Code-routing: a new attack on position verification

TL;DR

This paper introduces a new quantum attack on position verification schemes based on $f$-routing, exploiting secret-sharing encoding to efficiently compromise schemes for functions in the class $ ext{Mod}_p ext{L}$, surpassing previous methods.

Contribution

It presents a novel cheating strategy using secret-sharing encoding that attacks $f$-routing schemes for a broader class of functions than prior approaches.

Findings

The new attack completes $f$-routing with $O(SP_p(f))$ EPR pairs.

Efficient attack possible for functions in $ ext{Mod}_p ext{L}$ class.

Quantum secret sharing size bounds entanglement cost for $f$-routing.

Abstract

The cryptographic task of position verification attempts to verify one party's location in spacetime by exploiting constraints on quantum information and relativistic causality. A popular verification scheme known as $f$-routing involves requiring the prover to redirect a quantum system based on the value of a Boolean function $f$. Cheating strategies for the $f$-routing scheme require the prover use pre-shared entanglement, and security of the scheme rests on assumptions about how much entanglement a prover can manipulate. Here, we give a new cheating strategy in which the quantum system is encoded into a secret-sharing scheme, and the authorization structure of the secret-sharing scheme is exploited to direct the system appropriately. This strategy completes the $f$-routing task using $O(SP_p(f))$ EPR pairs, where $SP_p(f)$ is the minimal size of a span program over the field $\mathbb{Z}_p$ computing $f$. This shows we can efficiently attack $f$-routing schemes whenever $f$ is in the complexity class $\text{Mod}_p\text{L}$, after allowing for local pre-processing. The best earlier construction achieved the class L, which is believed to be strictly inside of $\text{Mod}_p\text{L}$. We also show that the size of a quantum secret sharing scheme with indicator function $f_I$ upper bounds entanglement cost of $f$-routing on the function $f_I$.