided such a protocol with quantum communication. Recently, both blind an verifiable DQC were shown to be possible, under computational assumptions, with a classical polynomial-time client (Mahadev 2017, Mahadev 2018). Compared to the work of Mahadev, our protocol is more modular, applies to the measurement-based model of computation (instead of the Hamiltonian model) and is composable. Our proof of security builds on ideas introduced in (Brakerski et al. 2018).

1. 1 Introduction

2. 1.1 Our results

3. 1.2 Remote state preparation: ideal resource

4. 1.3 Remote state preparation: real protocol

5. 1.4 Application: delegated computation

6. 2 Preliminaries

7. 2.1 Notation

8. 2.2 Efficient states and operations

9. 2.3 Computational distinguishability

10. 2.4 Composable security

11. 2.5 Rigidity

12. 2.6 Delegated quantum computation

13. 2.6.1 Ideal functionalities

14. 2.6.2 Local criteria

15. 3 Remote state preparation: real protocol

16. 3.1 Quantum random access codes

17. 3.2 The qubit preparation test

18. 3.3 Rigidity

19. 3.3.1 Devices

20. 3.3.2 Preimage test

21. 3.3.3 $Z$-measurement test

22. 3.3.4 $X_{\theta}$-measurement test, part A

23. 3.3.5 $X_{\theta}$-measurement test, part B

24. 3.4 Real protocol for remote state preparation

25. 4 Remote state preparation: ideal functionality

26. 5 Blind and verifiable computation from remote state preparation

27. A Claw-free functions with adaptive hardcore

28. A.1 The adaptive hardcore property

29. A.2 The collapsing property

1 Introduction

In the problem of delegated computation a user (often referred to as client or verifier) is provided as input a pair $(C,x)$ of a circuit $C$ and an input $x$ for the circuit. The verifier’s task is to evaluate $C(x)$ as efficiently as possible. For this the verifier may delegate some or all of the computation to a powerful but untrusted server (often referred to as the prover). Let $n$ be the length of $x$ and $T$ the size of the circuit $C$. Ideally, the runtime of the verifier is (quasi-)linear in $n$ and poly-logarithmic in $T$, while the runtime of the prover is quasi-linear in $T$. (Reducing space usage, for both the verifier and the prover, is also of interest, but for simplicity we focus on time.)

A productive line of research in complexity and cryptography has led to protocols for delegated computation with increasing efficiency and whose soundness can be information-theoretic [GKR15] or based on cryptographic assumptions [Kil92, KRR14]. The latter type include protocols utilizing public-key cryptography and making standard cryptographic assumptions, such as [HR18], as well as non-interactive protocols based on more non-standard assumptions, such as [GGPR13]. In addition to the natural applications in cloud and distributed computing, research in delegated computation is motivated by cryptographic applications (such as short zero-knowledge proofs [Gro10, BSCG*+*13]) and connections to complexity theory (such as the theory of multiprover interactive proof systems [KRR14] and probabilistically checkable proofs [GKR15]).

In this paper we are concerned with the problem of delegating quantum computations (DQC). Here the verifier is provided as input the classical description of a quantum circuit $C$, as well as a classical input $x$ for the circuit, and its goal is to obtain the result of a measurement of the output qubit of $C$ in the computational basis, when it is executed on $x$.333For simplicity we restrict to circuits that take classical inputs and return a single classical output bit obtained as the result of a measurement that is promised to return a particular value, [math] or $1$, with probability at least $\frac{2}{3}$. This setting corresponds to delegating decision problems, i.e. problems in which the output is a single bit. Our results also apply to the setting of relational or sampling problems for which the output consists of multiple bits. In this context the main question is the following: What security guarantees can DQC protocols achieve, and at what cost?

To gain an understanding of the current landscape around this question we briefly discuss the most relevant known results, referring to [GKK] for a more extensive treatment. First we note that DQC protocols come with two related but seemingly independent types of security guarantee: blindness and verifiability. A DQC protocol is said to be blind if throughout the interaction the prover does not learn anything about the delegated computation except for an upper bound on its size. A DQC protocol is said to be verifiable if it is unlikely for the prover to succeed in convincing the verifier to accept a false statement. The question of blind delegation of quantum computation was first considered by Childs [Chi01], who gave such a protocol with quantum communication. Verifiable delegation of quantum computation was formalized in [ABOE08, BFK09] (see also [ABOEM17, FK17]); the authors gave protocols for verifiable DQC, and just like Childs’ protocol, these protocols also require quantum communication.

Next we consider the question of efficiency of DQC protocols, focusing on the amount of quantum communication required as a measure of the verifier’s “quantum effort”. A first class of protocols, such as those from [ABOE08, BFK09], are known as prepare-and-send protocols. This is because the verifier is required to prepare a number of small quantum states and send them to the prover. In [ABOE08] the size of these quantum states (i.e. the number of qubits) depends on the protocol’s soundness (the probability that the verifier accepts an incorrect outcome). In [FK17] the verifier is only required to prepare a number of single-qubit states that depends on the protocol’s soundness. A second class of protocols is receive-and-measure protocols such as [HM15, FHM18], in which the verifier receives single qubits from the prover and is required to measure them in one of a small number of possible bases. The protocol that requires the least quantum capability from the verifier is the one from [FHM18]; in their protocol, the verifier only needs to measure the single qubits it receives one at a time in one of two bases, computational and Hadamard. The most communication-efficient protocols fall in the prepare-and-send category and require a total amount of quantum communication that scales as $O(T\log(1/\delta))$ where $\delta$ is the soundness error [KW17]; the most efficient protocols in the second category have a cubic dependence on $T$.

All the aforementioned protocols provide information-theoretic security (for either blindness or verifiability), and all require some limited but nonzero quantum capability for the verifier. In a recent breakthrough Mahadev introduced the first entirely classical protocol for DQC [Mah18b]. The protocol operates in the Hamiltonian model of quantum computation, in which instead of directly performing the computation $C$ the prover encodes the outcome of $C$ in the smallest eigenvalue of a local Hamiltonian $H_{C}$.444If the circuit returns [math] with probability at least $\frac{2}{3}$, the smallest eigenvalue is smaller than a threshold $a$, and if it returns [math] with probability less than $\frac{1}{3}$, the smallest eigenvalue is larger than a threshold $b>a$ (this is generally referred to as the “Kitaev circuit-to-Hamiltonian construction” [KSVV02]). The goal of the protocol is for the prover to provide evidence that it has prepared an eigenstate $\ket{\psi}$ of $H_{C}$ with associated eigenvalue strictly smaller than $a$. At the heart of Mahadev’s result is a commitment procedure that allows the prover to commit to individual qubits of $\ket{\psi}$, and subsequently reveal a measurement outcome for a basis of the verifier’s choice, using classical communication alone.

The fact that the verifier in Mahadev’s protocol is entirely classical marks a major departure from previous works, yet it comes at a cost in terms of security and efficiency. The security of the protocol is computational and rests on the post-quantum security of the learning with errors problem (LWE); moreover, the protocol is not blind, as the circuit has to be communicated to the prover so that it can determine $H_{C}$ and prepare an eigenstate.555The protocol can in principle be made blind by combining it with a scheme for quantum homomorphic encryption [Mah18a] but this introduces yet another layer of complexity. In terms of efficiency, the transformation from circuit to Hamiltonian results in an eigenvalue estimation problem that needs to be solved with accuracy at least $b-a=O(1/T^{2})$ for the best constructions known [BC18]. As a result the prover has to prepare $\Omega(T^{2})$ copies of the ground state, which implies that at least $\Omega(nT^{2})$ single qubits have to be sent by the prover. Moreover, preparation of a smallest eigenvalue eigenstate $\ket{\psi}$ of $H_{C}$ requires a circuit whose depth scales linearly with $T$, rather than with the depth of $C$. This induces a large overhead on the prover’s side when the circuit $C$ has low depth but high width666Such circuits are highly parallelizable and one might hope for the complexity of delegating one to scale with depth rather than with total circuit size..

Finally, and arguably most importantly, the protocol is monolithic and not obviously composable: while it solves the desired task of verification of quantum computation, it is not at first clear how or even if the protocol can be simplified to solve more elementary problems (e.g. verifying the preparation of a single qubit state or verifying the application of an elementary quantum operation) or combined with other cryptographic primitives (e.g. to remove or reduce quantum communication in a larger protocol).

Our work is motivated by the following question: does there exist a delegation protocol for quantum computation that combines the appealing feature of having an entirely classical verifier while maintaining the relative efficiency (small polynomial overhead), simplicity (prover’s computation is as close as possible to direct computation of delegated circuit), and security guarantees (verifiability, blindness, composability) of protocols with quantum communication?

1.1 Our results

We answer the question in the affirmative by providing an efficient, composable classical protocol for blind and verifiable DQC. The honest prover in our protocol only needs to implement the desired computation, expressed as a computation in the measurement-based model of computation, together with a sequential pre-processing phase consisting of a number of rounds that depends on the circuit size but such that the complexity of implementing each round scales only with the security parameter. The protocol combines the benefits of the best prepare-and-send quantum-verifier protocols for DQC but requires only classical communication; the downside is that our protocol is computationally sound.

Our DQC protocol is based on a basic quantum functionality that we develop and that we believe has wider applicability than the specific application to DQC. More precisely, we provide a computationally sound and composable protocol for the following two-party task, termed random remote state preparation (RSP): Alice (whom we will later identify with the verifier) receives either a uniformly random bit $b\in\{0,1\}$ or a uniformly random value $\theta\in\Theta=\{0,\frac{\pi}{4},\ldots,\frac{7\pi}{4}\}$ and Bob (whom we will later identify with the prover) receives the single-qubit state $\ket{b}$, in the case when Alice gets $b$, or the state $\ket{+_{\theta}}=\frac{1}{\sqrt{2}}(\ket{0}+e^{i\theta}\ket{1})$, in the case when Alice gets $\theta$. Informally, this amounts to Alice having the ability to “steer” a random state $\ket{+_{\theta}}$ (or $\ket{b}$) within Bob’s workspace, using classical communication only, and such that Bob does not learn the value of $\theta$ (or $b$, respectively). (The actual functionality is slightly more complicated; see Section 1.2 and Figure 1.)

The idea for RSP was introduced by Dunjko and Kashefi [DK16]. The main functionality they consider is a weaker variant of RSP termed random remote state preparation with blindness, or $\textsc{RSP}_{B}$. Intuitively, the latter functionality ensures that Bob learns no information about $\theta$, but it allows him to receive a state that is different from $\ket{+_{\theta}}$. The authors show that $\textsc{RSP}_{B}$ (and variants of it) can be composed with a prepare-and-send protocol due to [BFK09] to achieve blind (but not verifiable) delegated computation. In [CCKW18] a candidate implementation of $\textsc{RSP}_{B}$ is given and shown secure against a limited class of adversaries referred to as “honest-but-curious” adversaries. The authors of [DK16] also discuss a stronger form of their primitive, called $\textsc{RSP}_{S}$ (for strong), and observe that it can be used to achieve blind and verifiable DQC by composing it with the protocol of [FK17]. The authors do not, however, provide any instantiation of $\textsc{RSP}_{S}$ (other than the trivial one, using quantum communication).

Our main contribution is to define an ideal functionality, denoted $\textsc{RSP}_{V}$ (random remote state preparation with verification),777It is not hard to verify that $\textsc{RSP}_{V}$ is functionally equivalent to $\textsc{RSP}_{S}$, in the sense that either functionality can be used to implement the other using a simple protocol. Since the definitions are syntactically different, we use a different name to avoid confusion. and show that it can be implemented using a protocol having computational security and classical communication (see Theorem 4.2 for a formal statement and Section 1.2 for a definition of $\textsc{RSP}_{V}$):

Theorem 1.1** (Informal).**

Assuming the learning with errors problem is computationally intractable for efficient quantum algorithms, there exists a protocol with classical communication that implements the functionality $\textsc{RSP}_{V}$ within distance $\varepsilon>0$ and which has $O(1/\varepsilon^{3})$ communication complexity.

Here, by “implements within distance $\varepsilon$”, we mean that any efficient quantum circuit has advantage at most $\varepsilon$ in distinguishing the real remote state preparation protocol from the ideal functionality $\textsc{RSP}_{V}$.

To show this result we introduce a protocol for remote state preparation and show that it is secure based on the learning with errors problem. This is achieved by building on ideas from [BCM*+*18b, Mah18b] as well as from the literature on rigidity, self-testing, and quantum random access codes. Since this is our main technical contribution, we explain the protocol in more detail in Section 1.3 below.

We view $\textsc{RSP}_{V}$ as a fundamental resource for the construction of interactive protocols that involve classical communication between classical and quantum parties. For our result to be as widely applicable as possible, we establish security of our protocol in the abstract cryptography (AC) framework [MR11]. This allows one to use the primitive as a building block in other protocols.

As a specific example of the versatility of RSP we obtain a new protocol for DQC that only requires classical communication. The most natural protocol to which our construction applies is the delegated computation protocol from [FK17]. As already observed in [DK16], having a remote state preparation functionality immediately yields a blind and verifiable protocol for DQC with classical communication and computational soundness (we explain this in more detail in Section 1.4). The resulting protocol is more “direct” than the Mahadev protocol, in the sense that in our construction the operations that the prover has to perform are closer to the quantum computation that the verifier is delegating. (The protocol from [FK17] operates in the measurement-based quantum computing model,888It should be noted that the translation from the circuit model to MBQC incurs only a linear increase in overhead and this is also true for the protocol from [FK17], as explained in [KW17]. but we expect that protocols in the circuit model such as [Bro18] can also be implemented from $\textsc{RSP}_{V}$; see Section 1.4 for a discussion.)

If one assumes that $\textsc{RSP}_{V}$ can be implemented at unit cost then the protocol we obtain is also more efficient than Mahadev’s: for fixed soundness error, $\delta$, the number of operations performed by the prover scales linearly in the size of the delegated circuit and polynomially in the security parameter of the protocol. Unfortunately, our current version of RSP does not have unit cost. Furthemore, the number of uses of RSP required is linear in the circuit size, $T$. This implies that each use must be implemented with error $O(\delta/T)$. With our current analysis, assuming we take $\delta$ to be a constant, this results in a total communication that scales as $O(T^{4})$ (see Section 5 for a more fine-grained analysis). This is not as good as the quasi-linear complexity of prepare-and-measure protocols that use quantum communication. It is important to note, however, that the added overhead of the protocol stems from $\textsc{RSP}_{V}$. Thus, any improvement in the complexity of doing the state preparation will lead to an improvement in the complexity of the resulting DQC protocol. We believe reducing the overhead of $\textsc{RSP}_{V}$ is possible and mention a potential way of achieving this in Section 1.4 below. We also note that our protocol consists of a sequence of simple tests that play a similar role to the Bell test in multi-prover entanglement-based protocols for DQC [RUV13]. The protocol allows for a constant fraction of failed tests, so that a partially faulty device may in principle be used to implement the protocol successfully.

Before proceeding with more details of our approach it may be useful to briefly address the following question: can one use the protocol from [Mah18b] directly to implement RSP? Specifically, couldn’t one enforce that the prover prepares a small-eigenvalue eigenstate of the Hamiltonian $H_{\theta}=-\ket{+_{\theta}}\!\bra{+_{\theta}}$? In fact it is not at all straightforward to do this. The reasons are related to aspects of the Mahadev protocol discussed earlier. First, the committment procedure results in a state that can be measured in one of two possible bases, but it is not clear if any other form of computation besides a direct measurement can be performed on the committed qubit. Second, the guarantee provided is only that the state “exists” (i.e. the Hamiltonian has a small-eigenvalue eigenstate), but not that the state has actually been prepared by the prover. Finally, the information that the prover may have about the state it prepared is not explicitly limited (in the protocol from [Mah18b] the prover learns a classical description of the Hamiltonian, hence, in this case, the value of $\theta$); forcing the prover to prepare an unknown state may require adding an additional layer of (quantum) homomorphic encryption to the protocol.

1.2 Remote state preparation: ideal resource

We formulate our variant of RSP as a resource in the abstract cryptography framework [MR11]. Abstract cryptography (AC), similar to universal composability (UC) [Can01], is a framework for proving the security of cryptographic protocols in a way that ensures that the protocols can be securely composed in arbitrary ways. Informally, the idea is to argue that a given protocol, which we refer to as the real protocol, is indistinguishable from an ideal functionality (or resource) that captures precisely what honest or dishonest parties should be able to achieve in the protocol. This involves proving two things: correctness, meaning that any efficient family of circuits (known as a distinguisher) that interacts either with an honest run of the real protocol or with the ideal functionality has a negligible advantage in deciding which it is interacting with; security, meaning that any attack that a malicious party could perform in the real protocol can be mapped to an attack on the ideal functionality. This latter property is formalized by saying that there exists an efficient family of (quantum) circuits, known as a simulator, such that any distinguisher interacting with the ideal functionality and the simulator, or with the real protocol involving only the honest parties, has negligible advantage in deciding which it is interacting with. Showing that such a simulator exists is usually the main difficulty in proving security in AC. Since the existing results on the composability of DQC protocols are expressed in the AC framework, we also present our results in AC. For more details on the framework we refer to Section 2.4 and [MR11, DFPR14]. For the purposes of this introduction we assume basic familiarity with the framework.

