A New World in the Depths of Microcrypt: Separating OWSGs and Quantum Money from QEFID

TL;DR

This paper demonstrates, through a quantum oracle, that EFI pairs can exist without OWSGs, providing a separation that clarifies the minimal assumptions needed for certain quantum cryptographic primitives.

Contribution

It establishes a quantum oracle separation between EFI pairs and OWSGs, showing that EFI pairs do not necessarily imply OWSGs, and clarifies the landscape of minimal assumptions in quantum cryptography.

Findings

EFI pairs can exist without OWSGs in a quantum oracle

Separates QEFID and one-way puzzles from OWSGs using oracle techniques

Establishes a black-box separation between quantum money schemes and QEFID

Abstract

While in classical cryptography, one-way functions (OWFs) are widely regarded as the "minimal assumption," the situation in quantum cryptography is less clear. Recent works have put forward two concurrent candidates for the minimal assumption in quantum cryptography: One-way state generators (OWSGs), postulating the existence of a hard search problem with an efficient verification algorithm, and EFI pairs, postulating the existence of a hard distinguishing problem. Two recent papers [Khurana and Tomer STOC'24; Batra and Jain FOCS'24] showed that OWSGs imply EFI pairs, but the reverse direction remained open. In this work, we give strong evidence that the opposite direction does not hold: We show that there is a quantum unitary oracle relative to which EFI pairs exist, but OWSGs do not. In fact, we show a slightly stronger statement that holds also for EFI pairs that output classical bits (QEFID). As a consequence, we separate, via our oracle, QEFID, and one-way puzzles from OWSGs and several other Microcrypt primitives, including efficiently verifiable one-way puzzles and unclonable state generators. In particular, this solves a problem left open in [Chung, Goldin, and Gray Crypto'24]. Using similar techniques, we also establish a fully black-box separation (which is slightly weaker than an oracle separation) between private-key quantum money schemes and QEFID pairs. One conceptual implication of our work is that the existence of an efficient verification algorithm may lead to qualitatively stronger primitives in quantum cryptography.