Quantum zero-knowledge from Locally Simulatable Proofs Alex - PowerPoint PPT Presentation

Quantum zero-knowledge from Locally Simulatable Proofs Alex Bredariol Grilo joint work with Anne Broadbent (U. of Ottawa) arxiv:1911.07782

Quantum found. QZK Crypto TCS 2 / 19

Interactive proofs 3 / 19

Interactive proofs L ∈ NP P V 0 / 1 for x ∈ L , ∃ P V accepts for x �∈ L , ∀ P V rejects 3 / 19

Interactive proofs L ∈ NP L ∈ IP P P ... V V 0 / 1 0 / 1 for x ∈ L , ∃ P for x ∈ L , ∃ P V accepts V accepts for x �∈ L , ∀ P for x �∈ L , ∀ P V rejects V rejects whp 3 / 19

Interactive proofs L ∈ NP L ∈ IP = PSPACE P P ... V V 0 / 1 0 / 1 for x ∈ L , ∃ P for x ∈ L , ∃ P V accepts V accepts for x �∈ L , ∀ P for x �∈ L , ∀ P V rejects V rejects whp 3 / 19

Zero-knowledge P ... V 0 / 1 4 / 19

Zero-knowledge P ... ˜ V 4 / 19

Zero-knowledge P ... ˜ V X 4 / 19

Zero-knowledge P ... S ˜ ˜ V V X 4 / 19

Zero-knowledge P ... S ˜ ˜ V V X Y 4 / 19

Zero-knowledge P ... S ˜ ˜ V V X Y Computational zero-knowledge X and Y cannot be efficiently distinguished: 4 / 19

Zero-knowledge P ... S ˜ ˜ V V X Y Computational zero-knowledge X and Y cannot be efficiently distinguished: ∀ poly-time A : | Pr x ∼ D X [ A ( x ) = 1] − Pr y ∼ D Y [ A ( y ) = 1] | ≤ negl ( n ) 4 / 19

Zero-knowledge P ... S ˜ ˜ V V X Y Computational zero-knowledge X and Y cannot be efficiently distinguished: ∀ poly-time A : | Pr x ∼ D X [ A ( x ) = 1] − Pr y ∼ D Y [ A ( y ) = 1] | ≤ negl ( n ) Fundamental notion in modern cryptography! 4 / 19

Example: ZK for 3-coloring V F G B A D E C 5 / 19

Example: ZK for 3-coloring P V F G B A D E C 5 / 19

Example: ZK for 3-coloring V 5 / 19

Example: ZK for 3-coloring V Completeness ✓ Soundness ✓ ZK ✗ 5 / 19

Example: ZK for 3-coloring P V F G B A D E C 6 / 19

Example: ZK for 3-coloring P V F G B A D E C 6 / 19

Example: ZK for 3-coloring P V F G B A D E C 6 / 19

Example: ZK for 3-coloring P V A → 564651 B → 867132 C → 984565 D → 894102 E → 069732 F → 873210 G → 897966 6 / 19

Example: ZK for 3-coloring P V A → 564651 B → 867132 C → 984565 D → 894102 E → 069732 F → 873210 G → 897966 6 / 19

Example: ZK for 3-coloring P V A → 564651 B → 867132 { A , C } C → 984565 D → 894102 E → 069732 F → 873210 G → 897966 6 / 19

Example: ZK for 3-coloring P V A → 564651 B → 867132 { A , C } C → 984565 D → 894102 E → 069732 F → 873210 564651 , 984565 G → 897966 6 / 19

Example: ZK for 3-coloring P V A → 564651 B → 867132 { A , C } C → 984565 D → 894102 E → 069732 F → 873210 564651 , 984565 G → 897966 6 / 19

Example: ZK for 3-coloring P V A → 564651 B → 867132 { A , C } C → 984565 D → 894102 E → 069732 F → 873210 564651 , 984565 G → 897966 bit-commitment 6 / 19