We denote our variant of the ideal RSP by $\textsc{RSP}_{V}$, for random Remote State Preparation with Verification. The name is chosen in direct analogy to the resource $\textsc{RSP}_{B}$ of random Remote State Preparation with Blindness introduced in [DK16]. The resource $\textsc{RSP}_{V}$ is represented schematically in Figure 1. In the resource, Alice inputs a bit $W\in\{X,Z\}$ that denotes a measurement basis, computational ($W=Z$) or Hadamard ($W=X$). Bob inputs a bit $c\in\{0,1\}$ that denotes honest ($c=0$) or malicious ($c=1$) behavior. If $c=0$ then in the case when $W=Z$ Alice receives a uniformly random bit $b\in\{0,1\}$ and Bob receives the state $\ket{b}$; in the case when $W=X$ Alice receives a uniformly random value $\theta\in\Theta=\{0,\frac{\pi}{4},\ldots,\frac{7\pi}{4}\}$ and Bob receives the state $\ket{+_{\theta}}$. If $c=1$ both Alice and Bob receive an $ERR$ message, indicating abort.

Note that the resource $\textsc{RSP}_{V}$ can almost be understood as a communication channel from Alice to Bob that would allow Alice to select one of $10$ possible single-qubit states $\ket{0},\ket{1}$, or $\ket{+_{\theta}}$ for $\theta\in\Theta$ and send it to Bob. There are two differences: first, Alice does not choose the state, but instead the functionality chooses it uniformly at random and tells Alice what it is. Second, Bob may decide to block the channel, in which case both parties receive an error message. This in contrast with the weaker resource of $\textsc{RSP}_{B}$, also introduced in [DK16] and for which [CCKW18] give a real protocol with security against “honest-but-curious” adversaries, in which Bob is allowed to select the family of states $\{\rho_{\theta}\}$ that it receives (by explicitly specifying them to the resource).999The $\rho_{\theta}$ should satisfy the consistency condition shown in (6), which says that it is possible to generate the state $\rho_{\theta}$ by performing a $\theta$-dependent measurement on a fixed state $\rho$; we refer to [DK16] for details. The resource $\textsc{RSP}_{V}$ allows less flexibility to a dishonest user, making it more useful as a building block. In particular, the rigidity of Bob’s output state is essential to obtain a protocol that is verifiable.

1.3 Remote state preparation: real protocol

In the previous section we defined the ideal functionality for remote state preparation with verifiability, $\textsc{RSP}_{V}$. In this section we describe a protocol that we prove is computationally indistinguishable from the ideal functionality. The protocol builds on ideas from [BCM*+*18b] and [Mah18b]. The main difficulty in the implementation of $\textsc{RSP}_{V}$ is to obtain verifiability, i.e. the guarantee that an arbitrary (computationally bounded) prover successfully interacting with the verifier must have prepared locally the correct state, and yet have obtained no more information (computationally) about the state itself than could be gained had the state been sent directly by the verifier (or the ideal resource). To achieve this we significantly strengthen the rigidity argument from [BCM*+*18b] by giving more control, and freedom, to the verifier in the kinds of states that are prepared.

In the real protocol, that we call the buffered remote state preparation protocol (BRSP), Alice and Bob interact through two communication resources: a classical channel as well as a measurement buffer. The measurement buffer takes as input a classical message $M$ from Alice, and from Bob a specification (as a quantum circuit) of a measurement for each of the possible messages of Alice, as well as a state on which the measurement is to be performed (as a quantum state). The buffer then performs the measurement associated with Alice’s message, forwards the outcome to Alice, and returns the post-measurement state to Bob.

The necessity of relying on a measurement buffer to obtain a secure protocol is a consequence of the use of rigidity to obtain verifiability. Rigidity arguments require the assumption that, in an execution of the real protocol, the measurements implemented by Bob are “local”; in other words, that the simulator constructed in the security proof can interact directly with those measurements. In the AC framework, in general, a malicious Bob may “delegate” any measurements that it wishes to make to the environment101010In AC and UC, the environment represents anything that is external to the protocols under consideration [Can01, MR11]. This can include other protocols, other parties etc., which would render them inaccessible to the simulator. By constructing the protocol from a measurement buffer resource we explicitly prevent such behavior from Bob. (Note that the use of the buffer does not prevent Bob from sharing entanglement with the environmnent, or from exchanging quantum states with it in-between any two uses of the measurement buffer.) While the measurement buffer is necessary to obtain composable security, the use of this resource can be omitted when considering stand-alone security only (since in that case, there is no environment). Finally, note that the measurement buffer is not a “physical” resource of the protocol; in an actual run of the protocol Alice and Bob interact only classically. The buffer is discussed in more detail in Section 4.

We proceed with an informal description of the protocol and its analysis. Our starting point is the work [BCM*+*18b], in which the authors give a classical protocol between a verifier and prover such that provided the prover is accepted with non-negligible probability in the protocol, it is guaranteed that a subset of the values returned by the prover contain information-theoretic randomness. This guarantee holds as long as the prover is computationally bounded, and more specifically that it does not have the ability to break the learning with errors (LWE) problem while the protocol is being executed.

We observe that the proof of [BCM*+*18b] explicitly establishes a stronger rigidity statement whereby the prover is guaranteed, up to a local rotation on its workspace, to have prepared a $\ket{+}$ state and measured it in the computational basis (hence the randomness). Formulated differently, the protocol from [BCM*+*18b] implements a weak variant of $\textsc{RSP}_{V}$ in which only the option $W=Z$ is available to Alice. This is not sufficient for delegated computation, but it is a starting point.

To generate the other states needed for $\textsc{RSP}_{V}$ we need to go deeper in the protocol from [BCM*+*18b]. At a high level, the idea is to engineer the preparation of a state of the form

[TABLE]

where $x_{0},x_{1}\in\{0,1\}^{w}$ are bitstrings defined as the unique preimages of an element $y$, provided by the prover to the verifier, under a claw-free pair of functions $f_{0},f_{1}:\{0,1\}^{w}\to\mathcal{Y}$, where $\mathcal{Y}$ is some finite range set. For the purposes of this discussion it is not important how the state (1) is obtained, as long as we can guarantee that the prover prepares such a state.

In [BCM*+*18b] the next step is to ask the prover to measure the second register in the Hadamard basis (i.e. implement the Fourier transform over $\mathbb{Z}_{2}^{w}$ and then measure in the computational basis). Labeling the outcome as $d\in\{0,1\}^{w}$, the first qubit is projected to the state $\frac{1}{\sqrt{2}}(-1)^{d\cdot x_{0}}(\ket{0}+(-1)^{d\cdot(x_{0}\oplus x_{1})}\ket{1})$ that provides the basis for the randomness generation described earlier.

Consider the following simple modification: by thinking of $x_{0},x_{1}$ as elements of $\mathbb{Z}_{8}^{w/3}$ (assuming $w$ is a multiple of $3$) instead of $\{0,1\}^{w}$, we can ask the prover to implement the Fourier transform over $\mathbb{Z}_{8}$, yielding an outcome $d\in\mathbb{Z}_{8}^{w/3}$ and a post-measurement state

[TABLE]

where $\omega=e^{\frac{2i\pi}{8}}$ and the addition and inner product are taken modulo $8$. Up to a global phase this is precisely the state $\ket{+_{\theta}}$, for $\theta=\frac{\pi}{4}\,d\cdot(x_{0}+x_{1})$.

So far the argument establishes completeness: if Alice and Bob follow the protocol, Alice obtains an angle $\theta$ and Bob obtains the state $\ket{+_{\theta}}$. Moreover, using a slight extension of the adaptive hardcore bit statement from [BCM*+*18b] it is not hard to show that the value of $\theta$ is computationally indistinguishable from uniform from Bob’s perspective. The main difficulty is to argue that the prover must have created precisely the state $\ket{\psi_{\theta}}$ in (2), and not for instance a related state such as $\ket{\psi_{3\theta}}$. Note that this would be allowed in $\textsc{RSP}_{B}$, but it is not in $\textsc{RSP}_{V}$.

In order to show that the prover must have a state that is equal, up to an isometry, to a state of the form $\ket{\psi_{\theta}}$ we combine rigidity arguments similar to those employed in [BCM*+*18b] with a new idea: we introduce a test that asks the prover to demonstrate that the state it has prepared implements a near-optimal $2\mapsto 1$ quantum random access code (QRAC). A $2\mapsto 1$ QRAC is a procedure that encodes two classical bits into a single qubit, in a way that maximizes the success probability of the following task: given a request for either the first or the second bit (chosen with equal probability), perform a measurement on the single qubit that returns the value of that bit with the highest possible probability. As shown in [ALMO08] the optimum success probability of this task is $\frac{1}{2}+\frac{1}{2\sqrt{2}}$, and is achieved by encoding the two bits in one of the four single-qubit states $\ket{+_{0}},\ket{+_{\frac{\pi}{2}}},\ket{+_{\pi}}$ and $\ket{+_{\frac{3\pi}{2}}}$. More specifically, if the input bits are denoted $b_{1}$, $b_{2}$, then the QRAC state is $\ket{+_{b_{1}\pi+b_{2}\frac{\pi}{2}}}$. Moreover, the optimal measurement for predicting one bit or the other is a measurement in the basis $\{\ket{+_{\frac{\pi}{4}}},\ket{+_{\frac{5\pi}{4}}}\}$, if $b_{1}$ is requested, or $\{\ket{+_{\frac{3\pi}{4}}},\ket{+_{\frac{7\pi}{4}}}\}$, if $b_{2}$ is requested.

We extend the optimality proof from [ALMO08] to show that even a near-optimal family of states and measurements must be close, up to a global rotation, to the ones described above. Next we enforce that the prover’s states and measurements implement a near-optimal $2\mapsto 1$ QRAC by asking that the prover successfully predict certain bits of $\theta$, given partial information about it. For example, the verifier can reveal to the prover that $\theta\in\{\frac{\pi}{2},\frac{3\pi}{2}\}$ and ask which is the case; the prover should be able to answer with probability $1$ by performing the appropriate measurement. Or the verifier can reveal that $\theta\in\{\ket{+_{0}},\ket{+_{\frac{\pi}{2}}},\ket{+_{\pi}},\ket{+_{\frac{3\pi}{2}}}\}$ and ask the prover to guess one additional bit of $\theta$; the prover should be able to succeed with probability $\frac{1}{2}+\frac{1}{2\sqrt{2}}$.

Making use of the rigidity argument to establish composable security requires the simulator to have access to Bob’s measurement operators. For this reason, while most communication steps of the protocol can be implemented using a classical communication channel, in the last step of the protocol, described in the previous paragraph, the communication takes place through a measurement buffer: Alice inputs partial information about $\theta$, and Bob inputs a description of the measurement that he would have performed on each of Alice’s possible questions, together with the quantum state on which the measurement is to be performed.

The complete argument is given in Section 3. We introduce a sequential protocol that consists of a number $N$ of tests, followed by a random stopping time. We show that any behavior of the prover that has non-negligible probability of passing a fraction of tests that is within a small enough constant of the optimal fraction is such that the following property holds: at the end of the protocol, the state of the prover is unitarily equivalent to a state that is computationally indistinguishable (up to a small computational error that depends on $N$ and other parameters of the protocol) from a state of the form $\ket{\psi_{\theta}}$ together with some $\theta$-independent side information.

1.4 Application: delegated computation

Having defined the ideal $\textsc{RSP}_{V}$ functionality as well as the real protocol that implements this functionality from classical channels, we now discuss applications. As mentioned, the most natural application of RSP is to verifiable delegated quantum computation. Intuitively, the idea is the following: suppose Alice wishes to delegate $C(x)$ to Bob, for some quantum circuit $C$ having $T$ gates. Using the measurement-based protocol from [FK17], if Alice were to send Bob $O(T\,\log(1/\delta))$ randomly chosen states, from the ten possible choices mentioned earlier (the $\ket{+_{\theta}}$ states, with $\theta\in\Theta$, and the $\ket{0}$, $\ket{1}$ states), she would be able to delegate $C(x)$ to Bob and the protocol would have soundness error at most $\delta$. The $\textsc{RSP}_{V}$ functionality allows her to do exactly this, using classical communication alone. Of course, unlike the protocol of [FK17], the security of this construction would be computational, rather than information-theoretic. To summarize, in the delegation protocol Alice first executes $\textsc{RSP}_{V}$ a certain number of times with Bob in order to prepare the required resource states in Bob’s quantum memory. She then engages in the protocol of [FK17] as if she had sent the random states to Bob.

How many times does Alice need to execute $\textsc{RSP}_{V}$? To delegate the circuit of size $T$ and achieve soundness error $\delta$, the number of executions must clearly be at least $\Omega(T\,\log(1/\delta))$. If the real protocol used to implement $\textsc{RSP}_{V}$ prepared the intended states exactly, then we would have exactly that many runs. Of course, this is not the case, and we need to account for the failure probability of the real protocol, which we denote as $\varepsilon$. It was shown in [DFPR14, GKW15] that the protocol of [FK17] is robust to deviations in the collective state of the resource qubits. If there are $M$ such qubits, and the error per state is $\varepsilon$ then by the triangle inequality it follows that the deviation of the whole state is at most $M\varepsilon$. We therefore need to choose $\varepsilon=O(\delta/M)$ and since $M=\Omega(T\,\log(1/\delta))$, this means that $\varepsilon=O\left(\frac{\delta}{T\,\log(1/\delta)}\right)$. As shown in Section 3, to achieve error at most $\varepsilon$, the real protocol associated to $\textsc{RSP}_{V}$ must have a running time of $O(1/\varepsilon^{3})$. Putting everything together, this leads to a total number of operations that scales as $O((T^{4}/\delta^{3})\,\log^{4}(1/\delta))$. Ideally, one may hope for an implementation whose communication is linear in $T$. It may be possible to do this by considering a single-use parallel version of our protocol, whereby all states would be generated in a single iteration. Achieving this is likely to be technically challenging, and we leave the possibility open for future work.

In the language of AC, the ideal functionality for verifiable DQC has already been defined in [DK16]. What we show is that this functionality is computationally indistinguishable from the real protocol described earlier. To do this we first adapt the definitions of DQC resources to the setting of computational security. We then show that the results pertaining to those resources in the information-theoretic case also hold in the case of computational security. This is done in Section 5. Finally, we show that the $\textsc{RSP}_{V}$ functionality can be used to implement the computational DQC functionalities. It follows that the real protocol we described is computationally indistinguishable from the ideal DQC resource.

As already mentioned one of the main advantages to proving the security of $\textsc{RSP}_{V}$ in the AC framework is that one can directly plug this primitive into other existing protocols. Aside from DQC, a related application is to multi-party quantum computation (MPQC). In [KP17] the authors define AC functionalities for multi-party quantum computation. Their protocol consists of a number of clients, each having its own input, that wish to delegate a computation on their collective inputs to a quantum server. Its security, as defined in [KP17], is guaranteed in the settings where either the server is malicious (but the clients are not), or a subset of clients is malicious (but the server behaves honestly). The protocol works by having the clients perform a remote state preparation protocol, in which the clients send quantum states to the server. It then proceeds in a manner similar to the single-client DQC protocols. In principle, remote state preparation could be replaced with our $\textsc{RSP}_{V}$ primitive, leading to an MPQC protocol in which the clients and the server use only classical communication. We leave the formalization of this intuition to future work.

Upon completion of this work we became aware of the independent work “QFactory: classically-instructed remote secret qubits preparation” by Cojocaru, Colisson, Kashefi and Wallden. Using our terminology, their main result is the design of a protocol for $\textsc{RSP}_{B}$, the blind variant of RSP, that they prove computationally secure.

Outline.

We start with Section 2, which contains the preliminaries for this work. Most notably, in this section we recast some of the definitions pertaining to composability of DQC protocols, expressed in the AC framework, in the setting of computational, rather than information-theoretic security. Then, in Section 3, we describe the remote state preparation protocol and prove the rigidity statement about its functionality. In other words we show that, provided the verifier accepts with non-negligible probability, the prover’s state is close (up to an isometry) to the ideal random state that the verifier receives a description of. In the proof, we make use of an extended noisy trapdoor claw-free function family, for which we provide the relevant definitions in Appendix A, as well as present the properties of these functions that we require. Next, in Section 4 we describe the ideal $\textsc{RSP}_{V}$ functionality and prove, in the AC framework, that the protocol from Section 3 implements this functionality from classical channels, under computational assumptions. Having done this, we end in Section 5 by showing that the ideal $\textsc{RSP}_{V}$ functionality can be used to implement the functionality for blind and verifiable delegated quantum computation. From the previous results, this implies that one can have a computationally secure DQC protocol by using our RSP primitive to prepare the quantum states used by that protocol. The specific DQC protocol we consider is the one from [FK17].

Acknowledgments.

We thank Rotem Arnon-Friedman, Vedran Dunjko, Urmila Mahadev and Christopher Portmann for useful discussions. Alexandru Gheorghiu and Thomas Vidick are supported by MURI Grant FA9550-18-1-0161 and the IQIM, an NSF Physics Frontiers Center (NSF Grant PHY-1125565) with support of the Gordon and Betty Moore Foundation (GBMF-12500028). Thomas Vidick is also supported by NSF CAREER Grant CCF-1553477, AFOSR YIP award number FA9550-16-1-0495, and a CIFAR Azrieli Global Scholar award.

