Classical Verification of Quantum Computations with Efficient Verifier

TL;DR

This paper advances classical verification of quantum computations by developing efficient, multi-round protocols with negligible soundness error, applicable in various cryptographic models, and enabling practical quantum computation verification.

Contribution

It introduces the first constant-round CVQC protocol with negligible soundness error and constructs efficient two-round protocols in the QROM and CRS+QRO models.

Findings

Parallel repetition reduces soundness error significantly.

Two-round protocols achieve efficient verification in the QROM and CRS+QRO models.

Assumptions include quantum hardness of LWE and post-quantum cryptographic primitives.

Abstract

In this paper, we extend the protocol of classical verification of quantum computations (CVQC) recently proposed by Mahadev to make the verification efficient. Our result is obtained in the following three steps: $\bullet$ We show that parallel repetition of Mahadev's protocol has negligible soundness error. This gives the first constant round CVQC protocol with negligible soundness error. In this part, we only assume the quantum hardness of the learning with error (LWE) problem similar to the Mahadev's work. $\bullet$ We construct a two-round CVQC protocol in the quantum random oracle model (QROM) where a cryptographic hash function is idealized to be a random function. This is obtained by applying the Fiat-Shamir transform to the parallel repetition version of the Mahadev's protocol. $\bullet$ We construct a two-round CVQC protocol with the efficient verifier in the CRS+QRO model where both prover and verifier can access to a (classical) common reference string generated by a trusted third party in addition to quantum access to QRO. Specifically, the verifier can verify a $QTIME(T)$ computation in time $poly(n,log T)$ where $n$ is the security parameter. For proving soundness, we assume that a standard model instantiation of our two-round protocol with a concrete hash function (say, SHA-3) is sound and the existence of post-quantum indistinguishability obfuscation and post-quantum fully homomorphic encryption in addition to the quantum hardness of the LWE problem.