Example: ZK for 3-coloring P V A → 564651 B → 867132 { A , C } C → 984565 D → 894102 E → 069732 F → 873210 564651 , 984565 G → 897966 bit-commitment Completeness ✓ Soundness ✓ CZK ✓ 6 / 19

Quantum proofs 7 / 19

Quantum proofs L ∈ QMA L ∈ QIP P P ... V V 0 / 1 0 / 1 for x ∈ L , ∃ P for x ∈ L , ∃ P V accepts whp V accepts for x �∈ L , ∀ P for x �∈ L , ∀ P V rejects whp V rejects whp 7 / 19

Quantum proofs L ∈ QMA L ∈ QIP = PSPACE P P ... V V 0 / 1 0 / 1 for x ∈ L , ∃ P for x ∈ L , ∃ P V accepts whp V accepts for x �∈ L , ∀ P for x �∈ L , ∀ P V rejects whp V rejects whp 7 / 19

Quantum Zero-knowledge P ... V 0 / 1 8 / 19

Quantum Zero-knowledge P ... ˜ V 8 / 19

Quantum Zero-knowledge P ... ˜ V ρ 8 / 19

Quantum Zero-knowledge P ... ˜ S ˜ V V ρ 8 / 19

Quantum Zero-knowledge P ... ˜ S ˜ V V ρ σ 8 / 19

Quantum Zero-knowledge P ... ˜ S ˜ V V ρ σ Quantum computational zero-knowledge ρ and σ cannot be efficiently distinguished: 8 / 19

Quantum Zero-knowledge P ... ˜ S ˜ V V ρ σ Quantum computational zero-knowledge ρ and σ cannot be efficiently distinguished: ∀ quantum poly-time A : | Pr [ A ( ρ ) = 1] − Pr [ A ( σ ) = 1] | ≤ negl ( n ) 8 / 19

Zero-knowledge for quantum proofs 9 / 19

Zero-knowledge for quantum proofs Assuming qOWF: QMA ⊆ QZK since PSPACE = CZK ⊆ QZK Need to go through QMA ⊆ PP Desired: Efficient prover with QMA witness 9 / 19

Zero-knowledge for quantum proofs Assuming qOWF: QMA ⊆ QZK since PSPACE = CZK ⊆ QZK Need to go through QMA ⊆ PP Desired: Efficient prover with QMA witness BJSW’16: QMA ⊆ QZK with efficient prover Multiple rounds of communication Somewhat complicated 9 / 19

Zero-knowledge for quantum proofs Assuming qOWF: QMA ⊆ QZK since PSPACE = CZK ⊆ QZK Need to go through QMA ⊆ PP Desired: Efficient prover with QMA witness BJSW’16: QMA ⊆ QZK with efficient prover Multiple rounds of communication Somewhat complicated B G 19: explore Locally Simulatable codes from G SY19 9 / 19

Zero-knowledge for quantum proofs Assuming qOWF: QMA ⊆ QZK since PSPACE = CZK ⊆ QZK Need to go through QMA ⊆ PP Desired: Efficient prover with QMA witness BJSW’16: QMA ⊆ QZK with efficient prover Multiple rounds of communication Somewhat complicated B G 19: explore Locally Simulatable codes from G SY19 Applications in Cryptography ⋆ “commit-and-open” Proof of Knowledge QZK proof for QMA ⋆ “commit-and-open” Proof of Knowledge QSZK argument for QMA ⋆ QNISZK for QMA in the secret parameters setup 9 / 19

Zero-knowledge for quantum proofs Assuming qOWF: QMA ⊆ QZK since PSPACE = CZK ⊆ QZK Need to go through QMA ⊆ PP Desired: Efficient prover with QMA witness BJSW’16: QMA ⊆ QZK with efficient prover Multiple rounds of communication Somewhat complicated B G 19: explore Locally Simulatable codes from G SY19 Applications in Cryptography ⋆ “commit-and-open” Proof of Knowledge QZK proof for QMA ⋆ “commit-and-open” Proof of Knowledge QSZK argument for QMA ⋆ QNISZK for QMA in the secret parameters setup Applications in Complexity theory ⋆ QMA-hardness of Consistency of local density matrices problem under Karp reductions (open for 15 years!) ⋆ Locally Simulatable proofs 9 / 19