2 Preliminaries

2.1 Notation

We write $\mathcal{H}$ for a finite-dimensional Hilbert space, using indices $\mathcal{H}_{A}$, $\mathcal{H}_{B}$ to specify distinct spaces. $\mathrm{L}(\mathcal{H})$ is the set of linear operators on $\mathcal{H}$. We write $\mathop{\rm Id}\nolimits_{A}\in\mathrm{L}(\mathcal{H}_{A})$ for the identity operator, $\mbox{\rm Tr}(\cdot)$ for the trace, and $\mbox{\rm Tr}_{B}:\mathrm{L}(\mathcal{H}_{A}\otimes\mathcal{H}_{B})\to\mathrm{L}(\mathcal{H}_{A})$ for the partial trace. $\mathrm{Pos}(\mathcal{H})$ is the set of positive semidefinite operators and $\mathrm{D}(\mathcal{H})=\{X\in\mathrm{Pos}(\mathcal{H}):\mbox{\rm Tr}(X)=1\}$ the set of density matrices (also called states).

Given $A\in\mathrm{L}(\mathcal{H})$, $\|A\|_{1}=\mbox{\rm Tr}\sqrt{A^{\dagger}A}$ is the Schatten $1$-norm and $TD(A)=\frac{1}{2}\|A\|_{1}$ the trace distance.

Given $X,Z\in\mathrm{L}(\mathcal{H})$ we write $\{X,Z\}=XZ+ZX$ for the anticommutator and $[X,Z]=XZ-ZX$ for the commutator. $\sigma_{X},\sigma_{Y},\sigma_{Z}\in\mathrm{L}(\mathbb{C}^{2})$ are the single-qubit Pauli matrices. For an angle $\theta$ we let $\sigma_{X,\theta}=\cos\theta\,\sigma_{X}+\sin\theta\,\sigma_{Y}$.

A completely positive trace-preserving (CPTP) map $\mathcal{F}:\mathcal{H}_{A}\to\mathcal{H}_{B}$ is a linear map such that for any $\mathcal{H}_{C}$ and $\rho\in\mathrm{Pos}(\mathcal{H}_{A}\otimes\mathcal{H}_{C})$ it holds that $(\mathcal{F}\otimes\mathop{\rm Id}\nolimits_{C})(\rho)\in\mathrm{Pos}(\mathcal{H}_{B}\otimes\mathcal{H}_{C})$ and $\mbox{\rm Tr}(\mathcal{F}\otimes\mathop{\rm Id}\nolimits_{C}(\rho))=\mbox{\rm Tr}(\rho)$.

We let $\Theta=\{0,\frac{\pi}{4},\frac{2\pi}{4},\ldots,\frac{7\pi}{4}\}$. For $\theta\in\Theta$, $\ket{+_{\theta}}=\frac{1}{\sqrt{2}}(\ket{0}+e^{i\theta}\ket{1})$. We often identify elements of $\mathbb{Z}_{8}$ with $\{0,1,2,\ldots,7\}$. For a finite set $S$ we write $x\leftarrow_{U}S$ to mean that $x$ is chosen uniformly at random from $S$. A negligible function is a function $\delta:\mathbb{N}\to\mathbb{R}$ that goes to [math] faster than any inverse polynomial, i.e. $p(\lambda)\delta(\lambda)\to_{\lambda\to\infty}0$ for any polynomial $p$.

2.2 Efficient states and operations

Definition 2.1**.**

We say that a family of states $\{\rho_{\lambda}\in\mathrm{D}(\mathcal{H}_{A_{\lambda}})\}_{\lambda\in\mathbb{N}}$ is efficiently preparable (or just “efficient”) if there exists a polynomial-time uniformly generated111111By “polynomial-time uniformly generated we mean that there exists a Turing machine $T$ that on input $1^{\lambda}$ returns a description of the circuit $C_{\lambda}$ using some fixed finite universal gate set. family of circuits $\{C_{\lambda}\}_{\lambda\in\mathbb{N}}$ acting on $\mathcal{H}_{A_{\lambda}}\otimes\mathcal{H}_{B_{\lambda}}$ such that

[TABLE]

Definition 2.2**.**

We say that a family of CPTP maps $\{\mathcal{F}_{\lambda}:\mathrm{L}(\mathcal{H}_{A_{\lambda}})\to\mathrm{L}(\mathcal{H}_{B_{\lambda}})\}_{\lambda\in\mathbb{N}}$ is efficient if there exists a polynomial-time uniformly generated family of circuits $\{C_{\lambda}\}$ acting on $\mathcal{H}_{A_{\lambda}}\otimes\mathcal{H}_{B_{\lambda}}\otimes\mathcal{H}_{C_{\lambda}}$ such that

[TABLE]

2.3 Computational distinguishability

Definition 2.3**.**

Given two families of (not necessarily normalized) density operators $\{\rho_{\lambda}\}_{\lambda\in\mathbb{N}}$ and $\{\sigma_{\lambda}\}_{\lambda\in\mathbb{N}}$ we say that $\rho$ and $\sigma$ are computationally distinguishable with advantage at most $\delta(\lambda)$, and write $\rho\approx_{c,\delta}\sigma$, if for any polynomial-time uniformly generated family of circuits $\{D_{\lambda}\}_{\lambda\in\mathbb{N}}$, known as a distinguisher, there is a $\lambda_{0}\in\mathbb{N}$ such that

[TABLE]

The best $\delta(\lambda)$ in Definition 2.3 implicitly depends on the specific polynomial bound that is placed on the size of the distinguisher. In this paper it will always be the case that $\delta(\lambda)=\delta+\operatorname{negl}(\lambda)$, for some constant $\delta$ and a negligible function of $\lambda$. The size of the distinguisher will affect the negligible function; the statement should be interpreted as saying that for any polynomial size bound on the distinguisher there is a negligible function of $\lambda$ such that (3) holds.

Lemma 2.4**.**

For any density operators $\{\rho_{\lambda}\}_{\lambda\in\mathbb{N}}$ and $\{\sigma_{\lambda}\}_{\lambda\in\mathbb{N}}$, $\{\rho_{\lambda}\}_{\lambda\in\mathbb{N}}$ and $\{\sigma_{\lambda}\}_{\lambda\in\mathbb{N}}$ are computationally distinguishable with advantage at most $\|\rho_{\lambda}-\sigma_{\lambda}\|_{1}$.

Proof.

For any $\rho,\sigma$ and $0\leq D\leq\mathop{\rm Id}\nolimits$ it holds that:

[TABLE]

∎

Lemma 2.5**.**

For $b\in\{0,1\}$ let $\{\rho_{\lambda}^{b}\}_{\lambda\in\mathbb{N}}$ and $\{\sigma_{\lambda}^{b}\}_{\lambda\in\mathbb{N}}$ be two families of density operators. For all $\lambda$, let $\rho_{\lambda}=\sum_{b}\ket{b}\!\bra{b}\otimes\rho_{\lambda}^{b}$ and $\sigma_{\lambda}=\sum_{b}\ket{b}\!\bra{b}\otimes\sigma_{\lambda}^{b}$. Suppose that $\{\rho_{\lambda}\}$ and $\{\sigma_{\lambda}\}$ are distinguishable with advantage at most $\delta(\lambda)$. Then for $b\in\{0,1\}$, $\{\rho_{\lambda}^{b}\}$ and $\{\sigma_{\lambda}^{b}\}$ are distinguishable with advantage at most $\delta_{b}(\lambda)$ where $\delta_{0}(\lambda),\delta_{1}(\lambda)$ are such that $|\delta_{0}(\lambda)+\delta_{1}(\lambda)-\delta(\lambda)|=\operatorname{negl}(\lambda)$.

Proof.

For $b\in\{0,1\}$ fix a family of efficient distinguishers $\{D^{b}_{\lambda}\}$ for $\{\rho^{b}_{\lambda}\}$ and $\{\sigma_{\lambda}^{b}\}$ with advantage $\delta_{b}(\lambda)$. Then the distinguisher $D=\ket{0}\!\bra{0}\otimes D^{0}+\ket{1}\!\bra{1}\otimes D^{1}$ is efficient and has distinguishing advantage $\delta_{0}(\lambda)+\delta_{1}(\lambda)$ for $\{\rho_{\lambda}\}$ and $\{\sigma_{\lambda}\}$. This shows that $\delta_{0}(\lambda)+\delta_{1}(\lambda)\leq\delta(\lambda)$. Conversely, let $\{D_{\lambda}\}$ be an efficient distinguisher for $\{\rho_{\lambda}\}$ and $\{\sigma_{\lambda}\}$ with advantage $\delta(\lambda)$. Then

[TABLE]

where $D_{\lambda}^{b}$ is the efficient distinguisher that initializes an ancilla qubit to state $\ket{b}\!\bra{b}$ and then runs $D_{\lambda}$. ∎

2.4 Composable security

Abstract cryptography (AC) is a framework for proving the security of protocols under composition. For example if protocols $\pi_{1}$ and $\pi_{2}$ are shown to be secure in the AC framework then their sequential composition $\pi_{1}\circ\pi_{2}$ or parallel composition $\pi_{1}|\pi_{2}$ is automatically secure as well. For an in-depth introduction to the framework of abstract cryptography specialized to the present context of two-party quantum protocols we refer to [DFPR13]. Here we briefly recall the key notions and terminology.

The actions of the two players, generally called Alice and Bob, in a two-party protocol $\pi$ are specified by a sequence of CPTP maps $\pi_{A}=\{\mathcal{E}_{i}:\mathrm{L}(\mathcal{H}_{AC})\to\mathrm{L}(\mathcal{H}_{AC})\}_{i}$ and $\pi_{B}=\{\mathcal{F}_{i}:\mathrm{L}(\mathcal{H}_{CB})\to\mathrm{L}(\mathcal{H}_{CB})\}_{i}$, where $A$ and $B$ are Alice and Bob’s private registers respectively, and $C$ represents a communication channel. In AC the channel $C$ is modeled as a resource $\mathcal{R}$, where in general a resource is itself represented as a sequence of completely positive trace-preserving (CPTP) maps with internal memory.

In the AC framework a protocol can be thought of as a process that constructs a resource, $\mathcal{S}$, from some other resource, $\mathcal{R}$. For instance, a protocol $\pi_{AB}=(\pi_{A},\pi_{B})$ can construct an ideal resource for delegated quantum computation from a resource consisting of classical and quantum channels. The resource $\pi_{A}\mathcal{R}$ obtained by plugging in one player’s strategy into the resource is another resource, itself modeled as a sequence of CPTP maps, that can be thought of as a quantum strategy as defined in [GW07]. When both Alice and Bob follow the protocol while interacting with the resource $\mathcal{R}$ we write $\pi_{AB}\mathcal{R}$, or $\pi_{A}\mathcal{R}\pi_{B}$.121212The ordering of the protocols, $\pi_{A}$ and $\pi_{B}$, has no special significance. Note that $\pi_{A}\mathcal{R}\pi_{B}$ is again itself a resource, having input and output interfaces for both Alice and Bob.

Since the goal in the AC framework is to show that certain resources are indistinguishable from each other, we need a notion of distinguishability of resources. Informally, two resources $\mathcal{R}_{1}$ and $\mathcal{R}_{2}$, each modeled as a sequence of CPTP maps with input and output spaces of compatible dimension, are computationally distinguishable with advantage at most $\varepsilon$ if no efficient distinguisher $\mathcal{D}$ (itself represented as a family of efficient CPTP maps) can distinguish an interaction with $\mathcal{R}_{1}$ from an interaction with $\mathcal{R}_{2}$. Here, the distinguisher is allowed to create an initial state as input to the resource (the state can be entangled with a reference system kept by the distinguisher); then, upon having received the output of the first map, it can modify it in an arbitrary (efficient) way and input it to the second map, etc., until it is required to make an (efficient) measurement on the output of the last map (and its own reference system) in order to return a guess for the resource with which it was interacting. We write the composition of $\mathcal{D}$ and $\mathcal{R}_{i}$, for $i\in\{1,2\}$, as $\mathcal{D}\mathcal{R}_{i}$; this is a resource that takes no input and outputs a single bit.

Definition 2.6**.**

Let $\varepsilon=\varepsilon(\lambda)\in[0,1]$ be a function of a security parameter $\lambda\in\mathbb{N}$, and let $\mathcal{R}_{1}$ and $\mathcal{R}_{2}$ be two resources having input and output spaces of the same dimension. We say that $\mathcal{R}_{1}$ and $\mathcal{R}_{2}$ have distinguishing advantage $\varepsilon$ if for all efficient distinguishers $\mathcal{D}$ it holds that $|\Pr(\mathcal{D}\mathcal{R}_{1}=1)-\Pr(\mathcal{D}\mathcal{R}_{2}=1)|\leq\varepsilon$. We write this as:

[TABLE]

With this definition we have the following.

Definition 2.7**.**

Let $\varepsilon=\varepsilon(\lambda)\in[0,1]$ be a function of a security parameter $\lambda\in\mathbb{N}$. We say that a protocol $\pi=(\pi_{A},\pi_{B})$ constructs a resource $\mathcal{S}$ from a resource $\mathcal{R}$ with (computational) error (or distance) $\varepsilon$ if:

• •

Correctness: $\pi_{AB}\mathcal{R}\approx_{c,\varepsilon}\mathcal{S}$.

• •

Security: There exists an efficient simulator $\sigma$ such that $\pi_{A}\mathcal{R}\approx_{c,\varepsilon}\mathcal{S}\sigma$.

(Here $\pi_{AB}$, $R$, $S$ and $\sigma$ may all implicitly depend on $\lambda$.)

The first condition expresses the fact that if Alice and Bob follow the instructions of the protocol, the resulting resource behaves as the ideal one. The second condition expresses the fact that if Bob does not follow the protocol, any attack he performs on the real protocol can be mapped to an attack on the ideal protocol. This mapping is referred to as a simulator. Note that Definition 2.7 implicitly assumes that Alice always behaves honestly; this need not be the case in general but always holds in the context of this paper.

2.5 Rigidity

Definition 2.8**.**

Let finite-dimensional Hilbert spaces $\mathcal{H}_{{\textsf{A}}}$ and $\mathcal{H}_{{\textsf{A}}^{\prime}}$ and operators $R\in\mathrm{L}(\mathcal{H}_{{\textsf{A}}})$ and $S\in\mathrm{L}(\mathcal{H}_{{\textsf{A}}^{\prime}})$ be functions of a parameter $\delta>0$ (the dependence on $\delta$ is left implicit in the notation). We say that $R$ and $S$ are $\delta$-isometric with respect to $\ket{\psi}\in\mathcal{H}_{{\textsf{A}}}\otimes\mathcal{H}_{{\textsf{B}}}$, and write $R\simeq_{\delta}S$, if there exists an isometry $V:\mathcal{H}_{{\textsf{A}}}\to\mathcal{H}_{{\textsf{A}}^{\prime}}$ such that

[TABLE]

We sometimes write the isometry as a CPTP map $\Phi(R)=VRV^{\dagger}$ for $R\in\mathrm{L}(\mathcal{H}_{A})$, and also write $\Phi(\ket{\phi})$ for $V\ket{\phi}$, $\Phi(\sigma)$ for $V\sigma V^{\dagger}$. If $V$ is the identity, then we further say that $R$ and $S$ are $\delta$-equivalent, and write $R\approx_{\delta}S$ for $\|(R-S)\otimes\mathop{\rm Id}\nolimits_{{\textsf{B}}}\ket{\psi}\|^{2}=O(\delta)$.

The following can be shown by a standard application of Jordan’s lemma. Furthermore, the isometry $V$ can be implemented using the “swap” isometry as in [MYS12].

Lemma 2.9**.**

Let $\ket{\psi}\in\mathcal{H}_{{\textsf{A}}}\otimes\mathcal{H}_{{\textsf{B}}}$ and $Z,X,X^{\prime}$ observables on $\mathcal{H}_{{\textsf{A}}}$ such that $\{Z,X\}\approx_{\delta}0$ and $\{Z,X^{\prime}\}\approx_{\delta}0$. Then there exist $\delta^{\prime}=O(\sqrt{\delta})$, an isometry $V:\mathcal{H}_{\textsf{A}}\to\mathbb{C}^{2}\otimes\mathcal{H}_{{{\textsf{A}}^{\prime}}}$, and Hermitian commuting $A_{X},A_{Y}$ on $\mathcal{H}_{{{\textsf{A}}^{\prime}}}$ such that $A_{X}^{2}+A_{Y}^{2}=\mathop{\rm Id}\nolimits$ and

[TABLE]

Furthermore, there exists a polynomial-time algorithm that given explicit circuits implementing $Z,X$ and $X^{\prime}$ as input returns an explicit circuit that implements the isometry $V$.

2.6 Delegated quantum computation

2.6.1 Ideal functionalities

We recall the ideal resources for blind and verifiable delegated quantum computation (DQC), as defined in [DFPR13]. We start with blindness.

