Oracle Separations Between Quantum and Non-interactive Zero-Knowledge Classes

TL;DR

This paper extends previous oracle separation results to non-interactive zero-knowledge proofs with perfect security, demonstrating that quantum algorithms cannot efficiently simulate this class even with oracle access.

Contribution

It provides the first oracle separation between BQP and the most restrictive zero-knowledge class, NIPZK, for non-interactive proofs with perfect security.

Findings

Oracle A exists such that NIPZK^A is not contained in BQP^A.

Extends Aaronson's separation to non-interactive zero-knowledge with perfect security.

Shows quantum algorithms cannot efficiently simulate NIPZK proofs.

Abstract

We study the relationship between problems solvable by quantum algorithms in polynomial time and those for which zero-knowledge proofs exist. In prior work, Aaronson [arxiv:quant-ph/0111102] showed an oracle separation between BQP and SZK, i.e. an oracle $A$ such that $\mathrm{SZK}^A \not\subseteq \mathrm{BQP}^A$. In this paper we give a simple extension of Aaronson's result to non-interactive zero-knowledge proofs with perfect security. This class, NIPZK, is the most restrictive zero-knowledge class. We show that even for this class we can construct an $A$ with $\mathrm{NIPZK}^A \not\subseteq \mathrm{BQP}^A$.

Full text

1 Introduction

We investigate the relationship between quantum-computable problems and those with zero-knowledge proofs. We are motivated by the general desire of complexity theory to understand all relationships between complexity classes, as well as implications this particular relationship has for quantum-resilient cryptography. Specifically we consider the class BQP, those languages decidable by a quantum computer in polynomial time with bounded error. (See [8] for a more thorough discussion.)

Zero-knowledge is really a family of complexity classes. In a zero-knowledge proof for language $L$, the prover $P$ must convince a verifier $V$ that $x\in L$. The zero-knowledge property requires that the verifier cannot learn anything other than the statement being proved. (For example, $P$ cannot send a witness for $x$.) This is formalized by requiring that a simulator without access to $P$ can produce a transcript $T^{\prime}$ that is indistinguishable from a transcript $T$ of a real interaction. If $T^{\prime}$ is required to be distributed identically to $T$, then the resulting complexity class is perfect zero-knowledge (PZK). If it is required only to be statistically close, we get statistical zero-knowledge (SZK). If it is only required to be computationally indistinguishable, we get computational zero-knowedge (CZK). (See [3] for a more thorough discussion.)

We can further restrict the three classes above by requiring that the protocols be non-interactive. That is, we require that the whole interaction between $P$ and $V$ consist of a single message sent from $P$ to $V$. To make this possible, we must give the parties access to a common random string. We therefore have three non-interactive classes, analogous to those above (NICZK, NISZK, and NIPZK).

There are no unconditional results proving anything about the relationship between BQP and any of the six zero-knowledge classes discussed above. However, Aaronson [1] gave an oracle separation, an oracle $A$ under which $\mathrm{SZK}^{A}\not\subseteq\mathrm{BQP}^{A}$. This is evidence that there are problems with zero-knowledge proofs but no quantum algorithms, and it rules out many proof techniques for proving otherwise. In this paper we give a simple extension of this result, showing an oracle separation between BQP and NIPZK. NIPZK is the most restrictive of the zero-knowledge classes, so when we show an $A$ such that $\mathrm{NIPZK}^{A}\not\subseteq\mathrm{BQP}^{A}$ we implicitly show the same for PZK, NICZK, and NISZK.

Implications for cryptography

In recent years a variety of cryptographic protocols have been built using non-interactive zero-knowledge proofs. For example, Miller et al. use them to create a cryptocurrency that can be generated and spent anonymously [9]. Haralambiev uses them to create leakage-resilient signatures, signatures that remain secure even when some of the secret key is disclosed [4]. Juels et al. show they can be used in a less desirable way, allowing crowdfunding to be used to reward hackers for disclosing the secret information of their victims [5].

The cryptographic community has also recently spent considerable effort finding protocols that will remain secure in the face of adversaries with quantum computers. If the non-interactive zero-knowledge classes were contained in BQP, it would imply that cryptographic protocols using such proofs could not be made resilient to such quantum adversaries.

2 Oracle Separation Between SZK and BQP

Aaronson [1] proved the following result:

Theorem 2.1**.**

There exists an oracle A such that $\mathrm{SZK}^{A}\not\subseteq\mathrm{BQP}^{A}$.