Zero-knowledge for quantum proofs Assuming qOWF: QMA ⊆ QZK since PSPACE = CZK ⊆ QZK Need to go through QMA ⊆ PP Desired: Efficient prover with QMA witness BJSW’16: QMA ⊆ QZK with efficient prover Multiple rounds of communication Somewhat complicated B G 19: explore Locally Simulatable codes from G SY19 Applications in Cryptography ⋆ “commit-and-open” Proof of Knowledge QZK proof for QMA ⋆ “commit-and-open” Proof of Knowledge QSZK argument for QMA ⋆ QNISZK for QMA in the secret parameters setup Applications in Complexity theory ⋆ QMA-hardness of Consistency of local density matrices problem under Karp reductions (open for 15 years!) ⋆ Locally Simulatable proofs 9 / 19

Consistency of local density matrices problem 10 / 19

Consistency of local density matrices problem Input: Reduced density matrices ρ 1 , ..., ρ m on k -qubits � � Output: yes: ∃ ψ such that ∀ i : � Tr S i ( ψ ) − ρ i � ≤ ε � � � � 1 no: ∀ ψ , ∃ i : � Tr S i ( ψ ) − ρ i � ≥ � � poly ( n ) 10 / 19

Consistency of local density matrices problem Input: Reduced density matrices ρ 1 , ..., ρ m on k -qubits � � Output: yes: ∃ ψ such that ∀ i : � Tr S i ( ψ ) − ρ i � ≤ ε � � � � 1 no: ∀ ψ , ∃ i : � Tr S i ( ψ ) − ρ i � ≥ � � poly ( n ) Liu’06: containment in QMA, and partial result on QMA-hardness 10 / 19

Consistency of local density matrices problem Input: Reduced density matrices ρ 1 , ..., ρ m on k -qubits � � Output: yes: ∃ ψ such that ∀ i : � Tr S i ( ψ ) − ρ i � ≤ ε � � � � 1 no: ∀ ψ , ∃ i : � Tr S i ( ψ ) − ρ i � ≥ � � poly ( n ) Liu’06: containment in QMA, and partial result on QMA-hardness B G ’19: QMA-hardness 10 / 19

Very simple ZK proof for QMA P V ρ 1 , ..., ρ m 11 / 19

Very simple ZK proof for QMA P V ψ ⊗ ℓ ρ 1 , ..., ρ m 11 / 19

Very simple ZK proof for QMA P V X a Z b ψ ⊗ ℓ Z b X a ρ 1 , ..., ρ m a 1 , b 1 a 2 , b 2 ... a n − 1 , b n − 1 a n , b n 11 / 19

Very simple ZK proof for QMA P V X a Z b ψ ⊗ ℓ Z b X a ρ 1 , ..., ρ m 11 / 19

Very simple ZK proof for QMA P V a 1 , b 1 → 564651 ρ 1 , ..., ρ m a 2 , b 2 → 984565 ... X a Z b ψ ⊗ ℓ X a Z b a n , b n → 894102 ... 11 / 19

Very simple ZK proof for QMA P V a 1 , b 1 → 564651 ρ 1 , ..., ρ m a 2 , b 2 → 984565 i ... X a Z b ψ ⊗ ℓ X a Z b a n , b n → 894102 ... 11 / 19

Very simple ZK proof for QMA P V a 1 , b 1 → 564651 ρ 1 , ..., ρ m a 2 , b 2 → 984565 i ... X a Z b ψ ⊗ ℓ X a Z b a n , b n → 894102 984565 , 894102 keys to open otp of copies of ρ i ... 11 / 19