Definition 2.10** (Definition 4.1 in [DFPR13]).**

The ideal DQC resource $\mathcal{S}^{blind}$ which provides both correctness and blindness takes an input $\psi_{A}$ at Alice’s interface, but no honest input at Bob’s interface. Bob’s filtered interface has a control bit $b$, set by default to [math], which he can flip to activate the other filtered functionalities. The resource $\mathcal{S}^{blind}$ then outputs the permitted leak $\ell^{\psi_{A}}$ at Bob’s interface, and accepts two further inputs, a state $\psi_{B}$ and a map description $\ket{\mathcal{E}}\!\bra{\mathcal{E}}$. If $b=0$, it outputs the correct result $\mathcal{U}(\psi_{A})$ at Alice’s interface; otherwise it outputs Bob’s choice $\mathcal{E}(\psi_{AB})$.

Next we give the definition for blindness and verifiability. The main difference is that the ideal functionality is no longer allowed to return an output of Bob’s choice at Alice’s interface.

Definition 2.11** (Definition 4.2 in [DFPR13]).**

The ideal DQC resource $\mathcal{S}^{blind}_{verif}$ which provides correctness, blindness and verifiability takes an input $\psi_{A}$ at Alice’s interface, and two filtered control bits $b$ and $c$ (set by default to [math]). If $b=0$, it outputs the correct result $\mathcal{U}(\psi_{A})$ at Alice’s interface. If $b=1$, it outputs the permitted leak $\ell^{\psi_{A}}$ at Bob’s interface, then reads the bit $c$, and conditioned on its value, it either outputs $\mathcal{U}(\psi_{A})$ or $\ket{ERR}$ at Alice’s interface.

We provide the definitions of the ideal resources for two variants of random remote state preparation introduced in [DK16]:

Definition 2.12** (Definition 11 in [DK16]).**

The ideal resource called the strong random remote state preparation $(\textsc{RSP}_{S})$ has two interfaces A, and B, standing for Alice and Bob. The resource first selects an angle $\theta$ (from the set of 8 states) chosen uniformly at random. Bob’s interface has a filtered functionality comprising a bit $c$ which Bob can pre-set to zero or one, depending on whether he will behave maliciously. If Bob pre-sets $c=0$, the resource outputs the state $\ket{+_{\theta}}\!\bra{+_{\theta}}$ on Bob’s interface. If Bob pre-sets $c=1$, it awaits a description of a CPTP map $\mathcal{E}$ from Bob. Once the set is received, the functionality outputs $\mathcal{E}(\ket{+_{\theta}}\!\bra{+_{\theta}})$ at Bob’s interface. In both cases, the resource outputs the angle $\theta$ at Alice’s interface.

Definition 2.13** (Definition 8 in [DK16]).**

The ideal resource called the random remote blind state preparation for blindness $\textsc{RSP}_{B}$ has two interfaces A, and B, standing for Alice and Bob. The resource first selects a $\theta$ chosen uniformly at random. Bob’s interface has a filtered functionality comprising a bit $c$ which Bob can pre-set to zero or one, depending on whether he will behave maliciously. If Bob pre-sets $c=0$, the resource outputs the state $\ket{+_{\theta}}\!\bra{+_{\theta}}$ on Bob’s interface. If Bob pre-sets $c=1$, it awaits the set $\{(\theta,\left[\rho^{\theta}\right])\}_{\theta}$ from Bob, where $\left[\rho^{\theta}\right]$ denotes the classical description of a quantum state, with the property that $\rho^{\theta}+\rho^{\theta+\pi}=\rho^{\theta^{\prime}}+\rho^{\theta^{\prime}+\pi},\forall\theta,\theta^{\prime}.$ If the states Bob inputs do not satisfy the property above, the ideal functionality ignores the set Bob has input and awaits a new valid set. Once the set is received, the functionality outputs $\rho^{\theta}$ at Bob’s interface. In both cases, the resource outputs the angle $\theta$ at Alice’s interface.

Briefly, the difference between $\textsc{RSP}_{S}$ and $\textsc{RSP}_{B}$ is as follows. In $\textsc{RSP}_{S}$ if Alice accepts she receives a random angle $\theta$, and Bob receives $\mathcal{E}(\ket{+_{\theta}})$, for some CPTP map $\mathcal{E}$, that is independent of $\theta$. In the weaker $\textsc{RSP}_{B}$, the possible states, $\{\rho_{\theta}\}_{\theta\in\Theta}$, that Bob receives should satisfy

[TABLE]

Importantly, there is no requirement that Bob’s state is the correct $\ket{+_{\theta}}$ state, up to to the action of an independent CPTP map. It is precisely the possibility that the deviation map can depend on $\theta$ that makes $\textsc{RSP}_{B}$ unsuitable for verifiability (though it does provide blindness).

2.6.2 Local criteria

Dunjko et al. [DFPR13] give “local” criteria, $\delta$-local-blindness and independent $\delta$-local-verifiability, that can be used to establish the security of a protocol for delegated quantum computation in the AC framework. Their definitions are geared to showing information-theoretic security. We adapt them to the setting of computational security, as follows.

Definition 2.14**.**

A DQC protocol provides $\delta$-local-blindness if for all efficient adversaries $\{\mathcal{F}_{i}:\mathrm{L}(\mathcal{H}_{CB})\to\mathrm{L}(\mathcal{H}_{CB})\}$ in the protocol there is an efficient CPTP map $\mathcal{F}:\mathrm{L}(\mathcal{H}_{B})\to\mathrm{L}(\mathcal{H}_{B})$ such that for all efficiently preparable $\psi_{ABR}$,

[TABLE]

where $\mathcal{P}_{AB}$ is the map corresponding to an execution of the protocol with an honest Alice and a Bob specified by the maps $\mathcal{F}_{i}$ and $\circ$ denotes composition. When no map acts on a space, it is to be assumed that the identity is applied.

Definition 2.15**.**

A DQC protocol provides independent $\delta$-local verifiability if for all efficient adversaries $\{\mathcal{F}_{i}:\mathrm{L}(\mathcal{H}_{CB})\to\mathrm{L}(\mathcal{H}_{CB})\}$ in the protocol there exist efficient alternative maps $\{\mathcal{F}^{\prime}_{i}:\mathrm{L}(\mathcal{H}_{CBB^{\prime}})\to\mathrm{L}(\mathcal{H}_{CBB^{\prime}})\}$ such that the following hold:

For all efficient initial states $\psi_{AR_{1}}\otimes\psi_{R_{2}B}$ there is a $0\leq p^{\psi}\leq 1$ such that

[TABLE]

where $\rho_{AR_{1}}^{\psi}$ is the final state of Alice and the first part of the reference system; 2. 2.

For all efficient initial states $\psi_{ABR}$,

[TABLE]

where $\mathcal{P}_{AB}$ and $\mathcal{P}^{\prime}_{ABB^{\prime}}$ are the maps corresponding to an execution of the protocol with an honest Alice and a Bob specified by the maps $\mathcal{F}_{i}$ and $\mathcal{F}_{i}^{\prime}$ respectively, and $Q_{AB^{\prime}}:\mathrm{L}(\mathcal{H}_{A})\to\mathrm{L}(\mathcal{H}_{AB^{\prime}})$ is a map which generates from $A$ a system $B^{\prime}$ that contains a copy of the information whether Alice accepts or rejects.

The following is an analogue of [DFPR13, Corollary 6.9] for the computational setting.

Theorem 2.16**.**

If a DQC protocol $\pi$ implementing a unitary transformation $\mathcal{U}$ is $\delta_{c}$-correct and provides $\delta_{b}$-local-blindness and independent $\delta_{v}$-local-verifiability for all efficient inputs that are classical on $A$,131313We make the restriction that the input is classical for convenience; a more general version of the theorem, with some loss in parameters, applies to quantum inputs. See [DFPR13, Corollary 6.9] for details. for some $\delta_{c},\delta_{b},\delta_{v}\geq 0$, then it constructs $\mathcal{S}_{verif}^{blind}$ computationally within $\varepsilon=\max(\delta_{c},2\delta_{b}+4\sqrt{\delta_{v}})$.

Proof.

The proof is identical to the proof of [DFPR13, Corollary 6.9] except for ensuring that the simulator is computationally efficient. The first step is to combine local-blindness and local-verifiability to obtain the condition of local-blind-verifiability, i.e. the existence of maps $\mathcal{F}^{ok}$ and $\mathcal{F}^{ver}$ such that, using the notation from Definition 2.15,

[TABLE]

The maps $\mathcal{F}^{ok}$ and $\mathcal{F}^{ver}$ can be defined from $\mathcal{F}^{\prime}$ as in the proof of [DFPR13, Lemma 6.6] as

[TABLE]

where $\mathcal{P}_{B^{\prime}}^{ok}$ and $\mathcal{P}_{B^{\prime}}^{err}$ are the projection on the corresponding states of $B^{\prime}$. Clearly these maps can be implemented efficiently, given that $\mathcal{F}^{\prime}$ can. Next we need to show that any efficient distinguisher $\mathcal{D}$ for (10) contradicts either local-blindness or local-verifiability. Write

[TABLE]

If $\mathcal{D}$ is a distinguisher for (10) with advantage $\delta$, by Lemma 2.5 there exist distinguishers $D^{ok}$ between $\phi_{ARB}^{ok}$ and $(\mathcal{U}\otimes\mathop{\rm Id}\nolimits_{R_{1}R_{2}}\otimes\mathcal{F}^{ok})(\psi_{AR_{1}}\otimes\psi_{R_{2}B})$, and $D^{err}$ between $\phi_{RB}^{err}$ and $\psi_{R_{1}}\otimes(\mathop{\rm Id}\nolimits_{R_{2}}\otimes\mathcal{F}^{err})(\psi_{R_{2}B})$, with advantage $\delta_{1}$ and $\delta_{2}$ respectively such that $\delta_{1}+\delta_{2}\geq\delta$.

Consider first the case of $\phi_{RB}^{err}$. Using (7), (9) and Lemma 2.5 it follows that $\delta_{2}\leq\delta_{b}+\delta_{v}$. Consider next $\phi_{ARB}^{ok}$. Using the triangle inequality, $\mathcal{D}$ must distinguish between $\phi^{ok}_{AR_{1}R_{2}B}$ and $p^{\psi}\mathcal{U}(\psi_{AR_{1}})\otimes\phi^{ok}_{R_{2}B}$, and between $p^{\psi}\mathcal{U}(\psi_{AR_{1}})\otimes\phi^{ok}_{R_{2}B}$ and $\mathcal{U}(\psi_{AR_{1}})\otimes\mathcal{F}_{B}^{ok}(\psi_{R_{2}B})$, with advantage $\delta^{\prime}_{1}$ and $\delta^{\prime}_{2}$ respectively such that $\delta^{\prime}_{1}+\delta^{\prime}_{2}\geq\delta_{1}$.

Using property (8) of local verifiability and Lemma 2.5 it follows that no efficient distinguisher can distinguish $\phi_{AR_{1}}^{ok}$ from $p^{\psi}\mathcal{U}(\psi_{AR_{1}})$ with advantage larger than $\delta_{v}$. Using that the state $\mathcal{U}(\psi_{AR_{1}})$ is efficiently preparable, a specific distinguisher would be to perform a swap test with that state. It follows that $\mbox{\rm Tr}(\mathcal{U}(\psi_{AR_{1}})\phi_{AR_{1}}^{ok})\leq 2\delta_{v}$. Using the relation between fidelity and trace distance and Uhlmann’s theorem it follows that $\|\phi_{AR_{1}R_{2}B}^{ok}-p^{\psi}\mathcal{U}(\psi_{AR_{1}})\otimes\phi_{R_{2}B}^{ok}\|_{1}\leq\sqrt{4\delta_{v}}$, so by Lemma 2.4 it holds that $\delta^{\prime}_{1}\leq\sqrt{4\delta_{v}}$ as well.

Finally, using again (7), (9) and Lemma 2.5 it follows that $\delta^{\prime}_{2}\leq\delta_{b}+\delta_{v}$.

Having established (10) for some $\delta\leq 2\delta_{b}+4\sqrt{\delta_{v}}$, it remains to show the existence of a simulator $\sigma_{B}$ such that $\pi\approx_{c,\delta}\mathcal{S}_{verif}^{blind}\sigma_{B}$. The simulator is identical to the simulator constructed in the proof of [DFPR13, Theorem 5.2]: the simulator simply interacts with Bob as Alice would in the protocol $\pi$, using an arbitrary input $\psi_{B}$ instead of Alice’s real input $\psi_{A}$. This simulator is clearly efficient. The remainder of the argument is exactly the same, and we omit the details. ∎

3 Remote state preparation: real protocol

In this section we describe and analyze our implementation of the ideal resource for random remote state preparation with verification, $\textsc{RSP}_{V}$. We refer to this implementation as the real protocol (to be contrasted with the ideal protocol/functionality, introduced in the next section). As mentioned in the introduction, our implementation builds upon the randomness certification protocol from [BCM*+*18b] by, informally, performing the protocol modulo $8$ (instead of modulo $2$) and adding tests inspired from the study of quantum random access codes to verify that the prover prepares the right state, up to a local isometry.

We start by recalling the definition of a QRAC in Section 3.1, and show a new result about rigidity of $2\mapsto 1$ QRAC. In Section 3.2 we introduce the main building block for our protocol; we analyze its soundness and rigidity properties in Section 3.3. Finally, we describe and analyze our protocol for $\textsc{RSP}_{V}$ in Section 3.4.

3.1 Quantum random access codes

Definition 3.1**.**

A $2\mapsto 1$ quantum random access code (QRAC) is specified by four single-qubit density matrices $\{\phi_{u}\}_{u\in\{1,3,5,7\}}$ and two single-qubit observables $X_{0}$ and $X_{2}$. For $u\in\{1,3,5,7\}$ let $u_{0},u_{2}\in\{0,1\}$ be such that $u_{0}=0$ if and only if $u\in\{1,7\}$ and $u_{2}=0$ if and only if $u\in\{1,3\}$.141414The motivation for the somewhat obscure indexing scheme will become clear later. The success probability of the QRAC is defined as

[TABLE]

Let $\textsc{opt}_{Q}=\frac{1}{2}+\frac{1}{2\sqrt{2}}$. As shown in [ALMO08, Theorem 3], the highest possible success probability of a single-qubit $2\mapsto 1$ QRAC is $\textsc{opt}_{Q}$. More generally, we have the following rigidity statement.

Lemma 3.2**.**

Let $\{\phi_{u}\}$ and $X_{0},X_{2}$ be a $2\mapsto 1$ QRAC whose success probability is at least $(1-\delta)\textsc{opt}_{Q}$, for some $0\leq\delta<1$. Then

[TABLE]

Proof.

Assume without loss of generality that both observables $X_{0}$ and $X_{2}$ are in the plane specified by $\sigma_{X}$ and $\sigma_{Y}$. Let $v_{0}=(x_{0},y_{0},0)$ and $v_{2}=(x_{1},y_{1},0)$ be the Bloch sphere representation of the eigenvalue-$1$ eigenvector of $X_{0}$ and $X_{2}$ respectively, i.e. real unit vectors such that for $i\in\{0,2\}$, $X_{i}=x_{i}\sigma_{X}+y_{i}\sigma_{Y}$. As shown in [ALMO08, Section 3.4], the optimal success probability of any $2\mapsto 1$ QRAC based on $X_{0}$ and $X_{2}$ is $\frac{1}{2}(1+\frac{S}{8})$, where $S=2\|v_{0}+v_{2}\|+2\|v_{0}-v_{2}\|$. In order for the QRAC to achieve a success probability of $(1-\delta)\textsc{opt}_{Q}$ it is necessary that $\|v_{0}+v_{2}\|+\|v_{0}-v_{2}\|\geq 2\sqrt{2}-16\delta$. Using $4=\|v_{0}+v_{2}\|^{2}+\|v_{0}-v_{2}\|^{2}$ it follows that $|\|v_{0}+v_{2}\|^{2}-\|v_{0}-v_{2}\|^{2}|=O(\sqrt{\delta})$, thus $|v_{0}\cdot v_{2}|=O(\sqrt{\delta})$. Since $\{X_{0},X_{2}\}=2iv_{0}\cdot v_{2}\mathop{\rm Id}\nolimits$, we obtain $\|\{X_{0},X_{2}\}\|^{2}=O(\delta)$. ∎

The following simple test will be used later to estimate the success probability of a QRAC. We introduce it here to set some notation.

Definition 3.3**.**

Let $\{\phi_{u}\}_{u\in\{0,1,2,\ldots,7\}}$ be arbitrary density matrices. In the QRAC test, the prover is given $\phi_{u}$ for a uniformly random $u\in\{1,3,5,7\}$. The verifier sends a uniformly random $\theta\in\{0,2\}$ to the prover, who replies with a bit $v$. If $v\neq u_{\theta}$, the verifier sets $flag\leftarrow fail_{Q}$.

3.2 The qubit preparation test

The qubit preparation test described in Figure 3 forms the main building block of our remote state preparation protocol. The test relies on an extended variant of the family of claw-free functions used in [BCM*+*18b], introduced in [Mah18b] and called an extended noisy trapdoor claw-free family (ENTCF). We recall the definition of an ENTCF family $(\mathcal{F},\mathcal{G})$ in Appendix A, where we also present the main properties needed. For the purposes of this section it is sufficient to think of both $\mathcal{F}$ and $\mathcal{G}$ as families of pairs of functions, $(f_{k,0},f_{k,1})$ or $(g_{k,0},g_{k,1})$, where $k$ denotes a public key, such that both functions in an $f$-pair (also called claw-free pair) are bijections with the same domain and range, while both functions in a $g$-pair (also called injective pair) are bijections with the same domain but non-intersecting ranges, and such that moreover given a key $k$ it is computationally impossible to distinguish if $k$ corresponds to a claw-free or an injective pair.