Our own proofs follow a similar structure and rely on some of Aaronson’s lemmas, so we begin by recalling a few key details of his proof. He begins with a lower bound for the quantum query complexity of the Collision Problem. The problem is defined as follows.

Definition 2.1** (Collision Problem).**

Let $n$ be an integer and $X~{}:~{}\{1,...,n\}~{}\rightarrow~{}\{1,...,n\}$, represented in the standard way as a list of outputs. Suppose either $X$ is one-to-one (that is, each element of $\{1,...,n\}$ is output for exactly one input) or $X$ is r-to-one111It is sufficient for our result to restrict the problem to the $r=2$ case. for a fixed $r\geq 2$ (that is, each element of $\{1,...,n\}$ is output for exactly r inputs or not at all.) Then given the ability to query $X$, the Collision Problem $\mathrm{Col}^{r}_{n}$ is to accept if $X$ is one-to-one and reject if $X$ is $r$-to-one.

Aaronson then shows the following result, which we present without proof. $Q_{2}(\cdot)$ represents the (bounded error) quantum query complexity of the problem, defined as the number of bits of the input that the algorithm must examine.

Lemma 2.2**.**

$Q_{2}\left(\mathrm{Col}_{n}^{2}\right)=\Omega\left(n^{1/5}\right)$.

Kutin [6] proves a stronger version of the collision lower bound, $\Omega\left((n/r)^{1/3}\right)$, that also applies when $r\neq 2$. (This result is also a strengthening of the result of Shi [10], which gives the same bound but requires a larger output set for the function.) From either result, a diagonalization can be performed to produce the desired oracle separation.

3 Oracle Separation Between NIPZK and BQP

We now prove the following new result:

Theorem 3.1**.**

There exists an oracle $A$ such that $\mathrm{NIPZK}^{A}\not\subseteq\mathrm{BQP}^{A}$.

It suffices to demonstrate a NIPZK algorithm for $\mathrm{Col}^{2}_{n}$. The algorithm, inspired by the algorithm for uniformity testing given by Malka [7], proceeds as follows. The prover divides the shared random string into two strings $r_{1}$ and $r_{2}$, each of length $n$. For each $r_{i}$, it chooses uniformly a string $x_{i}$ with $X(x_{i})=r_{i}$. It then sends the chosen $x_{i}$ to the verifier. The verifier accepts if $X(x_{i})=r_{i}$ for both $i$.

We now prove the algorithm is NIPZK. First, we prove its completeness. If $X$ is one-to-one, then its image equals its codomain, and so the $x_{i}$ can always be selected to be valid, regardless of the $r_{i}$. Thus the verifier will always accept any one-to-one function.

Next, we prove its soundness. If $X$ is two-to-one, then half of its codomain is not in its image. Thus, with probability $\frac{3}{4}$, at least one of $r_{1}$ or $r_{2}$ is not in the image of $X$. Thus, with probability $\frac{3}{4}$, the prover cannot select $x_{i}$ that the verifier will accept. Thus the soundness error is $\frac{1}{4}$.

Next, we prove its perfect zero-knowledge property. The simulator can simply randomly pick two inputs $x_{1}$ and $x_{2}$, then run them through $X$ to get appropriate $r_{i}$. Since the $x_{i}$ are selected uniformly, when $X$ is one-to-one the $r_{i}$ are also uniformly distributed. Furthermore, for those $r_{i}$, there is only one possible pair of $x_{i}$; thus the simulator can exactly recreate the distribution over inputs to the verifier. From there, it can simply perfectly simulate any verifier on those inputs.

Thus $\mathrm{Col}^{2}_{n}\in$ NIPZK, and the theorem follows as above.

4 Conclusion

We constructed a NIPZK query algorithm for the collision problem. Using this algorithm and the quantum query lower bound on the collision problem we have demonstrated the existence of an oracle relative to which NIPZK $\not\subseteq$ BQP. This result has applications to the quantum-resistance of cryptography and cryptocurrency, where algorithms occasionally rely on non-interactive zero-knowledge proof protocols. Our result suggests that the use of those proofs does not introduce vulnerabilities into those algorithms in the presence of a quantum adversary. The next step would be to extend this oracle separation into an algebraic oracle separation [2], which would rule out a wider array of proof techniques and give additional evidence that NIPZK $\not\subseteq$ BQP.