We first show a completeness property of the qubit preparation test.

Lemma 3.4** (Completeness).**

There is an efficient quantum prover that is accepted with probability negligibly close to $1$ in the security parameter $\lambda$ in each of the preimage test and part A. of the $X_{\theta}$-measurement test, and with probability negligibly close to $\textsc{opt}_{Q}$ in part B. of the $X_{\theta}$-measurement test (Figure 3). Moreover, in case the verifier selects $G=0$ and a key $k$, after having returned a $y\in\mathcal{Y}$ in step 2. and an equation $d\in\mathbb{Z}_{8}^{w}$ at the beginning of step 3. the state of the prover is the state

[TABLE]

where $x_{0},x_{1}$ are the two preimages of $y$ under $f_{k,0}$ and $f_{k,1}$ respectively and $J$ is a simple map described in Appendix A.

Proof.

The honest strategy for the prover is as follows. Upon receipt of a key $k$ that specifies a pair of functions $f_{k,0}$ and $f_{k,1}$ the prover prepares a state $\ket{+}=\frac{1}{\sqrt{2}}\ket{0}+\frac{1}{\sqrt{2}}\ket{1}$, adjoins a uniform superposition over all $x\in\mathcal{X}$, evaluates $f$ in superposition, and measures the outcome $y$. The result is the state

[TABLE]

where $x_{0}$ and $x_{1}$ are the unique preimages of $y$ under $f_{k,0}$ and $f_{k,1}$ respectively.151515Here for clarity we ignore the fact that $f_{k,b}$ ranges over the set of distributions over $\mathcal{Y}$, rather than over $\mathcal{Y}$ itself. For details on how the prover can construct the state (12) with success probability exponentially close to $1$ in $\lambda$, we refer to [BCM*+*18a]. (In case $G=1$ the state further collapses to a single $\ket{b,x_{b}}$.)

If the verifier requests a preimage, the prover measures in the computational basis and returns $(b,x_{b})$. If the verifier requests an equation, the prover first evaluates the map $J$ on the second register and then measures all but the first register in the Fourier (over $\mathbb{Z}_{8}$) basis to obtain a string $d\in\mathbb{Z}_{8}^{w}$. The resulting state is

[TABLE]

where the inner products are taken modulo $8$. Finally, the prover measures the qubit in (11) in the requested basis, $\sigma_{Z}$ in the case of a $Z$-measurement or $\sigma_{X,\theta\frac{\pi}{4}}$ in the case of an $X_{\theta}$-measurement, to produce its answer. ∎

3.3 Rigidity

In this section we show that any prover, or device, that succeeds with probability close to optimum in the qubit preparation test (Figure 3) must perform measurements that obey a form of rigidity. We generally use $\varepsilon$ to denote the failure probability of the device in the test or one of its parts (the definition of $\varepsilon$ will always be specified in context), and always assume that $\varepsilon$ is larger than any term of the form $\operatorname{negl}(\lambda)$. The main result of the section is the following.

Lemma 3.5**.**

Let $\varepsilon>0$ and $\lambda$ a security parameter assumed to be chosen large enough so that $\varepsilon=\omega(\operatorname{negl}(\lambda))$. Suppose that a quantum polynomial-time prover succeeds in the qubit preparation test with probability at least $1-\varepsilon$. Let $Z$ be the observable associated with the prover’s strategy in step (b)(i) of the protocol, and $\{X_{\theta}\}_{\theta\in\{0,1,2,3\}}$ the observables associated with the prover’s strategy in step (b)(ii).

Then there exists a universal constant $c>0$, a $\delta=O(\varepsilon^{c})$, an efficiently computable isometry $\Phi:\mathcal{H}_{B}\to\mathbb{C}^{2}\otimes\mathcal{H}_{B^{\prime}}$, where $\mathcal{H}_{B}$ is the Hilbert space on which the prover’s observables act, and a state $\ket{\textsc{aux}}\in\mathcal{H}_{B^{\prime}}\otimes\mathcal{H}_{B^{\prime\prime}}$, where $mH_{B^{\prime}}$ is a purifying system for Bob’s initial state in $\mathcal{H}_{B}$, such that under the isometry $\Phi$ the following hold:

• •

In case $G=1$, the joint state of the bit $b$ and the prover’s post-measurement state in step (b) of the protocol, after having returned an equation $d$, is computationally indistinguishable from a state that is within $\delta$ trace distance of

[TABLE]

• •

In case $G=0$, the joint state of the angle $\hat{\theta}$, the bit $\hat{v}$ and the prover’s post-measurement state in step (b) of the protocol, after having returned an equation $d$, is computationally indistinguishable from a state that is within $\delta$ trace distance of

[TABLE]

The proof of Lemma 3.5 is given at the end of Section 3.3.5. We start by introducing notation to model the behavior of an arbitrary prover in the test.

3.3.1 Devices

Definition 3.6**.**

A device $D=(\phi,\Pi,M,Z,\{X_{\theta}\}_{\theta\in\{0,1,2,3\}})$ is specified by the following.

A (not necessarily normalized) positive semidefinite $\phi\in\mathrm{Pos}(\mathcal{H}_{\textsf{D}}\otimes\mathcal{H}_{\textsf{Y}})$. Here $\mathcal{H}_{\textsf{D}}$ is an arbitrary space private to the device, and $\mathcal{H}_{{\textsf{Y}}}$ is a space of the same dimension as the cardinality of the set $\mathcal{Y}$, also private to the device. (We think of $\phi$ as the state of the device immediately prior to returning the commitment string $y$. In particular, $\phi$ implicitly depends on the key $k\in\mathcal{K}_{\mathcal{F}}\cup\mathcal{K}_{\mathcal{G}}$.) For every $y\in\mathcal{Y}$, define

[TABLE]

Note that $\phi_{y}$ is not normalized, and $\sum_{y\in\mathcal{Y}}\mbox{\rm Tr}(\phi_{y})=\mbox{\rm Tr}(\phi)$. 2. 2.

For every $y\in\mathcal{Y}$,

1. (a)

A projective measurement $\{\Pi_{y}^{(b,x)}\}$ on $\mathcal{H}_{\textsf{D}}$, with outcomes $(b,x)\in\{0,1\}\times\mathcal{X}$. For each $y$, this measurement has two designated outcomes $(0,x_{0})$ and $(1,x_{1})$, which are the answers that are accepted in the preimage test; recall that we use the notation $V_{y}$ for this set. For $b\in\{0,1\}$ we use the shorthand $\Pi_{y}^{b}=\Pi_{y}^{(b,x_{b})}$, $\Pi_{y}=\Pi_{y}^{0}+\Pi_{y}^{1}$, and $\Pi_{y}^{2}=\mathop{\rm Id}\nolimits-\Pi_{y}^{0}-\Pi_{y}^{1}$. 2. (b)

A projective measurement $\{M_{y}^{d}\}$ on $\mathcal{H}_{\textsf{D}}$, with outcomes $d\in\mathbb{Z}_{8}^{w}$. 3. (c)

A binary observable $Z$ on $\mathcal{H}_{\textsf{D}}$. 4. (d)

For every $\theta\in\{0,1,2,3\}$, a binary observable $X_{\theta}$ on $\mathcal{H}_{\textsf{D}}$.

By Naimark’s theorem, up to increasing the dimension of $\mathcal{H}_{\textsf{D}}$ the assumption that $\{\Pi_{y}^{(b,x)}\}$, $\{M_{y}^{d}\}$ and $Z$, $X_{\theta}$ are projective is without loss of generality. For notational convenience we often drop the subscript $y$ from the measurements $\Pi_{y}$ and $M_{y}$, and the state $\phi_{y}$.

Definition 3.7** (Efficient devices).**

We say that a device $D=(\phi,\Pi,M,Z,\{X_{\theta}\})$ is efficient if the state $\phi$ can be prepared efficiently, and each of the measurements can be implemented efficiently.

We introduce notation for some post-measurement states of a device.

Definition 3.8**.**

Let $D=(\phi,\Pi,M,Z,\{X_{\theta}\})$ be a device. Let $\theta\in\{0,1,2,3\}$ and $v\in\{0,1\}$. Define a sub-normalized density matrix

[TABLE]

We sometimes omit $y$ and write $\phi_{\theta,v}$ for the same state. Note that since we assumed that $\{M_{y}^{d}\}$ is projective, the $8$ states $\phi_{\theta,v}$ are orthogonal. We write $\phi_{\theta}=\phi_{\theta,0}+\phi_{\theta,1}$.

3.3.2 Preimage test

In this section we draw consequences from the assumption that a device succeeds with probability at least $1-\varepsilon$ in the preimage test.

Lemma 3.9**.**

Let $D=(\phi,\Pi,M,Z,\{X_{\theta}\})$ be an efficient device that succeeds with probability at least $1-\varepsilon$ in the preimage test, for some $0\leq\varepsilon\leq 1$. Then there is an efficient device $D^{\prime}=(\phi^{\prime},\Pi,M,Z,\{X_{\theta}\})$ such that $\|\phi^{\prime}-\phi\|_{1}=O(\sqrt{\varepsilon})$ and such that $D^{\prime}$ succeeds with probability negligibly (in the security parameter $\lambda$) close to $1$ in the preimage test. In particular, for any $k\in\mathcal{K}_{\mathcal{F}}$ the state of $D^{\prime}$ after having returned $y$ has the form

[TABLE]

where for $b\in\{0,1\}$, $x_{b}=\textsc{Inv}_{\mathcal{F}}(t_{k},b,y)$, $\ket{\phi_{y,0}}$ and $\ket{\phi_{y,1}}$ are arbitrary, and the basis is chosen such that the measurement $\{\Pi^{(b,x_{b})}\}$ is a computational basis measurement of the first two registers. Similarly, for $k\in\mathcal{K}_{\mathcal{G}}$ the same state can be expressed as

[TABLE]

where $(\hat{b},x_{\hat{b}})=\textsc{Inv}_{\mathcal{G}}(t_{k},y)$.

Proof.

The proof is analogous to the reduction to a “perfect prover” shown in [Mah18c, Claim 7.2], and we only sketch it here. Given $\phi_{y}$, the device can evaluate CHKF in superposition to check if it would succeed in the preimage test. The device $D^{\prime}$ then repeatedly prepares $\phi$ and measures $y$ as $D$ would, until it has obtained a state $\phi_{y}$ that passes the preimage test with certainty (or until a polynomial number of attempts to do so have failed). The distance between $D$ and $D^{\prime}$ is bounded by the gentle measurement lemma (Lemma 9 in [Win99]). ∎

Lemma 3.10**.**

Let $D$ be an efficient device that succeeds with probability $1$ in the preimage test. Then for every $\theta\in\{0,1,2,3\}$ and $v\in\{0,1\}$, no polynomial-time quantum procedure can predict $\hat{\theta}(d)$ given $(y,d,\phi_{\theta,v})$ with advantage non-negligibly larger than $\frac{1}{4}$. Moreover, for every $\theta\in\{0,1,2,3\}$ no polynomial-time quantum procedure can predict $\hat{v}(d)$ given $(y,d,\phi_{\theta,v},\theta)$ with advantage non-negligibly larger than $\frac{1}{2}$.

In particular, the joint distribution of $(\hat{\theta}(d),\hat{v}(d))$ computed by the verifier in the measurement test is negligibly close to uniform, where the probability is taken over the device’s actions, including the choice of $y$ and $d$.

Proof.

Suppose for contradiction that there exists a distinguisher that achieves success probability noticeably larger than $\frac{1}{8}$, where the probability is over $y$ and $d$ as computed by the device as well as the distinguisher’s internal randomness. Suppose first that the distinguisher can predict $\hat{\theta}(d))$ with advantage noticeably larger than $\frac{1}{4}$. Using the collapsing property (Lemma A.7) and the fact that $\{M_{y}^{d}\}$ is efficient and the distinguisher are assumed efficient, it is still the case that the distinguisher has advantage noticeably larger than $\frac{1}{4}$ in predicting $\hat{\theta}(d))$ when the device first measures $\{\Pi_{y}^{(b,x_{b})}\}$ to obtain $(b,x_{b})$ and then only applies $\{M_{y}^{d}\}$ to obtain $d$. This contradicts the hardcore bit property (35).

Similarly, if the distinguisher has advantage noticeably larger than $\frac{1}{2}$ in predicting $\hat{v}(d)$, conditioned on its guess for $\hat{\theta}(d)$ being correct, using the collapsing property we construct an adversary that contradicts the hardcore bit property (34). ∎

3.3.3 $Z$-measurement test

Lemma 3.11**.**

Let $D$ be an efficient device that succeeds with probability $1$ in the preimage test, and at least $1-\varepsilon$ in the $Z$-measurement test. Then on average over $y\in\mathcal{Y}$,

[TABLE]

Proof.

The assumption of success $1-\varepsilon$ in the $Z$-measurement test implies that, on average over $k\in\mathcal{K}_{\mathcal{G}}$ and $y\in\mathcal{Y}$,

[TABLE]

where we used that for $k\in\mathcal{K}_{\mathcal{G}}$ by Lemma 3.9 it holds that $\phi=\sum_{b}\Pi^{b}\phi\Pi^{b}$. Since $\Pi$, $M$ and $Z$ can all be efficiently implemented, using the collapsing property (Lemma A.7) (18) holds on average over $k\in\mathcal{K}_{\mathcal{F}}$ as well.

Let $\Pi=\Pi^{0}-\Pi^{1}$ act on the first qubit of $\phi$ (written as in (15)). Again using the collapsing property, $\Pi\phi\Pi$ and $\phi$ are computationally indistinguishable, so

[TABLE]

Using that $\phi-\Pi\phi\Pi=2(\Pi^{0}\phi\Pi^{1}+\Pi^{1}\phi\Pi^{0})$, combining (18) and (19) gives

[TABLE]

Expanding the square in (17), this proves the lemma. ∎

3.3.4 $X_{\theta}$-measurement test, part A

Lemma 3.12**.**

Let $D=(\phi,\Pi,M,Z,\{X_{\theta}\})$ be an efficient device. Define a sub-normalized density

[TABLE]

Then $\tilde{\phi}_{{\textsf{YBXD}}}$ is the post-measurement state of the device at the end of the preimage test. For $v\in\{0,1\}$ and $\theta\in\{0,1,2,3\}$ let

[TABLE]

Then for any $\theta\in\{0,1,2,3\}$, $\sigma_{\theta,0}$ and $\sigma_{\theta,1}$ are computationally indistinguishable.

Proof.

The proof is almost identical to the proof of [BCM*+*18a, Lemma 7.1]. Suppose for contradiction that there exists a $\theta\in\{0,1,2,3\}$ and an efficient observable $O$ such that

[TABLE]

for some non-negligible function $\mu(\lambda)$. We derive a contradiction with the hardcore bit property (34).

Consider the following efficient procedure $\mathcal{A}$. $\mathcal{A}$ first prepares the state $\tilde{\phi}_{{\textsf{YBXD}}}$ in (20). This can be done efficiently by first preparing $\phi_{{\textsf{YD}}}$, then measuring a $y\in\mathcal{Y}$, then applying the measurement $\{\Pi_{y}^{(b,x)}\}$ to $\phi_{y}$, and returning a special abort symbol if the outcome is invalid, i.e. CHK${}_{\mathcal{F}}(k,b,x,y)=0$.

$\mathcal{A}$ then applies the measurement $\{M_{y}^{d}\}$ to $\tilde{\phi}_{{\textsf{YBXD}}}$, obtaining an outcome $d\in\mathbb{Z}_{8}^{w}$. Next, it measures using $\{X_{\theta}^{v}\}$ to obtain $v\in\{0,1\}$. At this point, the procedure has prepared either $\sigma_{\theta,0}$ or $\sigma_{\theta,1}$. Finally, the procedure measures $O$ to obtain a bit $u$, and returns $(b,x,d,\theta,u\oplus v)$.

This defines an efficient procedure. Using (22) it follows that the procedure violates the hardcore bit property (34). To see why, note that the guarantee (22) only holds when $\theta=\hat{\theta}(d)$, but this is precisely when (34) requires that there should be no distinguishing advantage. ∎

Corollary 3.13**.**

Let $D=(\phi,\Pi,M,Z,\{X_{\theta}\})$ be an efficient device that succeeds in the preimage test with probability $1$, and in the $Z$-measurement test with probability at least $1-\varepsilon$. Then on average over $y$,

[TABLE]

where $\phi_{\theta}$ is defined in Definition 3.8.

Proof.

Lemma 3.12 implies that $\sigma_{\theta,0}$ and $\sigma_{\theta,1}$ must have traces that are negligibly far from each other, i.e. for every $\theta$ and on average over $y\in\mathcal{Y}$,

[TABLE]

Using Lemma 3.11 and the Cauchy-Schwarz inequality, this expression is within $O(\sqrt{\varepsilon})$ of

[TABLE]

as desired. ∎

The following lemma shows a strong form of incompatibility between the measurements $Z$ and $X_{\theta}$, for any efficient device.

Lemma 3.14**.**

Let $D=(\phi,\Pi,M,Z,\{X_{\theta}\})$ be an efficient device such that $D$ succeeds with probability $1$ in the preimage test, and with probability at least $1-\varepsilon$ in both the $Z$-measurement test and part A. of the $X_{\theta}$-measurement test. Then there exists $\varepsilon_{\textsc{ac}}=O(\varepsilon^{1/4})$ such that on average over $y\in\mathcal{Y}$,

[TABLE]

Proof.

The assumption that $D$ succeeds with probability $1-\varepsilon$ in part A. of the $X_{\theta}$-measurement test implies that on average over $y\in\mathcal{Y}$ and $\theta$ distributed according to $\mbox{\rm Tr}(\phi_{\theta})$,

[TABLE]

Let $\tilde{\phi}_{\theta}$ be the normalized state $\phi_{\theta}/\mbox{\rm Tr}(\phi_{\theta})$. Using Lemma 3.10 to argue that the renormalization is roughly uniform for all but a negligible fraction of all $y$, Corollary 3.13 implies that on average over $y$,

[TABLE]

Since $\sum_{b,v}\mbox{\rm Tr}(X_{\theta}^{v}Z^{b}\tilde{\phi}_{\theta}Z^{b})=1$, it follows that for any $\theta\in\{0,1,2,3\}$ and $v\in\{0,1\}$,

[TABLE]

Conditions (23) and (24) place us in a position to apply [BCM*+*18a, Lemma 7.2], with $\phi=\phi_{\theta,v}$ (renormalized), $M=X_{\theta}^{v}$, and $\Pi=Z^{0}$. Taking $\omega=\frac{1}{2}+\Omega(\varepsilon^{1/4})$, the lemma implies that the projection $K$ on eigenspaces of the operator

[TABLE]

with associated eigenvalue bounded away from $\frac{1}{2}$ by $\Omega(\varepsilon^{1/4})$ satisfies $\mbox{\rm Tr}((\mathop{\rm Id}\nolimits-K)\phi)=O(\sqrt{\varepsilon})$. Thus for $v\in\{0,1\}$, $\mbox{\rm Tr}(([Z,X_{\theta}^{v}]-\frac{1}{2}Z)^{2}\phi)=O({\varepsilon}^{1/4})$. The lemma follows. ∎

Lemma 3.14 specifies that $Z$ and $X_{\theta}$ are close to anti-commuting on the state $\phi_{\theta}$. The following lemma uses the collapsing property and the hardcore bit property to argue that anti-commutation extends to any $\phi_{u}$, for $u\in\{0,1,2,3\}$.

Lemma 3.15**.**

Under the same assumptions as Lemma 3.14, on average over $y\in\mathcal{Y}$ and for all $\theta\in\{0,1,2,3\}$,

[TABLE]

for some $\varepsilon^{\prime}_{\textsc{ac}}=O(\sqrt{\varepsilon_{\textsc{ac}}})$.

Proof.

First we observe that for a (possibly unknown) $u$ the value \mbox{\rm Tr}\big{(}\{Z,X_{\theta}\}^{2}\phi_{u}\big{)} can be estimated efficiently. This is because for any $\ket{\psi}$, it is possible to implement

[TABLE]

at which point a measurment of the last qubit in the Hadamard basis returns $\ket{+}$ with probability $\frac{1}{2}\bra{\psi}\{Z,X_{\theta}\}^{2}\ket{\psi}$. By the collapsing property, \sum_{u}\mbox{\rm Tr}\big{(}\{Z,X_{\theta}\}^{2}\phi_{u}\big{)} is within negligible distance of \sum_{u}\mbox{\rm Tr}\big{(}\{Z,X_{\theta}\}^{2}\tilde{\phi}_{u}\big{)}, where $\tilde{\phi}_{u}$ is the result of first measuring $\{\Pi^{(b,x_{b})}\}$ on $\phi$ and then measuring $\{M^{d}\}$.

Now suppose for contradiction that there exists an $u^{\prime}$ such that \mbox{\rm Tr}\big{(}\{Z,X_{\theta}\}^{2}\phi_{u^{\prime}}\big{)} is noticeably larger than \mbox{\rm Tr}\big{(}\{Z,X_{\theta}\}^{2}\phi_{u}\big{)}, for all $u\neq u^{\prime}$. As argued above, by the collapsing property the same holds with respect to the states $\tilde{\phi}_{u^{\prime}}$ and $\tilde{\phi}_{u}$.

Consider the following efficient procedure $\mathcal{A}$. Starting from $\phi$, measure $\{\Pi^{(b,x_{b})}\}$ to obtain $(b,x_{b})$. Then measure $\{M^{d}\}$ to obtain $d$. Finally, implement the test described in (25). If the outcome is $\ket{+}$, return $u^{\prime}$. If the outcome is $\ket{-}$, repeat a uniformly random $u\in\{0,1,2,3\}$.

Then $\mathcal{A}$ returns $(b,x_{b},d,u^{\prime})$ such that $u^{\prime}=\hat{\theta}(d)$ with probability noticeably larger than $1/4$, violating the adaptive hardcore bit property (35). ∎

3.3.5 $X_{\theta}$-measurement test, part B

Lemma 3.16**.**

Let $D=(\phi,\Pi,M,Z,\{X_{\theta}\})$ be an efficient device, such that $D$ succeeds with probability $1$ in the preimage test, with probability at least $1-\varepsilon$ in both the $Z$-measurement test and part A. of the $X_{\theta}$-measurement test, and with probability at least $(1-\varepsilon)\textsc{opt}_{B}$ in part B. of the $X_{\theta}$-measurement test. Then on average over $y\in\mathcal{Y}$,

[TABLE]

for some $\varepsilon^{\prime\prime}_{\textsc{ac}}=O((\varepsilon^{\prime}_{\textsc{ac}})^{1/4})$.

Proof.

We perform a reduction to Lemma 3.2. The main work we need to do is argue that the observables $X_{0}$ and $X_{2}$ can be represented as observables acting on the same qubit. (The case of $X_{1}$ and $X_{3}$ is similar.)

Applying Lemma 3.15 for $\theta=0$ and $\theta=2$ followed by Lemma 2.9 we deduce that there is an isometry $V:\mathcal{H}_{\textsf{D}}\to\mathbb{C}^{2}\otimes\mathcal{H}_{{{\textsf{D}}^{\prime}}}$ and $\delta^{\prime}=O(\sqrt{\varepsilon_{\textsc{ac}}})$ under which which $Z\simeq_{\delta^{\prime}}\sigma_{Z}\otimes\mathop{\rm Id}\nolimits$, $X_{0}\simeq_{\delta^{\prime}}\sigma_{X}\otimes\mathop{\rm Id}\nolimits$, and $X_{2}\simeq_{\delta^{\prime}}\sigma_{X}\otimes A_{X}+\sigma_{Y}\otimes A_{Y}$, where $A_{X}$, $A_{Y}$ are Hermitian commuting such that $A_{X}^{2}+A_{Y}^{2}=\mathop{\rm Id}\nolimits$.

Let $\{\ket{v_{j}}\}$ be a joint diagonalization basis of $A_{X}$ and $A_{Y}$. Let $\rho=\sum_{u\in\{0,1,2,3\}}V\phi_{u}V^{\dagger}$, as a density matrix on $\mathbb{C}^{2}\otimes\mathcal{H}_{{{\textsf{D}}^{\prime}}}$ ($\rho$ implicitly depends on $y$, so it is not normalized). Define a distribution $p_{j,y}=\mbox{\rm Tr}(\rho^{(j)})$, with $\rho^{(j)}$ the single-qubit density matrix

[TABLE]

For any $j,y$ define a $2\mapsto 1$ QRAC as follows. The encoding of $u+4v\in\{1,3,5,7\}$, with $u\in\{1,3\}$ and $v\in\{0,1\}$, is the renormalized density matrix $\rho^{(j)}_{u,v}$, defined as $\rho^{(j)}$ in (26) with $\rho_{u,v}$ instead of $\rho$. The observables are $\sigma_{X}$ and $\bra{v_{j}}A_{X}\ket{v_{J}}\sigma_{X}+\bra{v_{j}}A_{Y}\ket{v_{j}}\sigma_{Y}$.

Using Lemma 3.10 and the assumption on the device’s success probability in part B. of the $X_{\theta}$-measurement test it follows that this QRAC, on average over $(y,j)$, satisfies the assumption of Lemma 3.2, for some $\delta=O(\sqrt{\delta^{\prime}})$. The conclusion follows. ∎

We end with the proof of the main lemma of the section, Lemma 3.5.

Proof of Lemma 3.5.

Fix a strategy for the prover that is accepted with probability at least $1-\varepsilon$ in the qubit preparation test. Then the strategy is accepted with probability at least $1-2\varepsilon$ in the preimage test, and at least $1-4\varepsilon$ in each of the $Z$-measurement test and the $X_{\theta}$-measurement test.

Applying Lemma 3.15 and Lemma 3.16 followed by Lemma 2.9 to $Z$, $X_{0}$ and $X_{2}$ if follows that there exists an efficient isometry $V$ from $\mathcal{H}_{B}$ to $\mathbb{C}^{2}\otimes\mathcal{H}_{B^{\prime}}$ under which $Z\simeq_{\delta_{1}}\sigma_{Z}\otimes\mathop{\rm Id}\nolimits$, $X_{0}\simeq_{\delta_{1}}\sigma_{X}$ and $X_{2}\simeq_{\delta_{1}}\sigma_{Y}\otimes\mathop{\rm Id}\nolimits$, for some $\delta_{1}=O(\sqrt{\varepsilon^{\prime\prime}_{ac}})$. It follows from success in part (b)(ii)A. that, under the isometry, for $\theta\in\{0,2\}$ and $v\in\{0,1\}$ the state $\phi_{\theta,v}$ is within $O(\delta_{1})$ of $\ket{+_{\theta\frac{\pi}{4}+v\pi}}\!\bra{+_{\theta\frac{\pi}{4}+v\pi}}\otimes\ket{\textsc{aux}_{\theta,v}}\!\bra{\textsc{aux}_{\theta,v}}$, for some states $\ket{\textsc{aux}_{\theta,v}}$. Using success in part (b)(ii)B. (the QRAC test) and applying Lemma 3.2 it similarly follows that for $\theta\in\{1,3\}$ and $v\in\{0,1\}$ the state $\phi_{\theta,v}$ is, under the same isometry, within $O(\delta_{1})$ of a state of the form $\ket{+_{\theta\frac{\pi}{4}+v\pi}}\!\bra{+_{\theta\frac{\pi}{4}+v\pi}}\otimes\ket{\textsc{aux}_{\theta,v}}\!\bra{\textsc{aux}_{\theta,v}}$.

Recall that by Lemma 3.10 the states $\phi_{\theta}$ are computationally indistinguishable. According to the previous paragraph,

[TABLE]

Since the operators $e^{i\theta\frac{\pi}{4}}\ket{0}\bra{1}+e^{-i\theta\frac{\pi}{4}}\ket{1}\bra{0}$ have constant trace distance for distinct values of $\theta$, it follows that $\ket{\textsc{aux}_{\theta,0}}\!\bra{\textsc{aux}_{\theta,0}}\approx_{c}\ket{\textsc{aux}_{\theta,1}}\!\bra{\textsc{aux}_{\theta,1}}$ for all $\theta$, and that they are computationally indistinguishable for different values of $\theta$.

This gives the second condition in the lemma. To obtain the first, recall that under $V$ it holds that $Z\simeq_{\delta_{1}}\sigma_{Z}\otimes\mathop{\rm Id}\nolimits$. Using success in part (b)(i) of the protocol the state at the beginning of step (b)(i) is of the form $\sum_{b}\ket{b}\!\bra{b}\otimes\ket{b}\!\bra{b}\otimes\ket{\textsc{aux}_{b}}\!\bra{\textsc{aux}_{b}}$, where the first $b$ is held by the verifier and $\ket{\textsc{aux}_{b}}\in\mathcal{H}_{B^{\prime}}$ are abitrary (not necessarily normalized). Using the collapsing property (Lemma A.7), for $b\in\{0,1\}$, $\ket{\textsc{aux}_{b}}\!\bra{\textsc{aux}_{b}}$ is computationally indistinguishable from any of the $\ket{\textsc{aux}_{\theta,0}}\!\bra{\textsc{aux}_{\theta,0}}+\ket{\textsc{aux}_{\theta,1}}\!\bra{\textsc{aux}_{\theta,1}}$. ∎

3.4 Real protocol for remote state preparation

In this section we introduce a many-round protocol that repeatedly calls the qubit preparation test. Eventually, the protocol returns either “abort”, or an angle $\theta\in\Theta$. The protocol is described in Figure 4.

To show that the protocol can be used to implement the $\textsc{RSP}_{V}$ resource, which will be done in the next section, we prove the following.

Theorem 3.17**.**

Suppose the remote state preparation protocol (Figure 4) with security parameter $\lambda>0$, maximum number of rounds $N\in\mathbb{N}$ and error tolerance $\delta\in[0,1]$ is executed with an arbitrary quantum polynomial-time prover. Assume that the protocol succeeds with probability at least $\omega$, for some $\omega>0$ such that $N\geq\delta^{-3}\log(2/\delta\omega)$. Then there exists an efficient isometry $\Phi$ and a state $\ket{\textsc{aux}}$ such that the joint state of the verifier’s input bit $W$, his output angle $b$ ($W=Z$) or $\theta$ ($W=X$), and the prover’s final state, conditioned on not aborting in step 2., is such that

[TABLE]

where $\varepsilon=O(\delta^{c})+negl(\lambda)$, for some constant $c>0$, and $p_{Z}$, $p_{X}$ are the verifier’s prior probability of choosing $W=Z$ or $W=X$ respectively. Moreover, the honest strategy introduced in the proof of Lemma 3.4 succeeds with probability negligibly close to $1$ in the protocol. At the end of the protocol, the verifier returns a uniformly random $b\in\{0,1\}$ and the prover’s state is $\ket{b}$ ($W=Z$) or $\theta\in\Theta$ ($W=X$) and the prover’s state is $\ket{+_{\theta}}$.

Proof.

The completeness property follows from Lemma 3.4 and a standard concentration bound.

To show soundness, fix a strategy for the prover that succeeds with probability at least $\omega$. For $i\in\{1,\ldots,N\}$ let $T_{i}\in\{0,1\}$ be a random variable that equals $1$ if and only if the prover does not cause the verifier to raise a $fail$ flag in the $i$-th round. By assumption on the prover’s success probability it holds that $T=\frac{1}{R}\sum_{i=1}^{R}T_{i}\geq(1-\delta)\textsc{opt}$ with probability at least $\omega$, where $\textsc{opt}=\frac{3}{4}+\frac{1}{4}\textsc{opt}_{Q}$.

Applying Azuma’s inequality, the probability that $T$ deviates from its expectation by more than $\delta$ is at most $2e^{-\delta^{2}R/2}$. It follows that as long as

[TABLE]

the expectation of $T$ conditioned on success satisfies $\textsc{E}[T|\text{not }abort]\geq(1-\delta)\textsc{opt}$. Under the assumption on $N$, $\delta$ and $\omega$ made in the theorem, condition (28) is satisfied with probability at least $1-\delta$ over the choice of $R$. Applying Markov’s inequality, a randomly chosen round satisfies $\textsc{E}[T_{i}|\text{not }abort]\geq 1-O(\sqrt{\delta})$ with probability at least $1-O(\sqrt{\delta})$. Provided such a round is chosen as the $R$-th round, we can apply Lemma 3.5 to conclude. ∎

4 Remote state preparation: ideal functionality

In this section we show that the remote state preparation protocol introduced in Section 3 constructs the ideal $\textsc{RSP}_{V}$ resource described in Section 1. The definition of $\textsc{RSP}_{V}$ (illustrated in Figure 1) is as follows:

Definition 4.1** (Random Remote State Preparation with Verification).**

The resource receives $W\in\{X,Z\}$ from Alice’s interface and the bit $c\in\{0,1\}$ from Bob’s interface. If $c=0$ and $W=Z$, Alice receives a uniformly random bit $b\in\{0,1\}$ and Bob receives the state $\ket{b}$. If $c=0$ and $W=X$ Alice receives a uniformly random value $\theta\in\Theta=\{0,\frac{\pi}{4},\ldots,\frac{7\pi}{4}\}$ and Bob receives the state $\ket{+_{\theta}}$. If $c=1$ both Alice and Bob receive an $ERR$ message.

Recall that our goal is to show that an implementation of the RSP protocol described in the previous section, based on a classical channel and a measurement buffer as communication resources,161616The measurement buffer is used each time the measurement test, step 3(b) of the qubit preparation test in Figure 3, is executed. The classical channel is used for all other steps. securely implements $\textsc{RSP}_{V}$. In the AC language, the implementation of RSP using the communication resources is known as the real protocol, and we denote it BRSP, for buffered remote state preparation. As an abstract functionality, we illustrate it in Figure 5. Alice has an input $W$,171717Alternatively, we say that Alice and Bob receive their inputs from (and return their outputs to) an environment. specifying the basis for state preparation, and produces as output either a random $b$ if $W=Z$, a random $\theta$ if $W=X$, or $ERR$ if Bob behaved maliciously. Bob takes as input the bit $c$, specifying whether he should behave honestly or maliciously. Mirroring Alice, his output is either a state $\ket{b}$, a state $\ket{+_{\theta}}$, or $ERR$. The two interact via a classical channel and a measurement buffer according to the specification given in Figure 5.

We note that in BRSP the buffer is only needed for step 3(b) of the protocol — from Figure 4 — in which there is a constant number of challenges, so that it remains efficient for Bob to forward a specification of each of its measurements. The fact that we build the real protocol from a measurement buffer is necessary for the security proof to go through. Informally, and outside of the AC framework, the measurement buffer is “without loss of generality”: in any execution of the protocol, Bob’s answer to a challenge from Alice is obtained by making a measurement on a quantum state; since we assume that Bob is computationally efficient an explicit description of the measurement exists, and this is all that is needed for the stand-alone security proof.

Obtaining composable security is more subtle, and this is why the buffer is needed. Note that its use does not preclude Bob from sharing a prior entangled state with the environment, nor from exchanging quantum messages with the environment in-between any two uses of the measurement buffer. In this sense the use of the buffer is comparable yet much less restrictive to the way a “device” is defined to obtain composable security of device-independent protocols for e.g. randomness expansion [Por17]. In that context, Alice (the verifier) interacts with a device that is prepared by Bob (the eavesdropper). Bob is allowed to provide the initial state of the device, but he does not interact with it at any later stage of the protocol, and in particular is not allowed to receive the contents of the internal memory of the device at the end of the protocol. In our setting, this latter point is allowed.

Summarizing, we view the protocol as consisting of three parties $\pi=(\pi_{A},\pi_{Buff},\pi_{B})$, where $\pi_{A}$ denotes Alice’s actions, $\pi_{B}$ denotes Bob’s actions and $\pi_{Buff}$ the actions of the measurement buffer. Whenever step 3 of the protocol is executed Bob sends his state and measurements to the buffer, where it is measured according to the measurement specified by Alice’s challenge. The measurement result is sent to both Alice and Bob. Bob, in addition, receives Alice’s challenge and the post-measurement state. We now show that BRSP constructs the ideal $\textsc{RSP}_{V}$ resource from classical channels.

Theorem 4.2**.**

The buffered remote state preparation protocol implements the ideal $\textsc{RSP}_{V}$ functionality. In other words, let $\mathcal{R}$ denote a classical channel and $\pi=(\pi_{A},\pi_{Buff},\pi_{B})$ denote the BRSP protocol:

• •

$\pi_{A}$* takes as input a bit $W$, specifying either the $Z$ basis or the $X$ basis and produces as output either a bit $b$, an angle $\theta$ or the $ERR$ flag. The actions that Alice performs in $\pi_{A}$ are exactly the same as in the RSP protocol, as described in Figure 5. $\pi_{A}$ interacts with the classical channel $\mathcal{R}$.*

• •

$\pi_{B}$* takes as input a bit $c$, specifying either honest (when $c=0$) or malicious (when $c=1$) behavior and outputs either $\ket{b}$, $\ket{+_{\theta}}$ or the $ERR$ flag. It ignores the bit $c$ and always behaves honestly, i.e. perform the actions instructed by Alice in RSP. For each measurement test performed, $\pi_{B}$ sends the state to be measured to $\pi_{Buff}$ and expects to receive the measurement outcome and the post-measurement state.*

• •

$\pi_{Buff}$* receives a message from Alice. It receives from Bob a specification $\mathcal{F}$ of a measurement to perform for each of Alice’s messages, as well as a state $\rho$ to be measured. It measures the state according to $\mathcal{F}(M)$. The measurement outcome is returned to both Alice and Bob. The post-measurement state is returned to Bob.*

We denote by $\perp_{B}$ a filtered functionality for Bob that has him set $c=0$ in $\textsc{RSP}_{V}$. Additionally, let $\lambda>0$ denote the security parameter used in BRSP, and $\delta>0$ denote the error tolerance parameter of BRSP. Then it holds that

[TABLE]

and there exists a polynomial-time quantum simulator $\sigma_{B}$ such that

[TABLE]

where $\varepsilon_{1}=\operatorname{negl}(\lambda)$ and $\varepsilon_{2}=O(\delta^{c})+\operatorname{negl}(\lambda)$, for some constant $c>0$.

Proof.

Eq. (29) follows immediately from the completeness of BRSP, that is inherited from the completeness of RSP (see Theorem 3.17). Indeed, if Alice, Bob and the buffer follow the protocol, their results are exactly those obtained in the ideal functionality.

For Eq. (30), note that we are assuming that Bob is the only malicious party, whereas Alice and the buffer still follow their honest actions in the protocol. Let us consider a simulator $\sigma_{B}$ that executes the BRSP protocol with Bob. More specifically, the simulator executes the “buffered” analogue of the protocol from Figure 4 with Bob.

If the protocol aborts before step $3$, the simulator sets $c=1$ in the ideal $\textsc{RSP}_{V}$ functionality, indicating $ERR$. If the protocol does not abort, the simulator chooses uniformly at random whether to perform the $W_{S}=Z$ or the $W_{S}=X$ run of the protocol. (We denote by $W_{S}$ the simulator’s choice of basis to avoid confusion with $W$, which denotes Alice’s choice.) In step $4$, the simulator takes Bob’s state and performs the measurement that returns the string $y$. Note that at step 5, from the point of view of Bob, the situation is indistinguishable from step 3(b) in the qubit preparation test (Figure 3). The simulator requests measurements for Bob associated with that step, that is, a “preimage measurement” as well as measurements $Z$ and $X_{\theta}$ associated with part (b)(ii). (To ensure that Bob does not detect this modification, we may assume that in the buffered protocol execution Bob’s measurements for step 3 are always requested at the end of step 2, irrespective of whether step 3 is performed or not, i.e. prior to round $R$ or not.)

If the simulator does not receive a state and measurements of matching dimension it sets $c=1$ and causes the ideal functionality to abort. Assuming the simulator has not aborted after receiving Bob’s final state, it sets $c=0$ in the $\textsc{RSP}_{V}$  functionality, and takes the resulting state. Using the specification of Bob’s measurement operators $Z$ and $X_{\theta}$ it computes the isometry $\Phi$ whose existence is guaranteed by Theorem 3.17,181818As long as the measurements are observables of the same dimension the isometry is always well-defined, whether the assumptions of the theorem are satisfied or not. “undoes” the isometry by applying its inverse, replaces the first qubit of the B register in (27) by the qubit obtained from $\textsc{RSP}_{V}$, and re-applies the isometry. It returns the resulting state to Bob. Let us now consider a distinguisher that interacts with either $\pi_{A}\mathcal{R}\pi_{Buff}$ or $\textsc{RSP}_{V}\sigma_{B}$ and which has the initial state $\psi$. In the first case we denote the distinguisher’s final state as $\tau^{\psi}_{AB}$. Assuming that in the protocol Alice accepts with probability $1-p^{\psi}$, for some $p^{\psi}>0$, we have that:

[TABLE]

where

[TABLE]

and $\gamma^{\psi}_{B}$ is some state on Bob’s side that is consistent with the protocol having aborted and the initial state of the system being $\psi$. The expression from Eq. (32) follows from the rigidity theorem (Theorem 3.17), since, conditioned on success, the reduced state of Alice and Bob takes the form in (32). Note that the probabilities for the choices $W=Z$ and $W=X$, respectively, as well as the isometry on Bob’s system and his auxiliary state, are determined by the initial state $\psi$.

Now let us consider the case when the distinguisher interacts with the ideal functionality and the simulator. We denote the final state, prior to the simulator performing the qubit swap, as $\sigma_{ASB}^{\psi}$. Once again, assuming the probability of acceptance for BRSP (as run by the simulator this time) is $1-p^{\psi}$, with $p^{\psi}>0$, we have that:

[TABLE]

where $\gamma^{\psi}_{B}$ is the same as in (31). At this point in the protocol, $\rho^{\psi}_{ASB}=\rho^{\psi}_{A}\otimes\rho^{\psi}_{SB}$, since, conditioned on acceptance in BRSP, the simulator has not yet interacted with the ideal functionality. Using the rigidity theorem again, we get

[TABLE]

Note that the probabilities for the $Z$ and $X$ tests are equal, since we’ve established that the simulator chooses which to perform uniformly at random. Also note that the $\ket{\textsc{aux}^{\psi}}$ system is shared between the simulator and Bob. The simulator now sets $c=0$ in the ideal functionality and receives the state it provides. As already described, it then “undoes” the isometry on the state it has from Bob, replaces the first qubit with the one from the ideal functionality, reapplies the isometry and sends the state to Bob.

As in the interaction with the real protocol, supposing that Alice (as controlled by the distinguisher) chooses to perform the two tests with probabilities $p_{Z}^{\psi}$ and $p_{X}^{\psi}$, respectively, the output she receives from the ideal functionality is either $b$ or $\theta$, with the associated probabilities. The state that the simulator receives and swaps into Bob’s system is of course classically correlated with this output, being either $\ket{b}$ or $\ket{+_{\theta}}$. If we now write the state of the system upon the completion of this last step we have

[TABLE]

where

[TABLE]

and $\zeta^{\psi}_{SB}(b)$, $\eta^{\psi}_{SB}(\theta)$ are states on the joint system of the simulator and Bob, given by:

[TABLE]

[TABLE]

The boldface letters highlight the state that was planted in Bob’s system. Now notice that if we trace out the simulator’s system from both of these states we get:

[TABLE]

[TABLE]

Tracing out the simulator from $\tilde{\rho}_{ASB}$ and plugging in the above expressions we obtain

[TABLE]

Finally, if we trace out the simulator from $\tilde{\sigma}_{ASB}^{\psi}$ and use the above state, we have:

[TABLE]

From the triangle inequality $\rho_{AB}^{\psi}\,\simeq_{2\varepsilon_{2}}\,\tilde{\rho}_{AB}^{\psi}$, and therefore we have that:

[TABLE]

concluding the proof. ∎

5 Blind and verifiable computation from remote state preparation

In [DK16] the authors show that a measurement-based protocol for blind delegation of quantum circuits, the Universal Blind Quantum Computing protocol of Broadbent et al. [BFK09] (BFK) can be constructed from the ideal functionality $\textsc{RSP}_{B}$ and classical communication channels. Their result builds upon the work of Dunjko et al. [DFPR14], who showed composable security of the BFK protocol in the AC framework. Dunjko et al. also showed composable security of a blind and verifiable variant of the BFK protocol introduced by Fitzsimons and Kashefi [FK17] (FK). Both protocols are designed to delegate a computation that is expressed in the model of measurement-based quantum computing (MBQC). In this model, a quantum computation is implemented by preparing a graph state (a collection of qubits that are entangled according to the structure of a graph) and then performing adaptive measurements on the qubits in the graph state. The main difference between the FK protocol and the BFK protocol is the use of traps to ensure verifiability in FK. Informally, trap qubits are qubits initialized in a $\ket{+_{\theta}}$ state, with $\theta$ chosen uniformly at random from $\Theta$, and such that all neighbors of the trap qubit in the underlying graph state are initialized in a random computational basis state; these are called dummy qubits. The role of the dummy qubits is to isolate the trap qubits from the computation, so that the prover’s measurements on the trap qubits can be verified independently of the computation. This isolation happens because, in the specific implementation of MBQC used by the FK and BFK protocols, the graph state is prepared by entangling $\ket{+_{\theta}}$ states using the Controlled-$Z$ operation. But note that this operation does not create entanglement if either of its input qubits is a state in the computational basis. We sketch the structure of the FK protocol in Figure 6, at a level that is sufficient to follow the arguments in this section; we refer to the description of Protocol 7 and Protocol 8 in [FK17] for full details.

Our goal in this section is to show that by replacing the quantum communication channel used by Alice to send single qubits to Bob in the FK protocol with BRSP we obtain a protocol that implements the ideal $\mathcal{S}_{verif}^{blind}$ resource for blind and verifiable delegated computation. Importantly, the resulting protocol involves only classical communication and is composable. We proceed in a number of incremental steps.

Note first that the set of single-qubit states prepared by the verifier in the FK protocol, $\ket{+_{\theta}}$ for $\theta\in\Theta$ and $\ket{0},\ket{1}$, is precisely the set of states that can be generated using the BRSP resource. We therefore define two variants of the FK protocol which we call $\textsc{RSP}_{V}$-FK and RSP-FK. The former is identical to the FK protocol, except Alice uses the ideal resource $\textsc{RSP}_{V}$ in order to prepare the states she is supposed to send to Bob in FK. RSP-FK is the same, except Alice uses the BRSP protocol to perform this preparation.

From the description of the FK protocol given in Figure 6, it is clear that the number of times Alice uses the ideal $\textsc{RSP}_{V}$ functionality or the BRSP protocol respectively is equal to the number of qubits she sends to the prover. As was shown in [KW17], there exist graph states such that this number is linear in the size of the quantum circuit she wishes to delegate. Given this, we can show the following:

Lemma 5.1**.**

Let $\delta_{BRSP}>0$ be the error tolerance parameter of the BRSP protocol used by Alice in RSP-FK, $\delta_{FK}>0$ be the error (soundness) of FK, $T>0$ the size of the computation Alice wishes to delegate to Bob191919Alternatively, we can say that $T$ is the size of Alice’s input and assume that she always delegates a universal circuit. and $\lambda>0$ the security parameter used in BRSP. Then, RSP-FK constructs $\textsc{RSP}_{V}$-FK, computationally, within distance $2\delta_{FK}+O(T\varepsilon)$, where $\varepsilon=O(\delta_{BRSP}^{c})+\operatorname{negl}(\lambda)$, for some constant $c>0$.

Proof.

From Theorem 4.2 we know that if $\delta_{BRSP}$ is the error of BRSP, then BRSP implements $\textsc{RSP}_{V}$ to within computational distance $\varepsilon$. We also know that $\textsc{RSP}_{V}$-FK involves $O(T\,\log(1/\delta_{FK}))$ uses of the $\textsc{RSP}_{V}$ functionality, since to achieve error $\delta_{FK}$ the FK protocol uses $O(T\,\log(1/\delta_{FK}))$ qubits [KW17]). In RSP-FK these are replaced with calls to BRSP. The compositionality theorem of AC (see [MR11, DFPR14]) implies that each replacement comes at an additive cost of $\varepsilon$. In other words, up to an error $O(T\;\log(1/\delta_{FK})\varepsilon)$, RSP-FK behaves exactly the same as $\textsc{RSP}_{V}$-FK. The fact that $\textsc{RSP}_{V}$-FK has error $\delta_{FK}$ means that (conditioned on acceptance) it arrives at the correct result, except with error $\delta_{FK}$. The same will be true of RSP-FK, with the added error of $O(T\,\log(1/\delta_{FK})\varepsilon)$ stemming from the use of BRSP. A triangle inequality leads us to conclude that RSP-FK implements $\textsc{RSP}_{V}$-FK within distance $2\delta_{FK}+O(T\,\log(1/\delta_{FK})\varepsilon)$. ∎

As a point of clarification, $\delta_{FK}$ represents the maximum deviations from the correct outcomes of the respective protocols, conditioned on Alice accepting. Also note that Alice can make the $O(T\;\log(1/\delta_{FK})\varepsilon)$ term be of order $\delta_{FK}$ by taking $\delta_{BRSP}=(\delta_{FK}/(T\,\log(1/\delta_{FK})))^{1/c}$.

We now show the following:

Lemma 5.2**.**

Let $\delta_{FK}>0$ be the error of FK. $\textsc{RSP}_{V}$-FK implements FK within distance $2\delta_{FK}$.

Proof.

We denote the two protocols as $\pi^{\textsc{RSP}_{V}-FK}=(\pi_{A}^{\textsc{RSP}_{V}-FK},\pi_{B}^{\textsc{RSP}_{V}-FK})$ and $\pi^{FK}=(\pi_{A}^{FK},\pi_{B}^{FK})$ respectively. Additionally, let $\mathcal{R}^{cq}$ denote a resource consisting of classical and quantum channels. We will show that

[TABLE]

for some simulator $\sigma_{B}$.

Correctness is immediate: if Alice and Bob behave honestly in both $\textsc{RSP}_{V}$-FK and in FK the results are statistically indistinguishable.

For security note the following. In $\textsc{RSP}_{V}$-FK, for each use of $\textsc{RSP}_{V}$  Alice chooses the preparation bases for the $\ket{+_{\theta}}$ states at random, and for the dummies she consistently chooses the $Z$ basis. The only difference between this and the actual FK protocol is that because she is using the $\textsc{RSP}_{V}$ functionality, Bob can force Alice to abort in the preparation stage by triggering the $ERR$ flag. To show that $\textsc{RSP}_{V}$-FK implements FK, we need to show that the simulator, $\sigma_{B}$, interacting with $\pi_{A}^{FK}\mathcal{R}^{cq}$, can make its interaction with Bob indistinguishable from that of $\pi_{A}^{\textsc{RSP}_{V}-FK}\mathcal{R}^{cq}$. First of all, to match $\textsc{RSP}_{V}$-FK in terms of inputs and outputs it must be that for each qubit to be prepared the simulator receives the $c$ bit from Bob indicating whether he wants to cause the current preparation to abort, as per the specification of $\textsc{RSP}_{V}$ (see Figure 1).

Consider a simulator that works as follows. The simulator first collects all the qubits sent by Alice through $\mathcal{R}^{cq}$. Then, for each qubit that it is supposed to send to Bob, it first receives the bit $c$ corresponding to that qubit. If $c=0$, indicating to not abort, the simulator sends that qubit to Bob. Otherwise, it sends the $ERR$ flag to Bob and also causes Alice to abort202020The simulator can cause Alice to abort by providing random responses to the measurement outcomes she expects from Bob. The probability that these responses will match all of Alice’s expected outcomes on the trap states is exponentially small. In other words, Alice will abort with probability $1-\exp(-O(T))$. This will mean that $\textsc{RSP}_{V}$-FK implements FK within distance $2\delta_{FK}+\exp(-O(T))$ but since we will always consider $\delta_{FK}=\Omega(\exp(-T))$, we omit this inverse exponential term.. If the simulator sends all of the qubits to Bob (i.e. there was no abort in the preparation stage) it then acts as a classical channel between Alice and Bob, forwarding the messages Alice sends (step 4.(a)) to Bob and then forwarding his responses to Alice (step 4.(b)).

From the soundness of FK it follows that at the end of either $\pi_{A}^{\textsc{RSP}_{V}-FK}\mathcal{R}^{cq}$ or $\pi_{A}^{FK}\mathcal{R}^{cq}\sigma_{B}$ the state of the system (conditioned on acceptance) is $\delta_{FK}$-close to the correct output. Applying the triangle inequality, the output states in the two situations are $2\delta_{FK}$-close to each other. This concludes the proof.∎

Note that the result of Lemma 5.2 holds within statistical distance. Of course, the result is also true when restricting to the computationally efficient setting, since the simulator is efficient (it simply needs to store states and forward messages received from Alice and Bob).

Finally, we use the following result from [DFPR13]:

Lemma 5.3** (Lemma C.1 in [DFPR13]).**

If the FK protocol is run with parameters such that it has error $\delta_{FK}$, then it is $4\sqrt{2}\delta_{FK}^{1/4}N^{2}$-blind-verifiable, where $N$ is the dimension of the subsystem of Alice’s input which is quantum.

For convenience we restrict our attention to classical inputs for Alice. In this case it follows that FK (with classical input) with soundness parameter $\delta_{FK}$ implements the ideal $\mathcal{S}_{verif}^{blind}$ resource within distance $O(\delta_{FK}^{1/4})$. With this fact, we can show the main result of this section.

Theorem 5.4**.**

The RSP-FK protocol with error $\delta_{FK}>0$ and security parameter $\lambda>0$ implements the ideal $\mathcal{S}_{verif}^{blind}$ resource within distance $O(\delta_{FK}^{1/4})+\operatorname{negl}(\lambda)$.

Proof.

From Lemmas 5.1 and 5.2 we see that RSP-FK with error $\delta_{FK}$ and security parameter $\lambda>0$ implements FK with error $O(\delta_{FK})+\operatorname{negl}(\lambda)$. Combining this with Lemma 5.3 leads us to conclude that RSP-FK implements the $\mathcal{S}_{verif}^{blind}$ resource within distance $O(\delta_{FK}^{1/4})+\operatorname{negl}(\lambda)$. ∎

The result of Theorem 5.4 states that using BRSP together with the FK protocol yields a protocol that is computationally indistinguishable from the ideal blind-verifiability functionality. If we take the distinguishing advantage to be $\delta>0$, what will be the total complexity (in terms of total of number of operations performed by the verifier) of RSP-FK for a computation of size $T$? From Theorem 5.4 it follows that in order to implement $\mathcal{S}_{verif}^{blind}$ to within distance $\delta$ we need to perform RSP-FK with soundness error $\delta^{4}$. Implementing the FK protocol so that it achieves soundness error $\delta^{4}$ requires $O(T\,\log(1/\delta^{4}))$ operations, where $T$ is the size of the computation. The change from $\delta$ to $\delta^{4}$ only increases the overhead by a constant factor, so that overall the prover requires $O(T\,\log(1/\delta))$ operations to implement FK. In our case, however, for each state sent by the verifier to the prover, the verifier executes BRSP. Thus the overhead is $O(C_{BRSP}\,T\,\log(1/\delta))$, where $C_{BRSP}$ is the cost of running one instance of BRSP. If we wish to achieve soundness error $\delta^{4}$ in RSP-FK, BRSP needs to have error at most $(\delta^{4}/(T\,\log(1/\delta)))^{1/c}$. The specific constant $c$ can be determined from the proof of Theorem 3.17 to be $c=1/3$. Thus we can estimate the cost of BRSP as $C_{BRSP}=(T^{3}/\delta^{12})\log^{3}(1/\delta)\operatorname{poly}(\lambda)$, where $\lambda$ is the security parameter. This gives a total cost of $O((T^{4}/\delta^{12})\,\log^{4}(1/\delta)\,\operatorname{poly}(\lambda))$. Note that this is the cost of implementing the ideal blind-verifiable resource. If we merely wish to implement FK itself, the cost would be $O((T^{4}/\delta^{3})\,\log^{4}(1/\delta)\,\operatorname{poly}(\lambda))$, since we would not incur the $1/\delta\rightarrow 1/\delta^{4}$ increase stemming from Lemma 5.3.

Appendix A Claw-free functions with adaptive hardcore

Our construction relies on a variant of a cryptographic primitive called a “noisy trapdoor claw-free family (NTCF),” introduced in [BCM*+*18b], and its extension to an “extended noisy trapdoor claw-free family (ENTCF),” given in [Mah18b]. We rely on definitions and notation from [BCM*+*18a, Section 3] and [Mah18c, Section 4].

A key property of an NTCF is the adaptive hardcore bit property, property 4. in [BCM*+*18a, Definition 3.1]. We need a slightly stronger variant of the property, that works over $\mathbb{Z}_{8}$ instead of $\mathbb{Z}_{2}$. The property we need is formulated in the following definition.

Definition A.1**.**

Let $\lambda$ be a security parameter. Let $\mathcal{X}$ and $\mathcal{Y}$ be finite sets. Let $\mathcal{K}_{\mathcal{F}}$ be a finite set of keys. A NTCF family

[TABLE]

is said to have adaptive $\mathbb{Z}_{8}$ hardcore if it satisfies the following conditions, for some integer $w$ that is a polynomially bounded function of $\lambda$.

For all $b\in\{0,1\}$ and $x\in\mathcal{X}$, there exists a set $G_{k,b,x}\subseteq\mathbb{Z}_{8}$ such that $\Pr_{d\leftarrow_{U}\mathbb{Z}_{8}^{w}}[d\notin G_{k,b,x}]$ is negligible, and moreover there exists an efficient algorithm that checks for membership in $G_{k,b,x}$ given $k,b,x$ and the trapdoor $t_{k}$. 2. 2.

There is an efficiently computable injection $J:\mathcal{X}\to\mathbb{Z}_{8}^{w}$, such that $J$ can be inverted efficiently on its range, and such that the following holds. For any $y\in\mathcal{Y}$, define functions $\hat{\theta}:\mathbb{Z}_{8}^{w}\to\{0,1,2,3\}$ and $\hat{v}:\mathbb{Z}_{8}^{w}\to\{0,1\}$ as the unique values such that $d\cdot(J(x_{0})+J(x_{1}))\bmod 8=\hat{\theta}(d)+4\hat{v}(d)$, where for $b\in\{0,1\}$, $x_{b}=\textsc{Inv}_{\mathcal{F}}(t_{k},b,y)$, if $d\in G_{k,0,x_{0}}\cap G_{k,1,x_{1}}$,212121The sets $G_{k,b,x}$ are defined in (40). and $\hat{\theta}(d)=\hat{v}(d)=\bot$ otherwise. Then if

[TABLE]

then for any quantum polynomial-time procedure $\mathcal{A}$ there exists a negligible function $\mu(\cdot)$ such that

[TABLE]

Similarly, if for $w\in\{0,1,2,3\}$,

[TABLE]

then for any quantum polynomial-time procedure $\mathcal{A}^{\prime}$ there exists a negligible function $\mu(\cdot)$ such that for all $w\in\{1,2,3\}$,

[TABLE]

A.1 The adaptive hardcore property

It is straightforward to verify that the same construction of an NTCF introduced in [BCM*+*18a] has adaptive $\mathbb{Z}_{8}$ hardcore.

Lemma A.2**.**

The NTCF family introduced in [BCM*+*18a] has adaptive $\mathbb{Z}_{8}$ hardcore, i.e. it satisfies item 2. in Definition A.1.

The proof of Lemma A.2 is very similar to the adaptive hardcore bit condition shown in [BCM*+*18a, Lemma 4.7], with some modifications to obtain a hardness statement $\bmod 8$ instead of $\bmod 2$. We indicate the main changes needed, referring directly to statements from [BCM*+*18a, Section 4.4].

The main step of the proof consists in showing the following Lemma, a direct analogue of [BCM*+*18a, Lemma 4.2]. The main difference is the requirement on $\hat{d}$. For a string $x\in\{0,1\}^{n}$ we write $|x|_{H}$ for the Hamming weight of $x$.

Lemma A.3**.**

Let $q$ be a prime, $\ell,n\geq 1$ integers, and $\mathbf{C}\in\mathbb{Z}_{q}^{\ell\times n}$ a uniformly random matrix. With probability at least $1-q^{\ell}\cdot 2^{-\frac{n}{8}}$ over the choice of $\mathbf{C}$ the following holds. For a fixed $\mathbf{C}$, all $\mathbf{v}\in\mathbb{Z}_{q}^{\ell}$ and $\hat{d}\in\{0,1\}^{n}$ such that $|\hat{d}|_{H}\geq\frac{n}{8}$, the distribution of $(\hat{d}\cdot s\bmod 8)$, where $s$ is uniform in $\{0,1\}^{n}$ conditioned on $\mathbf{C}\mathbf{s}=\mathbf{v}$, is within statistical distance $O(q^{\frac{3\ell}{2}}\cdot 2^{-\frac{n}{80}})$ of the uniform distribution over $\{0,1\}$.

The first change in the proof of [BCM*+*18a, Lemma 4.2] required to obtain Lemma A.3 is to the definition of a moderate matrix:

Definition A.4**.**

Let $\mathbf{b}\in\mathbb{Z}_{q}^{n}$. We say that $\mathbf{b}$ is moderate if it contains at least $\frac{n}{4}$ entries whose unique representative in $(-q/2,q/2]$ has its absolute value in the range $(\frac{q}{32},\frac{3q}{32}]$. A matrix $\mathbf{C}\in\mathbb{Z}_{q}^{\ell\times n}$ is moderate if its entire row span (except $0^{n}$) is moderate.

Lemma A.5**.**

Let $q$ be prime and $\ell,n$ be integers. Then

[TABLE]

Proof.

The proof is identical to [BCM*+*18a, Lemma 4.5], except for replacing $q/8$ with $q/32$. ∎

Lemma A.6**.**

Let $\mathbf{C}\in\mathbb{Z}_{q}^{\ell\times n}$ be an arbitrary moderate matrix and let $\hat{d}\in\{0,1\}^{n}$ be such that $|\hat{d}|\geq\frac{n}{8}$. Let $s$ be uniform over $\{0,1\}^{n}$ and consider the random variables $\mathbf{v}=\mathbf{C}\mathbf{s}\bmod q$ and $z=\hat{d}\cdot s\bmod 2$. Then $(\mathbf{v},z)$ is within total variation distance at most $2q^{\frac{\ell}{2}}\cdot 2^{-\frac{n}{80}}$ of the uniform distribution over $\mathbb{Z}_{q}^{\ell}\times\{0,1\}$.

The proof of the lemma is similar to the proof of [BCM*+*18a, Lemma 4.5], with a small difference due to the $\bmod 8$ condition. This is where the additional requirement that $|\hat{d}|\geq\frac{n}{10}$ (as opposed to simply $\hat{d}\neq 0$ in [BCM*+*18a]) is used.

Proof.

Let $f$ be the probability density function of $(\mathbf{v},z)$. Interpreting $z$ as an element of $\mathbb{Z}_{8}$, let $\hat{f}$ be the Fourier transform over $\mathbb{Z}_{q}^{\ell}\times\mathbb{Z}_{8}$. Let $U$ denote the density of the uniform distribution over $\mathbb{Z}_{q}^{\ell}\times\mathbb{Z}_{8}$. Applying the Cauchy-Schwarz inequality,

[TABLE]

where the second line follows from Parseval’s identity, and for the third line we used $\hat{f}(\mathbf{0},0)=\hat{U}(0,0)=1$ and $\hat{U}(\hat{\mathbf{v}},\hat{z})=0$ for all $(\hat{\mathbf{v}},\hat{z})\neq(0^{\ell},0)$. To bound (36) we estimate the Fourier coefficients of $f$. Denoting $\omega_{8q}=e^{-\frac{2\pi i}{8q}}$, for any $(\hat{\mathbf{v}},\hat{z})\in\mathbb{Z}_{q}^{\ell}\times\mathbb{Z}_{2}$ we can write

[TABLE]

where we wrote $\mathbf{w}^{T}=8\cdot{\hat{\mathbf{v}}}^{T}\mathbf{C}+q\cdot{\hat{z}}\hat{\mathbf{d}}^{T}\in\mathbb{Z}_{8q}^{n}$.

We first bound $\hat{f}(0^{\ell},\hat{z})$ for $\hat{z}\in\mathbb{Z}_{8}\backslash\{0\}$. In this case (37) simplifies to

[TABLE]

Next we observe that for all $i\in\{1,\ldots,n\}$ such that the representative of $({\hat{\mathbf{v}}}^{T}\mathbf{C})_{i}$ in $(-q/2,q/2]$ has its absolute value in $(\frac{q}{32},\frac{3q}{32}]$ it holds that $\frac{w_{i}}{q}\in(\frac{1}{4},\frac{3}{4}]\bmod 1$, in which case

[TABLE]

Since $\mathbf{C}$ is moderate, there are at least $\frac{n}{4}$ such entries, so that from (37) it follows that $|\hat{f}({\hat{\mathbf{v}}},{\hat{z}})|\leq 2^{-\frac{n}{40}}$ for all $\hat{\mathbf{v}}\neq\mathbf{0}$. Recalling (36) and (38), the lemma is proved. ∎

The proof of Lemma A.3 follows from Lemma A.6 exactly as in [BCM*+*18a], and we omit the details. With Lemma A.3 in hand, the proof of the adaptive $\mathbb{Z}_{8}$ condition, item 2. in Definition A.1, is very similar to the proof of the adaptive hardcore bit condition in [BCM*+*18a]. The main change needed is in the definition of the sets $G_{k,b,x}$, for $k=(\mathbf{A},\mathbf{A}\mathbf{s}+\mathbf{e}),b\in\{0,1\}$ and $x\in\mathcal{X}$, that is defined as follows:

[TABLE]

where $I_{b,x}(d)$ is the vector whose each coordinate is obtained by taking the inner product mod $2$ of the corresponding block of $\lceil\log q\rceil$ coordinates of $d$ and of $J(x)\oplus J(x-(-1)^{b}\mathbf{1})$, where $J:\mathcal{X}\to\{0,1\}^{w}$ is such that $J(x)$ returns the binary representation of $x\in\mathcal{X}$ and $\mathbf{1}\in\mathbb{Z}_{q}^{n}$ is the vector with all its coordinates equal to $1\in\mathbb{Z}_{q}$.

A.2 The collapsing property

The following lemma shows that any ENTCF has the collapsing property, introduced by Unruh [Unr16].

Lemma A.7**.**

Let $(\mathcal{F},\mathcal{G})$ be an ENTCF family. Let $\phi=\sum_{y\in\mathcal{Y}}\ket{y}\!\bra{y}\otimes\phi_{y}$ be a state that can be prepared efficiently, given as input a key $k\in\mathcal{K}_{\mathcal{F}}\cup\mathcal{K}_{\mathcal{G}}$. Let $\Pi=\{\Pi^{(b,x_{b})}\}$ be an efficiently implementable POVM such that $\mbox{\rm Tr}(\Pi^{(b,x_{b})}\phi_{y})=0$ if $f_{k,b}(x_{b})\neq y$ (if $k\in\mathcal{K}_{\mathcal{F}})$ or $g_{k,b}(x_{b})\neq y$ (if $k\in\mathcal{K}_{\mathcal{G}}$). Then there is no efficient procedure such that, given $k\leftarrow\textrm{GEN}_{\mathcal{F}}(1^{\lambda})$ and $y$ distributed according to $\mbox{\rm Tr}(\phi_{y})$, the procedure has a non-negligible advantage in distinguishing $\phi_{y}$ from $\phi^{\prime}_{y}=\Pi^{(0,x_{0})}\phi_{y}\Pi^{(0,x_{0})}+\Pi^{(1,x_{1})}\phi_{y}\Pi^{(1,x_{1})}$, where for $b\in\{0,1\}$, $x_{b}$ is such that $f_{k,b}(x_{b})=y$.

Proof.

Suppose for contradiction that there exists such a procedure. Since the procedure is efficient, using the property of injective invariance of an ENTCF (Definition 4.2 in [Mah18c]) it should produce computationally indistinguishable outcomes given $k\leftarrow\textrm{GEN}_{\mathcal{F}}(1^{\lambda})$ or $k\leftarrow\textrm{GEN}_{\mathcal{G}}(1^{\lambda})$. In the second case, $\phi^{\prime}_{y}=\phi_{y}$, so that no such procedure exists. ∎